@open-everywhere/provider-slack 0.1.0

package/agent/channels/slack-front.ts

@@ -0,0 +1,2349 @@
+// Component 2 wake path — MOUNTED).
+//
+// Slack delivers EVERY subscribed event to ONE Request URL. Eve's `slackChannel` owns that
+// URL and only acts on `app_mention` + `message.im` (DM); a plain `message.channels` reply is
+// silently dropped, and Eve exposes no `onMessage` hook. So to get "reply without re-tagging"
+// we FRONT the public URL with our own route and forward the events slackChannel handles to
+// its own handler — no dispatch fork (option (b)), no upstream dependency (option (a)).
+//
+// The design (why it's clean):
+//   • The wrapped `slackChannel` is pointed at an INTERNAL route (`/eve/v1/slack/mention`).
+//   • OUR route sits at the PUBLIC `/eve/v1/slack` (the URL Slack POSTs to).
+//   • Both routes live on the SAME channel object (one file → one channel name → ONE session
+//     namespace and ONE `send`). So forwarding `args` straight through gives slackChannel the
+//     exact `send`/continuation machinery it would get if mounted directly, AND our wake uses
+//     the same `send` → `slackContinuationToken(channel, thread)` continues the very session
+//     the mention started. That shared namespace is the whole reason (c) works.
+//
+// The front route:
+//   1. Buffers the RAW body ONCE (needed for BOTH signature verification AND forwarding).
+//   2. Verifies the Slack signature over that raw body (fail-closed 401). We re-implement the
+//      HMAC here because Eve's `verifySlackRequest` isn't a public export; slackChannel still
+//      re-verifies on the forward path (a fresh Request re-reads the body), so the mention
+//      path's auth is unchanged — we only ADD a gate, never weaken one.
+//   3. Classifies the envelope: url_verification / block_actions interaction → FORWARD to
+//      slackChannel's handler; message.im and message.mpim (the DM FAMILY) → divert into the
+//      surface's own standing DM window (OPE-351 stages 2 + 4), never forwarded; app_mention →
+//      FORWARD too, UNLESS either the single-window mention policy (unified-window.ts seam) says
+//      the unified window owns it — then the app_mention EVENT ITSELF is diverted to the unified
+//      supervisor as an addressed direct-mention wake (single-leg: ONE decision on ONE webhook),
+//      and its message.channels sibling is dropped exactly as always — or the mention landed in a
+//      GROUP DM, which the envelope does not say and a conversations.info read has to answer, in
+//      which case it diverts into that mpim's DM window and its message.mpim sibling is dropped;
+//      plain message.channels/groups → run the engagement wake (routeMessageEvent);
+//      member_joined_channel (the bot's own join) → the channel-join intro
+//      (routeChannelJoinEvent); a urlencoded `block_actions` payload whose actions carry an
+//      `oe_approval:` action id → OURS,
+//      handled locally via `handleApprovalPayload` and NEVER forwarded — every other
+//      urlencoded body (Eve's own `eve_input:` HITL clicks, view_submission, slash
+//      commands) still forwards exactly as before.
+//   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
+
+import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
+import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
+import { slackContinuationToken } from "eve/channels/slack";
+import { callSlackWebApi } from "./slack-web-api.js";
+import {
+  auditDmBotAuthorDrop,
+  auditDmDriverAdmitted,
+  dmDoorAdmitsDriver,
+  parseMessageEvent,
+  routeMessageEvent,
+  liveDeps,
+  routeNameDropEvent,
+  liveNameDropDeps,
+  parseChannelJoinEvent,
+  routeChannelJoinEvent,
+  liveChannelJoinDeps,
+  parseSlackReactionEvent,
+  routeReactionEvent,
+  liveReactionDeps,
+  routeSupervisorEvent,
+  liveSupervisorDeps,
+  supervisorFifoKey,
+  bindableFor,
+  bindableForJoin,
+  bindableForReaction,
+  slackSingleWindowMentionPolicy,
+  slackDomainUsesUnifiedWindow,
+  slackFrontTenantFenceDeclined,
+  slackInteractivityTenantFenceDeclined,
+  type SlackEventEnvelope,
+  type ParsedMessageEvent,
+  type NameDropContextHydrator,
+  type RouteOutcome,
+} from "./slack-events.js";
+import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
+import {
+  EventDedupe,
+  ThreadFifo,
+  getOrCreateDmSeat as liveGetOrCreateDmSeat,
+  touchDmSeat as liveTouchDmSeat,
+  dmSeatThresholds,
+  resolvePartition,
+  domainKeyOf,
+  isThreadEngaged,
+  divertInboundToUnifiedWindow,
+  isPrunedDeploymentWakeError,
+  markUndeliveredAfterHeal,
+  isUndeliveredAfterHeal,
+  healPrunedDeploymentStrand,
+  mintWakeId,
+  slackVendorEventTime,
+  spreadVendorTs,
+  resolveWakeTrust,
+  ambientSupervisorEnabled,
+  getConfig,
+  getOperationalStore,
+  OE_APPROVAL_PREFIX,
+  handleApprovalPayload as liveHandleApprovalPayload,
+  OE_SETKEY_ACTION_PREFIX,
+  OE_SETKEY_MODAL_CALLBACK,
+  handleSetKeyClick as liveHandleSetKeyClick,
+  handleSetKeyViewSubmission as liveHandleSetKeyViewSubmission,
+  OE_CONNECT_ACTION_PREFIX,
+  handleConnectClick as liveHandleConnectClick,
+  OE_GRANT_ACTION_PREFIX,
+  OE_INPUT_CLICK_PREFIX,
+  handleGrantCardClick as liveHandleGrantCardClick,
+  buildRecord,
+  enqueue as enqueueLogRecord,
+  flushLogShip,
+  type SingleWindowMentionPolicy,
+  type DmSeat,
+  type SetKeyViewResult,
+  stampNonMemberChatAuth,
+  externalPolicyIsInert,
+  recordWakeTail,
+  tailAuthorGrain,
+  dmWindowRegistryKey,
+  approvalCardRespondVia,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import {
+  renderWakeMessage,
+  slackChannelFactsFor,
+  slackAuthorIsMember,
+  slackClickerIsGuest,
+  slackWakeAuthorFacts,
+  slackExternalPolicyForRoom,
+  applySlackExternalPolicy,
+  stripUnfencedSlackAttachments,
+  slackEnterpriseIdFromEnvelope,
+  _resetAuthorMemberCache,
+} from "./slack-events.js";
+import { buildSlackAuth, withForwardedSlackEnvelope, type ForwardedSlackEnvelope } from "./slack-identity.js";
+import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
+import {
+  handleSlackApprovalCardClick as liveHandleApprovalCardClick,
+  type ApprovalCardClickOutcome,
+  type ApprovalRespondFn,
+} from "./slack-approval-card.js";
+import {
+  parseSlackShortcutPayload,
+  shortcutMessageEvent,
+  shortcutWakeKey,
+  type ParsedSlackShortcut,
+} from "./slack-shortcut.js";
+
+/** An HTTP route handler — `RouteHandler` isn't a public eve export, so we mirror its shape. */
+type RouteHandler = (req: Request, args: RouteHandlerArgs) => Promise<Response>;
+
+/** The public URL Slack POSTs every subscribed event to (Event Subscriptions Request URL). */
+export const PUBLIC_SLACK_ROUTE = "/eve/v1/slack";
+/** The internal path the wrapped `slackChannel` is mounted at (never hit by Slack directly). */
+export const INTERNAL_SLACK_ROUTE = "/eve/v1/slack/mention";
+
+// --- request classification (pure) ------------------------------------------
+
+/** The decision the front route makes for one inbound request. `env` is carried on the
+ * wake/join branches, and the decoded `payload` on the approval-click branch, so the handler
+ * needn't re-parse what it already parsed to classify. */
+export type FrontDecision =
+  | { readonly kind: "forward"; readonly reason: string }
+  | { readonly kind: "wake"; readonly reason: string; readonly env: SlackEventEnvelope }
+  | { readonly kind: "join"; readonly reason: string; readonly env: SlackEventEnvelope }
+  | { readonly kind: "reaction"; readonly reason: string; readonly env: SlackEventEnvelope }
+  | { readonly kind: "approval-click"; readonly reason: string; readonly payload: unknown }
+  /** A "Set API key" button click (credentials/intake.ts) — ours: verify the clicker is the intake's
+   *  requester, then views.open a native modal. Never forwarded. */
+  | { readonly kind: "setkey-click"; readonly reason: string; readonly payload: unknown }
+  /** A `view_submission` from our credential-intake modal — ours: encrypt + store the pasted value
+   *  host-side, and RESPOND with the modal-close/errors JSON. A `view_submission` for anyone else's
+   *  modal (Eve's own) still forwards. */
+  | { readonly kind: "setkey-submit"; readonly reason: string; readonly payload: unknown }
+  /** An `oe_connect:` connector-card button click (connections/connector-card.ts) — ours: re-verify
+   *  standing host-side, then mint an ephemeral OAuth URL / open the api-key intake. Never forwarded. */
+  | { readonly kind: "connect-click"; readonly reason: string; readonly payload: unknown }
+  /** An `oe_grant:` credential-grant card button click (access/credential-grant-card.ts) — ours: the
+   *  OWNER of the ask answered it in their own DM. Core verifies the clicker IS that owner, then
+   *  approves or declines. Never forwarded. */
+  | { readonly kind: "grant-click"; readonly reason: string; readonly payload: unknown }
+  /** A tap on a BRIDGED APPROVAL CARD the unified post arm rendered (OPE-1720). OURS, never
+   *  forwarded: eve's own interactivity route resolves a click against its Slack channel's state and
+   *  session address, and this card's parked request lives on the unified window — see
+   *  `slack-approval-card.ts`'s header for why a forward could only drop it. */
+  | { readonly kind: "input-click"; readonly reason: string; readonly payload: unknown }
+  /** An `app_mention` — the native slackChannel path owns it UNLESS the handler's single-window
+   *  policy says the unified window does (then the forward is suppressed and the mention's
+   *  `message.channels` sibling carries it as an addressed wake). Carries `env` so the handler
+   *  needn't re-parse what classification already parsed — same pattern as `wake`/`join`. */
+  | { readonly kind: "mention"; readonly reason: string; readonly env: SlackEventEnvelope }
+  /** A DM-FAMILY message — a 1:1 (`message.im`, OPE-351 stage 2) or a GROUP DM (`message.mpim`,
+   *  stage 4). OURS, never forwarded: the surface's seat is a first-class standing window, so the
+   *  event is diverted into it (`scheduleDmWake`) instead of going to eve's native `onDirectMessage`
+   *  (a 1:1) or being judged by the name-drop gate that refused it outright (a group DM). `dmKind`
+   *  is the classification the envelope DID carry, so the handler needn't re-read `channel_type`;
+   *  `env` rides along like every other wake branch. */
+  | { readonly kind: "dm-wake"; readonly reason: string; readonly env: SlackEventEnvelope; readonly dmKind: "im" | "mpim" }
+  /** A Slack SHORTCUT — a message shortcut (`message_action`) or a global one (`shortcut`),
+   *  OPE-1376. OURS, never forwarded: eve's `onShortcut` hook is unconfigured on this channel, so
+   *  a forward is a guaranteed no-op, and eve's shortcut context carries no session to wake from
+   *  anyway. The decoded shortcut rides along so the handler needn't re-parse it — same pattern as
+   *  the click branches, which carry a raw `payload` because their handlers own the decode. */
+  | { readonly kind: "shortcut"; readonly reason: string; readonly shortcut: ParsedSlackShortcut };
+
+/**
+ * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
+ * payload — `undefined` for anything that isn't one (no `payload` field, unparseable JSON, a
+ * non-`block_actions` type, or a `block_actions` whose action ids are all someone else's, e.g.
+ * Eve's own `eve_input:` HITL buttons). Never throws: any parse failure just means "not ours".
+ */
+function parseOeApprovalPayload(rawBody: string): unknown | undefined {
+  const raw = new URLSearchParams(rawBody).get("payload");
+  if (!raw) return undefined;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  if (typeof payload !== "object" || payload === null) return undefined;
+  const p = payload as Record<string, unknown>;
+  if (p.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const isOurs = (p.actions as unknown[]).some(
+    (a) =>
+      typeof a === "object" &&
+      a !== null &&
+      typeof (a as Record<string, unknown>).action_id === "string" &&
+      ((a as Record<string, unknown>).action_id as string).startsWith(OE_APPROVAL_PREFIX),
+  );
+  return isOurs ? payload : undefined;
+}
+
+/** Decode the interactivity `payload` field into a plain object, or undefined if it isn't parseable
+ *  JSON-in-urlencoded. Shared by the setkey click + view_submission classifiers below. */
+function decodeInteractivityPayload(rawBody: string): Record<string, unknown> | undefined {
+  const raw = new URLSearchParams(rawBody).get("payload");
+  if (!raw) return undefined;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  return typeof payload === "object" && payload !== null ? (payload as Record<string, unknown>) : undefined;
+}
+
+/**
+ * Best-effort decode of a urlencoded body into an `oe_setkey:` "Set API key" `block_actions`
+ * payload (credentials/intake.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeSetKeyClickPayload(rawBody: string): unknown | undefined {
+  const p = decodeInteractivityPayload(rawBody);
+  if (!p || p.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const isOurs = (p.actions as unknown[]).some(
+    (a) =>
+      typeof a === "object" &&
+      a !== null &&
+      typeof (a as Record<string, unknown>).action_id === "string" &&
+      ((a as Record<string, unknown>).action_id as string).startsWith(OE_SETKEY_ACTION_PREFIX),
+  );
+  return isOurs ? p : undefined;
+}
+
+/**
+ * Best-effort decode of a urlencoded body into an `oe_connect:` connector-card `block_actions` payload
+ * (connections/connector-card.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeConnectClickPayload(rawBody: string): unknown | undefined {
+  const p = decodeInteractivityPayload(rawBody);
+  if (!p || p.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const isOurs = (p.actions as unknown[]).some(
+    (a) =>
+      typeof a === "object" &&
+      a !== null &&
+      typeof (a as Record<string, unknown>).action_id === "string" &&
+      ((a as Record<string, unknown>).action_id as string).startsWith(OE_CONNECT_ACTION_PREFIX),
+  );
+  return isOurs ? p : undefined;
+}
+
+/**
+ * Best-effort decode of a urlencoded body into an `oe_grant:` credential-grant card `block_actions`
+ * payload (access/credential-grant-card.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeGrantClickPayload(rawBody: string): unknown | undefined {
+  const p = decodeInteractivityPayload(rawBody);
+  if (!p || p.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const isOurs = (p.actions as unknown[]).some(
+    (a) =>
+      typeof a === "object" &&
+      a !== null &&
+      typeof (a as Record<string, unknown>).action_id === "string" &&
+      ((a as Record<string, unknown>).action_id as string).startsWith(OE_GRANT_ACTION_PREFIX),
+  );
+  return isOurs ? p : undefined;
+}
+
+/**
+ * Best-effort decode of a urlencoded body into an `oe_input:` bridged-approval-card `block_actions`
+ * payload (core channels/approval-card.ts) — undefined for anything that isn't one. Never throws.
+ *
+ * 🔴 NOT eve's `eve_input:`, which still FORWARDS. The two prefixes are one character apart on
+ * purpose — both name an input request — and only one of them is ours. `startsWith` distinguishes
+ * them cleanly because neither is a prefix of the other, and the order of the two branches never
+ * matters: eve's clicks reach no branch here at all and fall to the urlencoded forward.
+ */
+function parseOeInputClickPayload(rawBody: string): unknown | undefined {
+  const p = decodeInteractivityPayload(rawBody);
+  if (!p || p.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const isOurs = (p.actions as unknown[]).some(
+    (a) =>
+      typeof a === "object" &&
+      a !== null &&
+      typeof (a as Record<string, unknown>).action_id === "string" &&
+      ((a as Record<string, unknown>).action_id as string).startsWith(OE_INPUT_CLICK_PREFIX),
+  );
+  return isOurs ? p : undefined;
+}
+
+/**
+ * Best-effort decode of a urlencoded body into OUR credential-intake `view_submission` (its
+ * `view.callback_id` is our modal's) — undefined for any other view_submission (Eve's own modals
+ * still forward). Never throws.
+ */
+function parseOeSetKeyViewSubmission(rawBody: string): unknown | undefined {
+  const p = decodeInteractivityPayload(rawBody);
+  if (!p || p.type !== "view_submission") return undefined;
+  const view = p.view as Record<string, unknown> | undefined;
+  return view?.callback_id === OE_SETKEY_MODAL_CALLBACK ? p : undefined;
+}
+
+/**
+ * The ids one already-decoded INTERACTIVITY payload names, for the tenant fence at the six click
+ * branches (OPE-1680). The tenant half comes from {@link slackInteractivityTenantIds}, which is the
+ * one reader of Slack's three Grid spellings; the room half is read here because only the fence's
+ * AUDIT ROW wants it — the admission decision never turns on a channel.
+ *
+ * A `view_submission` names no `channel` at all (it names a view), which is exactly why the row
+ * writer takes an optional channel rather than demanding one.
+ */
+function interactivityFenceIds(payload: unknown): {
+  readonly teamId?: string;
+  readonly enterpriseId?: string;
+  readonly channelId?: string;
+  readonly userId?: string;
+} {
+  const p = payload as Record<string, unknown> | null | undefined;
+  const obj = (v: unknown): Record<string, unknown> | undefined => (typeof v === "object" && v !== null ? (v as Record<string, unknown>) : undefined);
+  const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+  const channelId = str(obj(p?.channel)?.id);
+  const userId = str(obj(p?.user)?.id);
+  return {
+    ...slackInteractivityTenantIds(payload),
+    ...(channelId === undefined ? {} : { channelId }),
+    ...(userId === undefined ? {} : { userId }),
+  };
+}
+
+/**
+ * Decide how the front route handles a raw inbound body. FORWARD is the fail-safe default:
+ * anything slackChannel owns (the challenge handshake, `app_mention`, a `block_actions`/slash
+ * interaction) or anything unrecognized goes to slackChannel unchanged. The DM FAMILY is ours:
+ * `message.im` (OPE-351 stage 2) and `message.mpim` (stage 4) classify `dm-wake` and are diverted
+ * into the surface's own standing window. The other events slackChannel drops route to us too: a
+ * plain channel/group `message` → the engagement wake, `member_joined_channel` → the channel-join
+ * intro, and a urlencoded `block_actions` payload carrying an `oe_approval:` action id → the
+ * approval-click handler (ours alone). A urlencoded SHORTCUT payload (`message_action` /
+ * `shortcut`, OPE-1376) is ours too — every OTHER urlencoded body, including Eve's `eve_input:`
+ * clicks, its view_submissions and slash commands, still forwards. No network I/O and NO side
+ * effects, so every branch is unit-tested. Classification decides what a request IS; nothing here
+ * may write process state, because every gate that decides whether the request WAKES anything runs
+ * later in the handler (OPE-1442). The absence of a lookup is also why the
+ * GROUP-DM app_mention leg is decided in the HANDLER and not here: it needs a Slack lookup, because
+ * an app_mention envelope carries no `channel_type` to classify on.
+ */
+export function classifyEnvelope(rawBody: string, contentType: string): FrontDecision {
+  // Interactions (button clicks, slash commands) arrive urlencoded (`payload=...`).
+  if (contentType.includes("application/x-www-form-urlencoded")) {
+    const approvalPayload = parseOeApprovalPayload(rawBody);
+    if (approvalPayload !== undefined) {
+      return { kind: "approval-click", reason: "block_actions oe_approval: click — ours, never forwarded", payload: approvalPayload };
+    }
+    const setKeyClick = parseOeSetKeyClickPayload(rawBody);
+    if (setKeyClick !== undefined) {
+      return { kind: "setkey-click", reason: "block_actions oe_setkey: click — ours, never forwarded", payload: setKeyClick };
+    }
+    const setKeySubmit = parseOeSetKeyViewSubmission(rawBody);
+    if (setKeySubmit !== undefined) {
+      return { kind: "setkey-submit", reason: "view_submission for our credential-intake modal — ours, never forwarded", payload: setKeySubmit };
+    }
+    const connectClick = parseOeConnectClickPayload(rawBody);
+    if (connectClick !== undefined) {
+      return { kind: "connect-click", reason: "block_actions oe_connect: click — ours, never forwarded", payload: connectClick };
+    }
+    const grantClick = parseOeGrantClickPayload(rawBody);
+    if (grantClick !== undefined) {
+      return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
+    }
+    const inputClick = parseOeInputClickPayload(rawBody);
+    if (inputClick !== undefined) {
+      return { kind: "input-click", reason: "block_actions oe_input: click — ours, never forwarded", payload: inputClick };
+    }
+    // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
+    // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
+    // matched LAST among the urlencoded branches and cannot race any of them: every branch above
+    // reads a `block_actions` or a `view_submission`, and a shortcut is neither.
+    const shortcut = parseSlackShortcutPayload(decodeInteractivityPayload(rawBody));
+    if (shortcut) {
+      return { kind: "shortcut", reason: `${shortcut.kind} shortcut "${shortcut.callbackId}" — ours, never forwarded`, shortcut };
+    }
+    return { kind: "forward", reason: "urlencoded interaction/slash — slackChannel owns it" };
+  }
+  let env: SlackEventEnvelope;
+  try {
+    env = JSON.parse(rawBody) as SlackEventEnvelope;
+  } catch {
+    return { kind: "forward", reason: "unparseable body — let slackChannel ack it" };
+  }
+  if (env?.type === "url_verification") {
+    return { kind: "forward", reason: "url_verification challenge — slackChannel answers it" };
+  }
+  if (env?.type !== "event_callback") {
+    return { kind: "forward", reason: `outer type "${String(env?.type)}" — not an event we wake on` };
+  }
+  const eventType = typeof env.event?.type === "string" ? env.event.type : undefined;
+  if (eventType === "app_mention") {
+    // Not a bare "forward": the handler must first ask the single-window policy whether the
+    // unified window owns this mention (suppress the native forward) — the default answer is
+    // "forward to the mention path", byte-identical to before the branch existed.
+    return { kind: "mention", reason: "app_mention — the mention path owns it unless single-window suppresses", env };
+  }
+  if (eventType === "member_joined_channel") {
+    return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
+  }
+  if (eventType === "reaction_added" || eventType === "reaction_removed") {
+    // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
+    // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
+    return { kind: "reaction", reason: `${eventType} — reaction ingestion candidate`, env };
+  }
+  if (eventType !== "message") {
+    return { kind: "forward", reason: `event "${String(eventType)}" — not a message` };
+  }
+  const channelType = typeof (env.event as Record<string, unknown>).channel_type === "string"
+    ? ((env.event as Record<string, unknown>).channel_type as string)
+    : undefined;
+  if (channelType === "im") {
+    // OPE-351 stage 2: a 1:1 DM is no longer forwarded to eve's native `onDirectMessage`. Its seat is
+    // a first-class standing WINDOW (channels/dm-seat.ts), so the DM is diverted onto the `unified`
+    // channel exactly like the single-window app_mention above — one decision, one webhook.
+    return { kind: "dm-wake", reason: "message.im (DM) — the DM window seat owns it", env, dmKind: "im" };
+  }
+  if (channelType === "mpim") {
+    // OPE-351 stage 4: a GROUP DM joins the family. Its previous route was the engagement wake below,
+    // where `shouldNameDropWake` refused it outright on channel_type — so a non-mention message in a
+    // group DM woke NOTHING, and the room's only live path was an `app_mention` forwarded to eve's
+    // native per-thread session. Both halves move into the mpim's own standing window (the mention
+    // half in the `mention` branch of the handler, which has to ASK Slack what surface it landed on —
+    // an app_mention envelope carries no channel_type).
+    return { kind: "dm-wake", reason: "message.mpim (group DM) — the DM window seat owns it", env, dmKind: "mpim" };
+  }
+  // channels / groups — the plain reply slackChannel drops. Ours to wake.
+  return { kind: "wake", reason: `message.${channelType ?? "?"} — engagement wake candidate`, env };
+}
+
+/** The FIFO key a DM's wakes serialize on. Generation-INDEPENDENT (the same reasoning as
+ *  `supervisorFifoKey`): the FIFO's job is to serialize this DM's wakes, which must hold ACROSS a
+ *  rotation boundary too, so it keys on the channel and never on the generation-bearing token. Its
+ *  own namespace, so a DM's queue is never shared with a channel supervisor's or a thread's. */
+export function dmFifoKey(dmChannelId: string): string {
+  return `${dmChannelId}:oe-dm`;
+}
+
+// --- signature verification (Slack HMAC) ------------------------------------
+
+const SLACK_MAX_SKEW_SECONDS = 60 * 5; // Slack's own replay window.
+
+/**
+ * Verify a Slack request signature over the RAW body (the exact bytes Slack signed).
+ * `v0=` HMAC-SHA256 of `v0:{timestamp}:{body}` keyed by the signing secret, constant-time
+ * compared, with a 5-minute replay window. Fail-closed: any missing header / secret, a stale
+ * timestamp, or a mismatch returns false. `nowMs` is injectable so the replay window is tested.
+ *
+ * The BASESTRING AND DIGEST are `channels/slack-signature.ts`'s (OPE-197), shared verbatim with the
+ * webhook-registry entry for this scheme — a difference there would be a signature that verifies on
+ * one route and 401s on the other. What stays HERE is what the two routes legitimately differ on:
+ * this one reads one env-homed secret and returns a bare boolean, because a Slack Request URL has no
+ * failure vocabulary to report into.
+ */
+export function verifySlackSignature(
+  rawBody: string,
+  headers: Headers,
+  signingSecret: string | undefined,
+  nowMs: number = Date.now(),
+): boolean {
+  const timestamp = headers.get(SLACK_TIMESTAMP_HEADER);
+  const signature = headers.get(SLACK_SIGNATURE_HEADER);
+  if (!signingSecret || !timestamp || !signature) return false;
+  const ts = Number(timestamp);
+  if (!Number.isFinite(ts) || Math.abs(nowMs / 1000 - ts) > SLACK_MAX_SKEW_SECONDS) return false;
+  return slackSignatureMatches(signingSecret, timestamp, rawBody, signature);
+}
+
+// --- retry de-dupe + per-thread FIFO: LIFTED to core (OPE-114 stage 4) ----------------------
+// EventDedupe and ThreadFifo are provider-neutral front-door plumbing (teams-front rides them
+// too) — they now live in core channels/front-queue.ts, imported through the barrel below and
+// re-exported here so bundle-internal import sites (slack-commands, tests) are unchanged.
+export { EventDedupe, ThreadFifo };
+
+// --- bot identity (mention suppression) -------------------------------------
+
+/**
+ * The bot's own Slack user id, resolved once via `auth.test` (cached). Needed because Slack
+ * fires BOTH `app_mention` AND `message.channels` for a message that @mentions the app; the
+ * mention path already owns the `app_mention`, so on the wake path we DROP a message whose
+ * AUTHORED text still carries `<@bot>` to avoid a double turn. Authored, not the parsed `text`:
+ * that now carries forwarded content too, and a forward quoting a bot mention must still wake
+ * (OPE-1374). Best-effort: if it can't be resolved
+ * (no token / API error) we don't suppress — an occasional double is better than dropping a
+ * genuine engaged reply. `SLACK_BOT_TOKEN` is already required for the bot to post at all, so
+ * in practice this resolves.
+ */
+let botIdentityPromise: Promise<{ readonly userId?: string; readonly botId?: string }> | undefined;
+
+export function resolveBotIdentity(): Promise<{ readonly userId?: string; readonly botId?: string }> {
+  if (!botIdentityPromise) {
+    botIdentityPromise = (async () => {
+      try {
+        // Via OE's `callSlackWebApi` (the 429-backoff seam); a missing token makes it throw, and any
+        // throw → {} (best-effort — we simply don't suppress on failure).
+        const json = (await callSlackWebApi({ botToken: undefined, operation: "auth.test", body: {} })) as {
+          ok?: boolean;
+          user_id?: string;
+          bot_id?: string;
+        };
+        return json.ok ? { userId: json.user_id, botId: json.bot_id } : {};
+      } catch {
+        return {};
+      }
+    })();
+  }
+  return botIdentityPromise;
+}
+
+/** Reset the cached identity (tests only). */
+export function _resetBotIdentity(): void {
+  botIdentityPromise = undefined;
+}
+
+// --- the composed channel ---------------------------------------------------
+
+/** Injectable seams so the wake path is testable without live crypto / Slack. */
+export interface FrontOptions {
+  readonly signingSecret?: string;
+  readonly dedupe?: EventDedupe;
+  readonly fifo?: ThreadFifo;
+  readonly getBotIdentity?: () => Promise<{ readonly userId?: string; readonly botId?: string }>;
+  readonly now?: () => number;
+  /** Durable first-sighting check (true = proceed). Defaults to the operational store. */
+  readonly markEventSeen?: (org: string, key: string, atIso: string) => Promise<boolean>;
+  /** Is ambient-supervisor mode enabled for this channel's domain? (sync config lookup.)
+   *  Defaults to the live domain resolver (memory/domain.ts). Fail-closed off: when this
+   *  returns false the unowned-message dispatch is BYTE-IDENTICAL to today's name-drop path. */
+  readonly ambientEnabledFor?: (surfaceKey: string) => boolean;
+  /** Does this channel have a STANDING SEAT (OPE-1695)? Defaults to the live predicate
+   *  (slack-events.ts slackDomainUsesUnifiedWindow: the capability plus a seat domain). It decides
+   *  ONE thing here — whether an ADDRESSED wake has a seat road to take when the chattiness flag is
+   *  off. False keeps the pre-seat drop, so a deployment with the capability unarmed is unchanged. */
+  readonly seatedSurfaceFor?: (surfaceKey: string) => boolean;
+  /** Approval-click handler (defaults to the real `agent/approvals/flow.ts`). Injectable so
+   * tests can stub it without the propose/store/executor machinery it drags in.
+   *
+   * 🔴 IT TAKES THE ROUTE'S `waitUntil` (OPE-1709), for the same reason the Discord front's
+   * approval branch does: "Approve for session" releases the sibling cards the grant already
+   * covers, and each release runs a real `execute`. That work belongs off the interactivity
+   * response path. The handler falls back to its old awaited shape when this is absent, which is
+   * exactly what a stub that ignores the second argument gets. */
+  readonly handleApprovalPayload?: (payload: unknown, deps?: { waitUntil?: (p: Promise<unknown>) => void }) => Promise<boolean>;
+  /** "Set API key" click handler (defaults to the real `agent/credentials/intake.ts`) — verifies the
+   *  clicker owns the intake, then views.open the modal. Injectable for tests. */
+  readonly handleSetKeyClick?: (payload: unknown) => Promise<boolean>;
+  /** Credential-modal `view_submission` handler (defaults to `agent/credentials/intake.ts`) —
+   *  encrypts + stores the value and returns the modal-close/errors JSON. Injectable for tests. */
+  readonly handleSetKeyViewSubmission?: (payload: unknown) => Promise<SetKeyViewResult>;
+  /** Connector-card `oe_connect:` click handler (defaults to `agent/connections/connector-card.ts`) —
+   *  re-verifies standing host-side, then mints an ephemeral OAuth URL / opens the api-key intake.
+   *  Injectable for tests. */
+  readonly handleConnectClick?: (payload: unknown) => Promise<boolean>;
+  /** Injected in tests; the live default is core's `handleGrantCardClick`. The signed grant-click
+   *  branch schedules it through the route's `waitUntil`, so this handler may outlive the empty
+   *  Slack acknowledgement. */
+  readonly handleGrantCardClick?: (payload: unknown) => Promise<boolean>;
+  /** Bridged-approval-card `oe_input:` tap handler (OPE-1720, defaults to
+   *  `./slack-approval-card.ts`). Injectable so the classification and the branch are testable
+   *  without a store, a Slack token or eve's `respond` primitive. */
+  readonly handleApprovalCardClick?: (payload: unknown, respond: ApprovalRespondFn) => Promise<ApprovalCardClickOutcome>;
+  /** SINGLE-WINDOW mention policy for one (channel, surface) — should the unified window own an
+   *  @mention here (suppress the native forward + keep the sibling as an addressed wake)?
+   *  Defaults to the live {@link slackSingleWindowMentionPolicy} (grain + fail-closed
+   *  internal-channel confirmation). Injectable so the two mention legs are testable without a
+   *  live config/Slack; fail-closed off: the default answers "native owns it" for every
+   *  non-single-window domain, byte-identical to today. */
+  readonly mentionPolicyFor?: (channelId: string, surfaceKey: string) => Promise<SingleWindowMentionPolicy>;
+  /** Resolve (create/adopt/rotate/resume) the DM seat for a wake, KEYED ON THE SURFACE KEY since
+   *  OPE-351 stage 2 (the window token and its registry row are both surface-keyed). `channelId` is
+   *  the raw platform id the rotation distiller fetches history with; `legacyChannelId` is the
+   *  one-time adopt-from-OPE-90 probe, supplied for a 1:1 only — a group DM never had such a row.
+   *  Defaults to the live store-backed {@link liveGetOrCreateDmSeat} with the tail-carrying
+   *  distiller. Injectable for tests. */
+  readonly resolveDmSeat?: (org: string, dm: { surfaceKey: string; channelId?: string; legacyChannelId?: string }, atIso: string) => Promise<DmSeat>;
+  /** Record one wake on the DM seat (lastWakeAt/turnCount). Defaults to {@link liveTouchDmSeat}. */
+  readonly touchDmSeatFn?: (org: string, dmSurfaceKey: string, atIso: string) => Promise<void>;
+  /** DM-partner trust lookup (`users.info`) — feeds `dm_partner_trust`, which gates a 1:1 DM's SHARED
+   *  read layer (internal ⇒ `dm` trust, external ⇒ `public`). FAIL-CLOSED: undefined ⇒ the attribute
+   *  is omitted ⇒ the binding treats the partner as external. Defaults to the live cached lookup.
+   *  NOT consulted for a GROUP DM — see `scheduleDmWake`'s note on why the attribute is 1:1-only. */
+  readonly dmPartnerTrustFor?: (userId: string, teamId: string | undefined) => Promise<"internal" | "external" | undefined>;
+  /** The channel FACTS the envelope doesn't carry (`conversations.info`, TTL-cached, fail-soft):
+   *  the surface's `channelType` — the only way to tell a GROUP-DM `app_mention` from a channel's,
+   *  since an app_mention envelope has no `channel_type` — and the trust gate's confirmed-internal
+   *  verdict, which stands in for the DM-partner check a group DM cannot make. Defaults to the live
+   *  {@link slackChannelFactsFor}. Injectable so both mpim legs are testable without Slack; a stub
+   *  answering `{ internal: false }` reproduces the missing-`mpim:read` degradation exactly.
+   *
+   *  `appCanRead` is the shortcut route's file gate (OPE-1442) and is FAIL-CLOSED: an omitted or
+   *  false value withholds the target message's files. A stub that leaves it out therefore
+   *  reproduces "the app cannot read this room", which is the safe default for a test to inherit.
+   *
+   *  `extShared`/`trustChecked` are the RAW platform halves `internal` joins away (OPE-1486) — the
+   *  group-DM wake stamps them so `bindSlack` grades an mpim on the same two facts a channel is
+   *  graded on. Both are POSITIVE-ONLY: an omitted value stamps nothing, so a stub that leaves them
+   *  out reproduces "the platform said nothing about sharing", which demotes no room. */
+  readonly channelFactsFor?: (
+    channelId: string,
+  ) => Promise<{ internal: boolean; channelType?: string; appCanRead?: boolean; extShared?: boolean; trustChecked?: boolean }>;
+  /** Open (or reuse) the 1:1 DM channel with a Slack member, returning its `D…` id — the landing
+   *  place a GLOBAL shortcut wakes in (OPE-1376), since a global shortcut names no conversation.
+   *  `conversations.open` is idempotent, so this is a resolve rather than a create. Needs the
+   *  `im:write` bot scope, which the runbook and the wizard manifest already require for the
+   *  governance DM-delivery arm. Defaults to the live call; FAIL-CLOSED: undefined ⇒ the shortcut
+   *  wakes nothing and says so, never a wake in a guessed room. Injectable for tests. */
+  readonly openDirectMessageChannel?: (userId: string) => Promise<string | undefined>;
+  /** The trigger author's two membership facts, from ONE `users.info` probe — the exact pair every
+   *  wake route in slack-events.ts resolves. Two readers: the native `app_mention` forward's
+   *  external-policy gate, which calls it only when that policy is not inert (so a deployment on the
+   *  shipped grains pays nothing there), and every GROUP-DM wake (OPE-1486), which reads its
+   *  `refuted` half unconditionally — a guest who writes in an mpim must mark the turn whatever the
+   *  policy grain is. Defaults to the live {@link slackWakeAuthorFacts}; injectable so both are
+   *  testable without Slack. */
+  readonly authorFactsFor?: (
+    channelInternal: boolean,
+    userId: string | undefined,
+    teamId: string | undefined,
+  ) => Promise<{ readonly surfaceInternal: boolean; readonly refuted: boolean }>;
+}
+
+const OK = () => new Response("ok");
+
+/**
+ * The Enterprise Grid rung a forwarded delivery carries, paired with the message it describes
+ * (OPE-1559). `undefined` for an ordinary single-workspace install, for an interactivity body, and
+ * for anything this route could not parse — the native forward then stows nothing and `slack.ts`
+ * stamps no rung, exactly as before.
+ *
+ * The rung itself comes from {@link slackEnterpriseIdFromEnvelope}, the ONE reader of
+ * `enterprise_id`; this function only pairs it with the inner event's `(channel, ts)`, which is what
+ * lets `forwardedSlackEnterpriseId` (slack-identity.ts) answer for that message alone. A Grid
+ * envelope whose inner event names neither returns `undefined`: an unpairable rung is a rung this
+ * route will not carry.
+ */
+function forwardedEnvelopeOf(rawBody: string): ForwardedSlackEnvelope | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return undefined;
+  }
+  // `JSON.parse` answers `null` for the body `null`, and a scalar for `1` or `"x"` — none of which
+  // throws, and all of which would make the field reads below throw INSTEAD OF returning undefined.
+  // A throw here escapes `forwardNative` and turns a forward that used to ack 200 into a 500 that
+  // Slack retries, so the shape is checked rather than assumed.
+  if (parsed === null || typeof parsed !== "object") return undefined;
+  const env = parsed as SlackEventEnvelope;
+  const enterpriseId = slackEnterpriseIdFromEnvelope(env);
+  if (enterpriseId === undefined) return undefined;
+  const event = env.event;
+  const channelId = typeof event?.channel === "string" ? event.channel : undefined;
+  const ts = typeof event?.ts === "string" ? event.ts : undefined;
+  if (!channelId || !ts) return undefined;
+  return { enterpriseId, channelId, ts };
+}
+
+/** The event_id (retry-stable) or `(channel, ts)` key we de-dupe a wake candidate on.
+ *  Prefixed with the RECEIVING bot identity (constant "default" today): with N Slack apps
+ *  in one channel (item 27 tier 2) each app receives its own copy of every message, and
+ *  an un-prefixed key would swallow one app's copy as the other's retry — silently, per
+ *  message, maddening to debug. The TTL'd dedupe store self-heals across the change. */
+function wakeKey(env: SlackEventEnvelope, channelId: string, ts: string, botIdentity = "default"): string {
+  const eventId = typeof env.event_id === "string" ? env.event_id : undefined;
+  return `${botIdentity}:${eventId ?? `${channelId}:${ts}`}`;
+}
+
+/**
+ * Resolve the 1:1 DM channel with one Slack member (OPE-1376's global-shortcut landing place).
+ *
+ * `conversations.open` is idempotent — repeated calls return the SAME `im` channel id — so there is
+ * no "already open" branch, and this opens no conversation a global shortcut's invoker did not
+ * themselves ask for by pressing the shortcut.
+ *
+ * FAIL-CLOSED and QUIET-ON-THE-WIRE: any failure (no token, a workspace without `im:write`, a user
+ * who cannot be DM'd) returns `undefined`, which the caller turns into "wake nothing, log why".
+ * Returning a guess would put a person's shortcut into a room they did not choose.
+ */
+async function liveOpenDirectMessageChannel(userId: string): Promise<string | undefined> {
+  try {
+    const opened = await callSlackWebApi({ botToken: undefined, operation: "conversations.open", body: { users: userId } });
+    if (opened?.ok !== true) return undefined;
+    const channel = opened.channel as { id?: unknown } | undefined;
+    return typeof channel?.id === "string" && channel.id.length > 0 ? channel.id : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// Durable half of the retry dedupe: the in-memory seen-set only catches a retry landing
+// on the SAME instance; on serverless the redelivery often lands on a fresh one. FAIL-OPEN
+// by design — dedupe prevents an annoyance (a double reply), not a security hole, so a
+// store outage must never silence genuine wakes. TTL matches the in-memory set; Slack
+// stops retrying long before it expires.
+const DEDUPE_TTL_MS = 10 * 60_000;
+let warnedDedupeStore = false;
+async function liveMarkEventSeen(org: string, key: string, atIso: string): Promise<boolean> {
+  try {
+    return await getOperationalStore().markEventSeen(org, key, atIso, DEDUPE_TTL_MS);
+  } catch (err) {
+    if (!warnedDedupeStore) {
+      warnedDedupeStore = true;
+      console.warn(`[open-everywhere:slack-front] durable dedupe unavailable — in-memory only: ${String(err)}`);
+    }
+    return true;
+  }
+}
+
+// Route decisions used to be silently discarded, which made a gate decline, a judged
+// NO_REPLY, and a broken path indistinguishable from the outside (bit us live: "the
+// name-drop didn't reply" had no way to tell WHY). One line per candidate event; the
+// posted reply itself is the positive signal, this line is the story when there isn't one.
+const logOutcome =
+  (path: string, channelId: string, ts: string) =>
+  (outcome: RouteOutcome): void => {
+    console.log(
+      `[open-everywhere:slack-front] ${path} ${channelId}/${ts}: ${outcome.woke ? "woke" : "no wake"} — ${outcome.reason}`,
+    );
+  };
+
+/**
+ * Turn a swallowed FIFO wake failure into a DURABLE, queryable signal (resilience S-1 / #551
+ * §3.4): a log-ship "error" record (the primary win — the failure survives the ~1h console
+ * retention) plus a best-effort `surface.wake_failed` audit row (mirrors recordQuietFailure's
+ * posture). The FIFO key encodes the channel (`${channelId}:${threadTs}` for a thread wake,
+ * `${channelId}:oe-sup` for a supervisor wake); team is unknown at this layer, so the audit
+ * partition falls back to the empty-team default exactly like recordQuietFailure's own
+ * `teamId ?? ""` — best-effort, never blocks. Never throws.
+ */
+/**
+ * Deliver a wake, and RE-DELIVER IT ONCE when the first attempt died on a pruned deployment
+ * (OPE-963, channels/stranded-seat.ts).
+ *
+ * The first attempt's failure is not wasted: `divertToUnifiedWindow` classified it and MARKED the
+ * seat's `channel_session` row for rotation before it rethrew. So the second attempt re-resolves the
+ * seat, `rotationTrigger` answers `operator-marked`, the seat takes its own rotate leg (fresh
+ * generation, carried tail), and eve opens a NEW run under the CURRENT deployment. Without this the
+ * member loses the message that hit the strand, even though the seat itself is healed.
+ *
+ * EXACTLY ONE retry, and only for this class. Every other failure rethrows untouched, straight to
+ * the FIFO's loud handler ({@link recordWakeFailure}). A second failure of the same class rethrows
+ * too — the seat could not be marked, so a third attempt would resume the same dead run.
+ *
+ * THE ROUTE FUNCTION MUST BE RE-RUNNABLE, and both wrapped routes are. Everything they do before
+ * the divert is a read or an idempotent write: TTL-cached `conversations.info` / `users.info`
+ * probes, a deterministic external-policy verdict (its private notice posts only on a verdict that
+ * RETURNS rather than throws, so a retry never reaches it), a read-only spend gate, and
+ * `markEngaged`, which upserts. `recordWakeTail` and `touchDmSeat`/`touchSession` all run AFTER the
+ * divert, so a failed attempt records nothing to duplicate. The wake id is minted fresh, which is
+ * correct — the retry is a new delivery.
+ *
+ * Applied only to the WINDOW-bearing routes — a thread seat has no `channel_session` row to mark,
+ * so a retry there could only resume the same dead run.
+ *
+ * OPE-970: when the RETRY ALSO throws, the seat is still healed for its NEXT wake — but THIS
+ * member's message got no answer, and that fact must not collapse into an ordinary send-failure
+ * row indistinguishable from a transient blip. The retry's error is tagged
+ * ({@link markUndeliveredAfterHeal}) before it rethrows, so {@link recordWakeFailure} can give the
+ * row its own reason.
+ */
+export async function deliverWithStrandRetry<T>(deliver: () => Promise<T>): Promise<T> {
+  try {
+    return await deliver();
+  } catch (err) {
+    if (!isPrunedDeploymentWakeError(err)) throw err;
+    console.warn(`[open-everywhere:slack-front] wake hit a pruned deployment — seat marked for rotation, re-delivering once: ${String(err)}`);
+    try {
+      return await deliver();
+    } catch (retryErr) {
+      markUndeliveredAfterHeal(retryErr);
+      throw retryErr;
+    }
+  }
+}
+
+export function recordWakeFailure(key: string, err: unknown): void {
+  const channelId = key.split(":")[0] ?? key;
+  try {
+    enqueueLogRecord(buildRecord("error", "wake", "supervisor/thread wake delivery failed", { fields: { fifoKey: key, channelId }, err }));
+    void flushLogShip();
+  } catch {
+    /* log-ship best-effort */
+  }
+  // Held on the route (OPE-1648): the FIFO promise this runs under is itself in `waitUntil`, but a
+  // `void`-ed write sits OUTSIDE that promise and so races the freeze after the 200 all the same.
+  void holdRouteWork(
+    (async () => {
+      try {
+        const p = resolvePartition({
+          channel: { kind: "slack" },
+          session: { auth: { current: { attributes: { team_id: "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+        } as Parameters<typeof resolvePartition>[0]);
+        // OPE-970: a retry that ALSO failed after the pruned-deployment heal gets its own reason —
+        // otherwise it is indistinguishable from any other send failure, and the only way to tell
+        // "the seat is fine now but this message was lost" from "a transient blip" was to read the
+        // raw message text and recognise the run-key sentence by eye.
+        const undeliveredAfterHeal = isUndeliveredAfterHeal(err);
+        await getOperationalStore().appendAudit({
+          ts: new Date().toISOString(),
+          org: p.org,
+          platform: p.platform,
+          workspace: p.workspace,
+          surface: p.surface,
+          action: "surface.wake_failed",
+          detail: {
+            fifoKey: key,
+            message: String(err instanceof Error ? err.message : err).slice(0, 500),
+            ...(undeliveredAfterHeal
+              ? { reason: "pruned-deployment-heal-retry-failed", remedy: "seat healed for its next wake; this message got no answer" }
+              : {}),
+          },
+        });
+      } catch {
+        /* audit is best-effort — the log-ship record above is the durable signal */
+      }
+    })(),
+  );
+}
+
+/**
+ * Build the front route handler. Buffers the body once, verifies the signature, then forwards
+ * or wakes per {@link classifyEnvelope}. `innerHandler` is slackChannel's own POST handler,
+ * invoked with a FRESH Request (re-readable body) + the same {@link RouteHandlerArgs}, so
+ * slackChannel re-verifies and dispatches exactly as if it owned the URL.
+ */
+/**
+ * SINGLE-WINDOW diversion (channels/unified-window.ts): layer the cross-channel hop onto the
+ * supervisor deps. When routeSupervisorEvent minted a `window` for a wake (the domain's
+ * crossSurfaceWindow gates hold — the wakeId is already rendered into the envelope), deliver it
+ * through eve's cross-channel `to(...).send(...)` into the synthetic `unified` channel instead of the
+ * Slack send: the effective token becomes `unified:<raw>`, shared with every surface in the
+ * domain — ONE context window. The unified channel's `receive` registers the wakeId→origin map
+ * entry (durably, BEFORE the send) and re-checks the gates fail-closed. This wrapper lives HERE
+ * because only the route handler holds `args.to` (and slack-events.ts must not import
+ * unified.ts — unified.ts imports it). A window-less wake passes through untouched, so flag-off
+ * is byte-identical. A diversion failure PROPAGATES to the FIFO's loud catch (fail-closed: a
+ * wake whose reply map couldn't be written is not delivered into the shared window).
+ *
+ * THREAD-OWNERSHIP ingress routing (§S2): the divert goes through the INBOUND variant
+ * (unified.ts divertInboundToUnifiedWindow), which — only under delegation.oneshotAgent — consults the
+ * durable ownership index and dispatches a wake landing in an OWNED thread to the owning task/
+ * thread-seat session's token instead of the standing seat's. Flag-off, and on every unowned
+ * thread, the inbound variant is a byte-identical passthrough to divertToUnifiedWindow.
+ *
+ * OPE-971: the `!input.window` (NATIVE, flag-off) branch below is Slack's own un-windowed
+ * supervisor session — the send this domain takes when it never opted into windowing at all. That
+ * send was completely unwrapped: a pruned-deployment strand there stranded the seat silently,
+ * forever (see channels/stranded-seat.ts). `deps.wake`'s own registryKey for this branch IS
+ * `surfaceKey` (supervisorGrainFor returns `{unified:false, registryKey:surfaceKey}` flag-off — the
+ * exact row `liveSupervisorDeps`'s `getOrCreateSession` already rotates), so the heal is told that
+ * key directly rather than trying to parse it back out of the per-channel token.
+ */
+export function withSingleWindowDiversion(
+  deps: ReturnType<typeof liveSupervisorDeps>,
+  to: RouteHandlerArgs["to"],
+  surfaceKey: string,
+): ReturnType<typeof liveSupervisorDeps> {
+  return {
+    ...deps,
+    async wake(input) {
+      if (!input.window) {
+        try {
+          await deps.wake(input);
+        } catch (err) {
+          await healPrunedDeploymentStrand({
+            token: input.token,
+            registryKey: surfaceKey,
+            surfaceKey,
+            workspace: surfaceKey.split("/")[1] ?? "unknown",
+            platform: "slack",
+            atIso: new Date().toISOString(),
+            err,
+          });
+          throw err;
+        }
+        return;
+      }
+      await divertInboundToUnifiedWindow(to, {
+        message: input.message,
+        // The seat wake's untrusted-wrapped side-channel context (the name-drop hydration,
+        // OPE-1725). Omitted on every other wake, so a context-less divert is byte-identical.
+        ...(input.context && input.context.length > 0 ? { context: input.context } : {}),
+        token: input.token,
+        window: input.window,
+        surfaceKey,
+        auth: input.auth as { attributes?: Record<string, unknown> },
+      });
+    },
+  };
+}
+
+// DM-PARTNER TRUST, front-route copy (OPE-351 stage 2). `dm_partner_trust` gates the DM's SHARED read
+// layer (internal partner ⇒ `dm` trust, external ⇒ `public`), so the diverted DM's auth must carry it
+// or every DM silently degrades to the external tier — a regression the native path would not have had.
+// The native path resolves it in slack.ts (`enrichDmPartner`) off `ctx.slack.request`, which does not
+// exist here (the front route holds no eve slack context, and slack.ts imports THIS module, so the
+// helper cannot simply be shared without a cycle).
+//
+// OPE-466: the PROBE ITSELF now lives in slack-events.ts (`slackAuthorIsMember`), because the same
+// question — is this person a full member of this workspace? — is what a CHANNEL author's wake tier
+// needs, and two caches of one answer drift. This function is the DM leg's reading of that verdict,
+// and it keeps the DM leg's own FAIL-CLOSED direction: an unresolvable probe leaves the attribute
+// unset and the binding fails closed to the external tier, unchanged from before.
+async function liveDmPartnerTrust(userId: string, teamId: string | undefined): Promise<"internal" | "external" | undefined> {
+  const member = await slackAuthorIsMember(userId, teamId);
+  return member === undefined ? undefined : member ? "internal" : "external";
+}
+
+/** Reset the cached DM-partner trust (tests only). */
+export function _resetDmTrustCache(): void {
+  _resetAuthorMemberCache();
+}
+
+// `wrapDmSeatFrom` (OPE-90) is DELETED at OPE-351 stage 2. It existed to remap the address of eve's
+// NATIVE DM send onto a rotatable seat token — a bolt-on to a dispatch path a DM no longer takes. The
+// DM is now diverted onto the `unified` channel before the forward ever happens (`scheduleDmWake`
+// below), so the seat token is chosen at DISPATCH time by the same code every other standing seat
+// uses, and there is no native send left to intercept. What it carried forward, and where each part
+// lives now: the seat resolve → `resolveDmSeat` in `scheduleDmWake`; the fresh-generation tail
+// prepended as `context` → the divert's own `context` argument; the off-critical-path wake touch →
+// the same `waitUntil(touch…)` there. What it does NOT carry forward is its FAIL-OPEN fallback to the
+// native send: there is nothing honest to fall back TO, since eve's native DM dispatch would open a
+// session on an address the seat has no window row for. A DM whose seat cannot be resolved now fails
+// LOUDLY into the FIFO's catch (audited via recordWakeFailure) instead of silently answering from a
+// second, un-rotatable session — the same fail-closed posture every other divert has.
+
+/**
+ * Does this `message` event DUPLICATE an `app_mention` Slack also fires, so the wake path must drop it?
+ *
+ * Slack sends TWO events for a new message that @mentions the bot: the `app_mention`, which the
+ * front's own `mention` branch owns, and a sibling carrying the same text — `message.channels` in a
+ * channel, `message.mpim` in a group DM. Acting on both is a double turn, so both the channel wake
+ * path and the group-DM leg drop the sibling through this one rule.
+ *
+ * 🔴 AN EDIT IS NEVER A SIBLING, AND SUPPRESSING ONE IS A LOST WAKE (OPE-1673). Slack delivers an
+ * edit ONLY as `message` with `subtype: "message_changed"`; no `app_mention` accompanies it, and
+ * `parseMessageEvent` reads the POST-EDIT text — so a person who edits a message in an engaged
+ * thread to add `<@bot>`, or who corrects the wording of a mention that is already there, matched
+ * this rule and was answered by nothing at all. There is no second event to prefer. The exemption is
+ * narrow by construction: an edit cannot reach the `app_mention` branch, because the front classifies
+ * the envelope on its event TYPE and a `message_changed` always arrives as a `message`.
+ *
+ * UNVERIFIED, and stated rather than assumed: Slack's docs do not say whether an edit that ADDS a
+ * mention also raises a fresh `app_mention`. If it does, the cost of this exemption is an occasional
+ * double turn — the same trade the next paragraph already takes, for the same reason.
+ *
+ * MATCH THE AUTHOR'S OWN TEXT, NEVER THE MERGED ONE (OPE-1374). `ev.text` carries forwarded and
+ * quoted content, so testing it would suppress a forward whose QUOTED message mentions the bot.
+ * UNVERIFIED for the same reason as above: whether Slack fires an `app_mention` for a mention that
+ * lives inside an attachment. If it does NOT — the shape we expect — testing the merged text loses
+ * the wake outright, because no sibling ever arrives to deliver it. If it DOES, the cost is a double
+ * turn. We take the double: an occasional double beats a drop, and a deaf agent on a forward is the
+ * failure OPE-1374 exists to prevent.
+ *
+ * Pure, so both the suppression and its exemption are unit-testable without Slack or a store. An
+ * unresolved bot user id suppresses nothing — there is no needle to match, and inventing one would
+ * drop every message.
+ */
+export function mentionSiblingSuppressed(input: {
+  readonly authoredText: string;
+  readonly subtype?: string;
+  readonly botUserId?: string;
+}): boolean {
+  if (input.botUserId === undefined || input.botUserId.length === 0) return false;
+  if (input.subtype === "message_changed") return false;
+  return input.authoredText.includes(`<@${input.botUserId}>`);
+}
+
+export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions = {}): RouteHandler {
+  const dedupe = opts.dedupe ?? new EventDedupe();
+  const fifo = opts.fifo ?? new ThreadFifo(recordWakeFailure);
+  const getBotIdentity = opts.getBotIdentity ?? resolveBotIdentity;
+  const now = opts.now ?? (() => Date.now());
+  const signingSecret = () => opts.signingSecret ?? process.env.SLACK_SIGNING_SECRET;
+  const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
+  // OPE-589 leg D: reuse the taint-marking member probe (slack-events.ts `slackClickerIsGuest`,
+  // itself `slackAuthorIsMember` inverted). Same `users.info` call and cache the channel-taint leg
+  // already pays for, so a clicker who recently posted a message in the same workspace is often a
+  // free lookup, not a new one.
+  const handleApproval =
+    opts.handleApprovalPayload ??
+    ((payload: unknown, deps?: { waitUntil?: (p: Promise<unknown>) => void }) =>
+      liveHandleApprovalPayload(payload, { clickerIsGuest: slackClickerIsGuest, ...(deps?.waitUntil ? { waitUntil: deps.waitUntil } : {}) }));
+  const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
+  const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
+  const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+  const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+  const handleApprovalCardClick = opts.handleApprovalCardClick ?? liveHandleApprovalCardClick;
+  const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
+  const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
+  const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
+  const openDirectMessageChannel = opts.openDirectMessageChannel ?? liveOpenDirectMessageChannel;
+  const resolveDmSeat = opts.resolveDmSeat ?? ((org, dm, atIso) => liveGetOrCreateDmSeat(org, dm, atIso));
+  const touchDmSeatFn = opts.touchDmSeatFn ?? liveTouchDmSeat;
+  const dmPartnerTrustFor = opts.dmPartnerTrustFor ?? liveDmPartnerTrust;
+  const channelFactsFor = opts.channelFactsFor ?? slackChannelFactsFor;
+  const authorFactsFor = opts.authorFactsFor ?? ((internal: boolean, userId: string | undefined, teamId: string | undefined) => slackWakeAuthorFacts(internal, userId, teamId));
+
+  // THE one single-window mention decision, shared by BOTH mention legs (the `app_mention`
+  // native-forward below and its `message.channels` sibling on the wake path) so they stay
+  // exactly complementary — never a double turn (native + unified), never a gap (neither). True ⇔
+  // the channel has a STANDING SEAT and the policy's privacy floor holds (channel POSITIVELY
+  // confirmed internal, fail-closed). Any error ⇒ false ⇒ the native split.
+  // 🔴 THE CHATTINESS PRECONDITION IS GONE (OPE-1695). Requiring `ambientSupervisor` here is what
+  // made a mention in an addressed-only room open eve's native per-thread session — the fallback
+  // the ruling deletes. Its complement moved with it: `scheduleUnownedWake` now takes the seat road
+  // for every addressed wake, so suppressing the native leg can no longer leave the mention with
+  // nowhere to land.
+  const singleWindowOwnsMention = async (channelId: string, surfaceKey: string): Promise<boolean> =>
+    (await mentionPolicyFor(channelId, surfaceKey)).suppressNative;
+
+  // 🔴 THE WHOLE HANDLER RUNS INSIDE THE ROUTE HOLD (OPE-1648). Every door below answers its 200 at
+  // once and finishes its work afterwards — this route through `args.waitUntil`, eve's native
+  // handler through the same `args` on the forward — so a `void`-ed audit write anywhere under here
+  // races the serverless freeze that follows the response and loses the row.
+  //
+  // 🔴 EVERY `waitUntil` THE DELIVERY REGISTERS IS QUIESCED FIRST, and that is what makes the hold
+  // reach the wake routes. eve snapshots its background-task array the instant this handler
+  // resolves, so a `waitUntil` called later — from an engagement route running inside one of the
+  // FIFO promises below, long after the 200 — lands in a list nobody awaits. Every such route runs
+  // INSIDE a promise registered here while the handler was still going, so handing the platform a
+  // promise that outlives that route's own writes is enough, and nothing extra is registered: a
+  // delivery that queues no background work still hands the platform nothing at all.
+  return (req: Request, args: RouteHandlerArgs): Promise<Response> =>
+    withSlackRouteHold(() => {
+      // `Object.create`, not a spread: the route args are eve's object, and a spread would keep only
+      // its OWN enumerable properties. Shadowing one method on a prototype-linked copy leaves
+      // everything else — `from`, `to`, `attachSession`, `params` — resolving to eve's own.
+      const held: RouteHandlerArgs = Object.assign(Object.create(args) as RouteHandlerArgs, {
+        waitUntil: (p: Promise<unknown>) => args.waitUntil(routeHoldQuiesced(p)),
+      });
+      return handleFrontRequest(req, held);
+    });
+
+  async function handleFrontRequest(req: Request, args: RouteHandlerArgs): Promise<Response> {
+    const rawBody = await req.text();
+    if (!verifySlackSignature(rawBody, req.headers, signingSecret(), now())) {
+      return new Response("unauthorized", { status: 401 });
+    }
+    const decision = classifyEnvelope(rawBody, req.headers.get("content-type") ?? "");
+
+    /**
+     * Hand this request to eve's native `slackChannel`, with the OPE-1374 attachment boundary
+     * applied to what eve is given (OPE-1380).
+     *
+     * 🔴 EVERY NATIVE FORWARD GOES THROUGH HERE, not just the `@mention` one. A fence on the mention
+     * path alone would be no fence at all — the same reasoning `slackWakeSpendGate` states for its
+     * own placement: an `im` message forwards natively too, and eve merges its attachments the same
+     * way. The click and view_submission fall-throughs carry no `event`, so for them this is the
+     * identity below and their forward stays byte-identical.
+     *
+     * 🔴 THE RE-SIGN IS WHAT MAKES A REWRITE POSSIBLE. The inner handler re-verifies the Slack
+     * signature over the body it receives, so a changed body needs a signature over those bytes. The
+     * secret is the one this route just VERIFIED the inbound signature with, so a deployment where
+     * the two secrets disagree would have 401'd above rather than reaching here.
+     *
+     * FAIL-SOFT TO TODAY'S BEHAVIOUR. If the body carried nothing to strip (the common path), or the
+     * signature cannot be reminted (no secret, no timestamp header), the ORIGINAL bytes and headers
+     * are forwarded. Losing the fence on a body we cannot re-sign is recoverable; dropping the
+     * message on a signature the inner handler then refuses is not.
+     *
+     * 🔴 IT ALSO CARRIES THE ENTERPRISE RUNG ACROSS THE FORWARD (OPE-1559). `enterprise_id` lives on
+     * the envelope, and eve hands its handler the INNER event only, so the rung would be lost here
+     * otherwise — and a Grid deployment that declared only the enterprise would resolve every native
+     * mention as an undeclared room. The stow wraps the WHOLE forward, including the fenced-body
+     * branch, because both branches end in the same inner handler. See
+     * {@link withForwardedSlackEnvelope} for why the carrier is async-scoped and message-matched.
+     * EVERY native forward is wrapped for the same reason the attachment fence is: an `im` message
+     * forwards natively too, so a rung carried on the mention path alone would be half a rung.
+     */
+    const forwardNative = (): Promise<Response> =>
+      withForwardedSlackEnvelope(forwardedEnvelopeOf(rawBody), () => {
+        const fenced = stripUnfencedSlackAttachments(rawBody);
+        const ts = req.headers.get(SLACK_TIMESTAMP_HEADER);
+        const secret = signingSecret();
+        if (fenced === rawBody || !ts || !secret) {
+          return innerHandler(new Request(req.url, { method: "POST", headers: req.headers, body: rawBody }), args);
+        }
+        // A fresh Headers, because the inbound `content-length` describes the ORIGINAL bytes and the
+        // fenced body is shorter. Dropped rather than recomputed: `Request` sets it from the body.
+        const headers = new Headers(req.headers);
+        headers.set(SLACK_SIGNATURE_HEADER, slackSignature(secret, ts, fenced));
+        headers.delete("content-length");
+        console.log("[open-everywhere:slack-front] stripped an unfenced link-unfurl attachment before the native forward (OPE-1380)");
+        return innerHandler(new Request(req.url, { method: "POST", headers, body: fenced }), args);
+      });
+
+    // `liveDeps` types `send`'s auth as `unknown` on purpose (it doesn't import Eve's auth type);
+    // the cast bridges that gap — at runtime the payload/token/auth pass straight through. Hoisted
+    // because BOTH the single-window app_mention divert (mention branch) and the unowned-message
+    // wake path feed the same supervisor/name-drop dispatcher.
+    //
+    // eve 0.31 replaced the route's flat `send(payload, { continuationToken, … })` with
+    // `from(address).send(message, { … })` — the address is bound at `from()` time instead of
+    // riding in the options, and `context` moved out of the payload into the options. OE's own
+    // `WakeSend` (slack-events.ts) is UNCHANGED by design: it is an OE-authored adapter interface,
+    // not eve's, so the whole wake/name-drop/supervisor/join layer below stays byte-identical and
+    // the version-shaped difference is confined to this one adapter.
+    const send = ((input: { message: string; context?: readonly string[] }, opts: { auth: unknown; continuationToken: string; state?: unknown }) =>
+      args.from(opts.continuationToken).send(input.message, {
+        auth: opts.auth,
+        ...(opts.state === undefined ? {} : { state: opts.state }),
+        ...(input.context && input.context.length > 0 ? { context: input.context } : {}),
+      } as never)) as unknown as Parameters<typeof liveDeps>[0];
+
+    // Two-layer idempotency (in-memory first, then the durable cross-instance store) shared by the
+    // wake path AND the single-window mention divert: a Slack RETRY (same event_id) must never
+    // double-wake. Returns false when the event was already handled (caller 200s and stops).
+    // Fail-open on an unresolvable partition — dedupe prevents a double reply, not a security hole.
+    /** The two-layer dedupe, keyed EXPLICITLY. Split out from {@link notYetSeen} for the shortcut
+     *  branch (OPE-1376), whose idempotency key is Slack's per-click `trigger_id` rather than an
+     *  Events API `event_id` — see `shortcutWakeKey` for why the message's own ts is wrong there. */
+    const notYetSeenKey = async (key: string, ev: ParsedMessageEvent): Promise<boolean> => {
+      if (dedupe.seen(key, now())) return false;
+      dedupe.mark(key, now());
+      try {
+        const org = resolvePartition(bindableFor(ev)).org;
+        if (!(await markEventSeen(org, key, new Date(now()).toISOString()))) return false;
+      } catch {
+        /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+      }
+      return true;
+    };
+
+    /** The Events API form: key one `event_id` (falling back to `channel:ts`). Every existing wake
+     *  route reads this one; only the shortcut branch keys itself. */
+    const notYetSeen = (env: SlackEventEnvelope, ev: ParsedMessageEvent): Promise<boolean> =>
+      notYetSeenKey(wakeKey(env, ev.channelId, ev.ts), ev);
+
+    // UNOWNED message dispatch (top-level, or in-thread but not engaged): today's default is the
+    // name-drop path (per-domain opt-in, fail-closed). When the channel's domain opts into
+    // ambientSupervisor, the SAME unowned traffic routes to the channel-supervisor session instead
+    // (slack-events.ts routeSupervisorEvent) — the "always-on teammate" leg. `directMention` is the
+    // SINGLE-WINDOW addressed-mention divert (an app_mention event routed here from the mention
+    // branch): it forces the supervisor path (the only road into the unified window) and renders an
+    // addressed `direct-mention` wake. The supervisor wake serializes on its OWN FIFO key (the
+    // supervisor token), never shared with a thread FIFO. Fail-closed: any partition/config error,
+    // or the flag off, falls through to the UNCHANGED name-drop dispatch — so ambientSupervisor-off
+    // is byte-identical to today. Parametrised on `ev` so both the app_mention divert and a plain
+    // message.channels wake feed one dispatcher.
+    // `onWake` runs SYNCHRONOUSLY, once, immediately before a wake is scheduled — and never on the
+    // addressed-drop path below. The shortcut route (OPE-1442) uses it to seed the attachment
+    // registry only for a click that actually wakes something; every other caller omits it.
+    const scheduleUnownedWake = (ev: ParsedMessageEvent, label: string, directMention = false, onWake?: () => void, seatEngaged = false): void => {
+      let ambient = false;
+      let surfaceKey: string | undefined;
+      try {
+        surfaceKey = resolvePartition(bindableFor(ev)).surfaceKey;
+        ambient = ambientEnabledFor(surfaceKey);
+      } catch {
+        ambient = false; // unresolvable partition / config load → today's name-drop path
+      }
+      // 🔴 AN ADDRESSED WAKE TAKES THE SEAT ROAD, WHATEVER THE CHATTINESS FLAG SAYS (OPE-1695). The
+      // drop that stood here refused an addressed wake on an ambient-off channel, because the seat
+      // itself only existed where ambient was on — so a mention and a channel-message shortcut both
+      // died there. Seats are universal now: the flag decides whether UNADDRESSED talk wakes the
+      // seat, and addressing decides nothing about the session's shape. A mention in an
+      // addressed-only room therefore lands in that room's own seat, with the earlier exchange in
+      // context, instead of opening eve's native per-thread session (the fallback this ruling
+      // deletes) or being dropped.
+      // 🔴 THE DROP SURVIVES WHERE THERE IS NO SEAT, AND THAT KEEPS FLAG-OFF BYTE-IDENTICAL. With the
+      // standing-seat capability unarmed there is no seat road at all, so an addressed wake that fell
+      // through here would take the NAME-DROP path — a silently mis-judged wake, which is exactly what
+      // the old drop existed to prevent. The mention route never reaches it (its own policy leaves the
+      // native leg in charge when nothing windows); the SHORTCUT route does, and on such a deployment
+      // it is dropped loudly, exactly as before.
+      // An unresolvable partition leaves no surface key, so there is no seat to ask about: that
+      // reads as UNSEATED, which keeps the drop — the fail-closed direction the old branch had.
+      const seated = surfaceKey !== undefined && seatedSurface(surfaceKey);
+      if (directMention && !ambient && !seated) {
+        console.warn(`[open-everywhere:slack-front] ${label} ${ev.channelId}/${ev.ts}: addressed wake with no standing seat and ambient off — dropped (no road to a seat)`);
+        return;
+      }
+      // 🔴 `seatEngaged` IS NOT `directMention`, and the distinction is load-bearing. An ENGAGED
+      // thread's follow-up must reach the seat that is holding the conversation even in an
+      // addressed-only room — otherwise the seat answers a mention once and goes deaf on the very
+      // thread it opened. But it must NOT be treated as an address: `directMention` also lifts the
+      // app_mention/channel_type disqualifiers AND bypasses the stood-down suppression
+      // (slack-events.ts routeSupervisorEvent, `ev.threadTs && !directMention && engRow?.stopped`),
+      // so passing it here would make `stand_down` stop working in threads. It only says "there is a
+      // seat road for this message", which is what the chattiness flag would otherwise have said.
+      const addressedOrAmbient = directMention || ambient || seatEngaged;
+      onWake?.();
+      if (addressedOrAmbient) {
+        // Generation-INDEPENDENT FIFO key (T1.5): the FIFO's job is to serialize supervisor
+        // wakes for this CHANNEL, which must hold ACROSS a rotation boundary too — keying on
+        // the generation-bearing token (the old hardcoded gen-1 assumption) would split one
+        // channel's serialized queue in two the instant a rotation minted a new generation.
+        // supervisorFifoKey needs no store read either, so it stays a stable, synchronous key
+        // on the hot path exactly like the token-based key did.
+        const supKey = supervisorFifoKey(ev.channelId);
+        args.waitUntil(
+          fifo.enqueue(supKey, () =>
+            deliverWithStrandRetry(() =>
+              routeSupervisorEvent(
+                ev,
+                withSingleWindowDiversion(liveSupervisorDeps(send), args.to, surfaceKey!),
+                directMention ? { directMention: true } : undefined,
+              ).then(logOutcome(`${label}-supervisor`, ev.channelId, ev.ts)),
+            ),
+          ),
+        );
+        return;
+      }
+      // 🔴 A NAME-DROP WAKES THE ROOM'S STANDING SEAT (OPE-1725). `routeNameDropEvent` stays the
+      // JUDGE — the name match, the domain's `nameDropWake` opt-in, the internal confirmation, the
+      // wake arm — and on a SEATED surface its `seatRoute` hands the judged wake to that seat instead
+      // of opening eve's native per-thread session. Addressing decides what the seat is owed; it
+      // never decides the shape of the session, so the same seat an @mention reaches answers a
+      // name-drop, with the room's earlier exchange already in its context.
+      // UNSEATED ⇒ no `seatRoute`, and the native per-thread wake is byte-identical to today. That
+      // arm is the whole pre-seat deployment, so the fallback is not a corner case.
+      //
+      // 🔴 THE JUDGE RUNS OUTSIDE THE SEAT'S FIFO, and only a message it ADMITS enters one. Putting
+      // the judge inside would make every unaddressed message in a seated room occupy the channel's
+      // serialized queue for the length of a decision that almost always declines — a real cost on a
+      // busy room, and it would hold a genuine seat wake behind it. `fifo.enqueue` resolves void and
+      // SWALLOWS a failure, so the outcome is captured in the closure and the default stays the
+      // honest "did not wake" for a delivery that threw.
+      // 🔴 THE HYDRATOR RIDES ACROSS THE HAND-OFF (OPE-1725). The judge fetches the room's
+      // surrounding conversation for the wake it admits, and the SEAT wake must carry that same
+      // block — withheld by the same transform — or a seated deployment quietly stops hydrating
+      // name-drops at all. It is passed as a thunk, so the seat road pays for the history page only
+      // after its own tenant fence, spend gate and external-participant policy admit the wake.
+      const seatRoute = seated
+        ? async (hydrateContext: NameDropContextHydrator): Promise<RouteOutcome> => {
+            let outcome: RouteOutcome = { deliver: false, reason: "seat wake delivery failed", woke: false };
+            await fifo.enqueue(supervisorFifoKey(ev.channelId), async () => {
+              outcome = await deliverWithStrandRetry(() =>
+                routeSupervisorEvent(ev, withSingleWindowDiversion(liveSupervisorDeps(send), args.to, surfaceKey!), {
+                  nameDrop: true,
+                  nameDropContext: hydrateContext,
+                }),
+              );
+            });
+            return outcome;
+          }
+        : undefined;
+      args.waitUntil(
+        routeNameDropEvent(ev, { ...liveNameDropDeps(send), ...(seatRoute ? { seatRoute } : {}) }).then(
+          logOutcome(seatRoute ? `${label}-name-drop-seat` : label, ev.channelId, ev.ts),
+        ),
+      );
+    };
+
+    /**
+     * THE DM WAKE (OPE-351 stage 2; group DMs at stage 4) — a `message.im` or `message.mpim` diverted
+     * into its own first-class standing window, the DM analogue of the single-window app_mention
+     * divert above. `dmKind` names which family member it is; everything the two differ in is
+     * called out below, and nothing else does.
+     *
+     * 🔴 IT DELIBERATELY BYPASSES routeSupervisorEvent, engagementTierFor AND THE NAME-DROP JUDGE.
+     * Every one of those exists to answer "was the agent addressed, and is this worth replying to?"
+     * — a question a 1:1 DM has already answered. A DM IS ALWAYS ANSWERED; routing it through a
+     * silence-biased judge would let the agent ignore someone talking to it directly, which is the
+     * one place it must never be quiet. So this path renders an ADDRESSED wake (`slackDmWake`,
+     * `addressing:"direct-mention"`) and dispatches it, full stop. The spend gate is NOT bypassed:
+     * `divertToUnifiedWindow`'s own attended-arrival gate (windowSpendGate) runs on this wake exactly
+     * as it does on a mention, which is what replaces the native door's gate.
+     *
+     * A GROUP DM WAKES ON THE SAME UNCONDITIONAL RULE, AND THAT IS A REAL WIDENING — its previous
+     * route (`shouldNameDropWake`) refused every non-mention message on channel_type, so the room woke
+     * only on an @mention. The justification is not that every message in a group DM is addressed to
+     * the agent (it plainly is not), but that a closed room the agent was added to person-by-person is
+     * a conversation it is IN, and the judgement of whether to speak belongs to the model, which has
+     * the text, rather than to a front-door gate keyed on a channel type. What carries that is the
+     * wake's own silence escape plus the GROUP opening of the `[direct]` preamble
+     * (channels/normalized-wake.ts), which says the room holds other people and tells the seat to stay
+     * out of what is not asked of it. The COST of the widening lands on the spend gate above, not on
+     * a judge: a chatty group DM is a budget question, and it is already answered by one.
+     *
+     * THE ENVELOPE IS MINIMAL, ON PURPOSE — no backscroll. The native DM path deliberately skipped
+     * `loadConversationContext` (slack.ts: "DMs are skipped — the 1:1 history IS the conversation and
+     * the durable session already carries it"), and that reasoning survives the re-seat unchanged: the
+     * seat is one long-lived session over the whole DM, so injecting history would duplicate what the
+     * session already holds. The one thing a FRESH generation carries is the recorded tail of the
+     * generation it replaced (OPE-794) — the case that argument does not cover, since a rotation is
+     * exactly when the session stops holding it.
+     *
+     * A STRICT IMPROVEMENT IN FENCING: eve's native DM dispatch delivered the human's text as the raw
+     * turn body. Going through the shared wake renderer means a DM body is now `wrapUntrusted`-fenced
+     * like every other surface's — a DM was the last inbound text that was not.
+     *
+     * FAIL-CLOSED, unlike the OPE-90 remap it replaces: no seat, no partition or no dispatch means the
+     * wake FAILS into the FIFO's loud catch (audited by recordWakeFailure) rather than falling back to
+     * a native send, which would answer the human from a second session with no window row behind it.
+     */
+    const scheduleDmWake = async (
+      ev: ParsedMessageEvent,
+      dmKind: "im" | "mpim",
+      /** The DM door admitted this bot author as the deployment's named e2e driver (OPE-1023).
+       *  Defaults FALSE, so every existing call site is unchanged. */
+      driverAdmitted = false,
+    ): Promise<void> => {
+      // 🔴 THE TENANT FENCE, AND THIS IS ITS CHOKEPOINT FOR THE WHOLE DM FAMILY (OPE-1644). Before
+      // this line `slack-front.ts` consulted the fence NOWHERE, while the mention door, the four
+      // dispatching engagement routes, the channel-join door and the `/oe` slash door all did — so a
+      // DM from a workspace this deployment never declared woke the DM seat. That seat is the
+      // LARGEST grant the deployment makes: it holds a window token, delegation and memory, and a
+      // DM is exactly where a colliding `U…` id resolves somebody's PERSONAL credentials.
+      //
+      // EVERY road into a DM window passes through here — the `message.im`/`message.mpim` branch,
+      // the DM-shaped shortcut and the group-DM mention divert — so the fence is placed here rather
+      // than at each of the three, and no road can be added that skips it. The two callers that CAN
+      // decide earlier do (the DM branch and the shortcut branch below), because a refusal there
+      // also spares the deployment a foreign workspace's attachment fetch and dedupe write; this
+      // check is what makes those an optimisation rather than the fence itself.
+      //
+      // SILENT, like every other door: nothing is posted back into the DM. We cannot safely identify
+      // anybody in an unadmitted workspace, and a foreign tenant learning it reached a live
+      // deployment is more than it needs to know. The audit row and the operator log line are the
+      // whole signal.
+      if (slackFrontTenantFenceDeclined(ev, `dm-${dmKind}`, "scheduleDmWake")) return;
+      const p = resolvePartition(bindableFor(ev));
+      const atIso = new Date(now()).toISOString();
+      const isGroup = dmKind === "mpim";
+      // 🔴 WHERE THE SURFACE'S TRUST COMES FROM, and why the two families differ.
+      //   • 1:1 — the DM PARTNER, via users.info. It rides BOTH the delivery auth (`dm_partner_trust`
+      //     gates the DM's shared read layer) and the envelope's trust tier, so one lookup answers
+      //     both. Fail-closed to `external`/`unauth`.
+      //   • GROUP — there is no partner. `dm_partner_trust` is a singular fact about "the other person
+      //     in this DM", a question an mpim does not have an answer to, and `bindSlack` ignores the
+      //     attribute for `mode:"mpim"` anyway (its trust comes from `slackTrust`). Stamping one would
+      //     be inventing a fact. What stands in for the WAKE tier is the surface's own confirmed-
+      //     internal verdict — the same substitution routeSupervisorEvent makes for a channel — read
+      //     from the TTL-cached conversations.info the mention leg already needs. Fail-closed: an
+      //     unresolvable lookup (a workspace without `mpim:read`) leaves every author `unauth`, which
+      //     renders the reference-only system note rather than dropping the wake. The group's AUTHOR
+      //     is a separate probe, resolved just below — the room says nothing about who wrote here.
+      const partnerTrust = !isGroup && ev.userId ? await dmPartnerTrustFor(ev.userId, ev.teamId) : undefined;
+      const roomFacts = isGroup ? await channelFactsFor(ev.channelId) : undefined;
+      const surfaceInternal = isGroup ? roomFacts?.internal === true : partnerTrust === "internal";
+      // ── THE AUTHOR LEG (OPE-1486, Tommy's 2026-09-07 ruling) ────────────────────────────────────
+      //
+      // 🔴 A GROUP DM IS A ROOM, SO ITS AUTHOR IS PROBED LIKE A CHANNEL'S. `partnerTrust` answers a
+      // 1:1's author (`dmPartnerTrustFor` probes `ev.userId` — the writer, not some third party), so
+      // the 1:1 leg has always carried a real refutation. An mpim resolved none at all, which left
+      // `oe_chat_nonmember` ABSENT on a turn a guest's own bytes opened. That is an INGESTION-grain
+      // hole under the 2026-08-13 ruling: taint keys on whose words entered the context.
+      //
+      // The probe is `slackWakeAuthorFacts` — the SAME `users.info` verdict every channel route
+      // reads, TTL-cached, so a person who wrote in this workspace recently costs no new call. It
+      // fails OPEN: an unresolvable probe refutes nobody.
+      //
+      // 🔴 PRESENCE MARKS NOTHING. This asks who WROTE the trigger, never who sits in the room. No
+      // roster is read here and none should be: a guest who has not spoken has put no bytes in the
+      // context, and marking the turn for them would refuse the member plane on a room's occupancy.
+      //
+      // 🔴 THE WAKE TIER IS DELIBERATELY NOT NARROWED, AND THE FENCE IS CARRIED SEPARATELY. This is
+      // the explicit decision the ticket asked for rather than an inherited one, and the two halves
+      // of what the tier controls are what make it safe:
+      //   • the tier decides the RENDER — a `peer`/`principal` body is delivered unfenced, and only
+      //     `unauth` adds the reference-only system note. It does NOT decide whether the wake fires:
+      //     an mpim whose room cannot be confirmed already wakes at `unauth` rather than dropping;
+      //   • so the refutation rides to the render on its own field (`triggerRefuted` →
+      //     `WakeMessageInput.refuted`), which is a ONE-WAY FENCE BACKSTOP: it fences a refuted
+      //     author's body without touching the tier or the note.
+      // What that buys, against folding the refutation into `surfaceInternal` as a channel does: a
+      // guest the operator's own people invited into an addressed room still gets the addressed
+      // envelope and an answer, while their bytes still reach the model INSIDE the fence and the
+      // member plane still refuses a personal credential on the turn. Narrowing the tier as well
+      // would add only the demotion of the envelope itself, which no part of this ruling asks for.
+      const authorRefuted = isGroup ? (await authorFactsFor(surfaceInternal, ev.userId, ev.teamId)).refuted : partnerTrust === "external";
+      const wakeTrust = resolveWakeTrust({
+        // 🔴 THE ADMITTED DRIVER IS NOT A BOT AUTHOR HERE (OPE-1023) — the same expression the
+        // engagement and mention doors already use (`Boolean(ev.botId) && !isAllowedSlackDriver(…)`),
+        // applied to the DM door's own narrower lever. Left as a plain `Boolean(ev.botId)`, an
+        // admitted driver would wake at the `relay` floor and the DM legs would exercise a trust tier
+        // no human DM ever produces — which is not the real front door the carve-out exists to open.
+        //
+        // NO TRUST IS INVENTED. The driver posts through a human `xoxp` token, so `ev.userId` is a
+        // REAL member id and the tier below is resolved from that human by the ordinary rules (an
+        // unvouched surface still lands `unauth`, the admin roster still decides `principal`). What
+        // the flag removes is only the machine floor that Slack's `bot_id` stamp would otherwise
+        // impose on a message a person actually wrote.
+        authorIsBot: Boolean(ev.botId) && !driverAdmitted,
+        authorId: ev.userId,
+        surfaceInternal,
+        channelKey: p.surfaceKey,
+      });
+      // ── THE EXTERNAL-PARTICIPANT POLICY (OPE-507 author grain) ──────────────────────────────────
+      //
+      // A DM is ALWAYS addressed, so an excluded sender here is owed BEHAVIOUR 1: the private notice
+      // and nothing else. The notice posts back into this very DM — it is already private, so there
+      // is no `conversations.open` to make and no room to disclose anything to.
+      //
+      // 🔴 IT SITS ABOVE `resolveDmSeat`, WHICH IS WHY THE TRUST BLOCK MOVED UP. A suppressed DM must
+      // mint no seat, rotate no generation and consume no tail. The probe above is the same
+      // one the seat path needed anyway, so the reorder costs nothing.
+      //
+      // A DM contributes NO ROOM LEG — on a DM the trust plane asks about the PARTNER, not about the
+      // room — so only the AUTHOR grain can suppress here.
+      //
+      // 🔴 A GROUP DM IS SUPPRESSIBLE ON THE AUTHOR GRAIN TOO (OPE-1486). It was not before, because
+      // an mpim resolved no refutation at all — the limit the old note here recorded. The author leg
+      // above now resolves one from the same probe a channel uses, so an operator who set
+      // `externalPolicy.authorGrain: "withhold"` gets that rule in a group DM as well. Nothing moves
+      // on the SUPPRESSION PATH for a default deployment: `withholdsBody` is inert under the shipped
+      // `taint` grain, so only a deployment that explicitly excluded refuted authors is suppressed
+      // here — which is the rule it asked for. That is a claim about SUPPRESSION alone: on `taint`
+      // the same refutation still newly stamps `oe_chat_nonmember` and still newly fences the body,
+      // which is the fix. The room leg stays off for the whole DM family by the note above: on a DM
+      // the trust plane asks about the PARTNER, not about the room.
+      {
+        // `authorRefuted` is already resolved above, from ONE probe per family — the 1:1's partner
+        // lookup or the group's author lookup — so this gate makes no second call.
+        const verdict = await applySlackExternalPolicy(ev, p, { trust: wakeTrust, refuted: authorRefuted }, "scheduleDmWake");
+        if (verdict !== "proceed") {
+          console.log(`[open-everywhere:slack-front] dm ${p.surfaceKey}: suppressed — externalPolicy verdict "${verdict}"`);
+          return;
+        }
+      }
+      // `channelId` is what the ROTATION distiller fetches history with (always supplied);
+      // `legacyChannelId` is the one-time adopt-from-OPE-90 probe and is 1:1-ONLY. OPE-90 never minted
+      // an `oe-dm-seat::<id>` row for a group DM, so probing for one could only ever miss — and a miss
+      // that cannot be distinguished from a store outage is worse than no probe, because the OPE-346
+      // note-loss audit row exists precisely to tell those two apart.
+      const seat = await resolveDmSeat(
+        p.org,
+        { surfaceKey: p.surfaceKey, channelId: ev.channelId, ...(isGroup ? {} : { legacyChannelId: ev.channelId }) },
+        atIso,
+      );
+      const wakeId = mintWakeId();
+      // buildSlackAuth's DM attributes VERBATIM — including the rootDmGrainAttrs `oe_grain:"standing"`
+      // stamp, which is what narrows a DM-family root's hands (window-tool-gating §D-DM, which already
+      // covered mpim). `isPrivate:true` holds for both: a 1:1 is unambiguous, and a group DM has no
+      // public form. `channelType` is the dmKind verbatim, so `slackMode` binds `dm` / `mpim` and every
+      // mode-keyed carve-out (the lean-seat identity trio, the memory route, the skills refusal) sees
+      // the SAME mode it saw on the native token.
+      //
+      // OPE-466 CARRIAGE: a DM/group-DM wake ingests exactly one message, so the join runs over the
+      // trigger's own tier. The 1:1 leg already resolves `unauth` for a guest or Connect stranger
+      // (the partner probe above IS the membership probe); the group leg keeps the ROOM's tier and
+      // carries its author's refutation separately — see the author-leg note above for why the two
+      // are not folded together on an mpim.
+      const auth = stampNonMemberChatAuth(
+        buildSlackAuth({
+          userId: ev.userId ?? "",
+          teamId: ev.teamId,
+          // The Grid rung (OPE-1508), the same conditional spread `authForEvent` uses: a group DM
+          // in an Enterprise Grid carries the enterprise the operator's declaration is written at,
+          // and a non-Grid event stamps nothing.
+          ...(ev.enterpriseId === undefined ? {} : { enterpriseId: ev.enterpriseId }),
+          channelId: ev.channelId,
+          threadTs: ev.threadTs,
+          channelType: dmKind,
+          isPrivate: true,
+          ...(partnerTrust ? { dmPartnerTrust: partnerTrust } : {}),
+          // 🔴 THE GROUP DM CARRIES THE PLATFORM'S OWN SHARING VERDICT (OPE-1486), which is what a
+          // channel wake has always stamped (`authForEvent`) and an mpim wake never did. `bindSlack`
+          // reads the pair through `slackTrust`, so this is the binding's only route to the fact
+          // that a group DM spans another organisation — and `binding.trust` is the DEMOTION half of
+          // the member plane's G4b vouch. Without it a Slack Connect group DM was vouched internal
+          // under a workspace-wide declaration, because `slackTrust` graded every mpim `internal`.
+          //
+          // POSITIVE-ONLY, and both halves are spread conditionally for it: a workspace without
+          // `mpim:read` resolves neither fact, stamps neither attribute, and keeps today's verdict.
+          // Absence of an answer must never demote a room — only the platform SAYING so does.
+          ...(roomFacts?.extShared === undefined ? {} : { isExternal: roomFacts.extShared }),
+          ...(roomFacts?.trustChecked === undefined ? {} : { trustChecked: roomFacts.trustChecked }),
+        }),
+        // OPE-489: the author leg reads the POSITIVE refutation. On a 1:1 that is exactly the
+        // partner probe's `external` verdict — the same users.info answer, so no second lookup.
+        // OPE-1486: a GROUP DM resolves the same refutation from the same probe a channel's author
+        // leg uses, so a guest or Connect stranger who WRITES here marks the turn. The ROOM leg is
+        // still off for the whole DM family — `dm: true` puts it out of scope for the `public` tier,
+        // because on a DM `trust` asks about the PARTNER, not about the room.
+        [{ trust: wakeTrust, refuted: authorRefuted }],
+        { dm: true },
+      );
+      // OPE-794 — a fresh DM generation opens with the OUTGOING generation's RECORDED TAIL as its
+      // backscroll, in place of the deleted handoff note. The DM envelope is otherwise still minimal
+      // by design (the seat is one long-lived session over the whole DM, so replaying history a live
+      // session already holds would duplicate it) — the tail is exactly the case that reasoning does
+      // not cover, because a rotation is when the session stops holding it.
+      const message = renderWakeMessage(ev, () => atIso, {
+        dm: true,
+        trust: wakeTrust,
+        // The FENCE BACKSTOP for the whole DM family (OPE-1486) — the SAME refutation the taint stamp
+        // and the policy gate read, so the three cannot disagree about one author. On a 1:1 it is a
+        // no-op in practice (a refuted partner is already `unauth`, and `unauth` is already fenced);
+        // on a GROUP DM it is what fences a refuted author whose tier the room keeps at member grade.
+        triggerRefuted: authorRefuted || undefined,
+        wakeId,
+        ...(seat.freshGeneration && seat.tail.length > 0 ? { backscroll: seat.tail } : {}),
+      });
+
+      // 🔴 NO `replyAnchorTs` ON A TOP-LEVEL DM — the reply stays FLAT in the conversation. The
+      // CHANNEL divert DOES set one (slack-events.ts), because threading an answer under its trigger
+      // keeps a busy shared channel tidy; the slack post arm reads `threadTs ?? replyAnchorTs`
+      // as its thread target, so setting it here would thread EVERY DM answer under the message that
+      // asked — shattering a 1:1 conversation into a pile of one-reply threads. That is also not what
+      // the native path did: eve replied to the wake's own `thread_ts` (OPE-98's per-wake anchor), which
+      // is absent on a top-level DM message, so the answer posted flat. Behaviour preserved deliberately.
+      // A DM message that genuinely IS in a thread still carries its threadTs and is answered in it.
+      //
+      // 🔴 A GROUP DM IS FLAT TOO — and here that DEPARTS from the native behaviour rather than
+      // preserving it, so the reasoning has to stand on its own. Today an mpim @mention is answered by
+      // eve's native path, which anchors on the wake's own `thread_ts` and therefore THREADS under the
+      // mention. Keeping that would put two reply geometries in one room served by one seat: the
+      // mention-carried wake threaded, every other message in the same conversation flat — the
+      // placement flipping on whether the human happened to type `<@bot>`. Between "match what mpim did
+      // yesterday" and "one seat, one room, one placement", the second wins: the seat is a single
+      // long-lived session over the WHOLE group DM (the same property that makes a 1:1 flat), and a
+      // Slack group DM is capped at nine people, so it has none of the tidiness problem threading
+      // solves in a busy channel. A genuinely threaded mpim message still carries its threadTs and is
+      // still answered inside that thread, exactly as in a 1:1.
+      const origin = { platform: "slack" as const, channelId: ev.channelId, ...(ev.threadTs ? { threadTs: ev.threadTs } : {}) };
+      // THE OWNED-THREAD INGRESS SEAM (§2.6, OPE-1719), on the DM leg too — and the reason is the
+      // `threadTs` two comment blocks above. A Slack DM CAN hold a thread, so a DM thread can be
+      // owned: the DM seat runs on a standing window token, `spawn_thread_session` mounts on it, and
+      // a seat spawned inside a DM thread records a real ownership row. On the raw divert that row
+      // was never read, so the seat was orphaned until its TTL — the exact defect this ticket closes,
+      // on the one surface whose DM carries a thread signal at all. Discord's and Teams' DM legs stay
+      // on the raw divert because THEIR DM origins carry none, not because a DM is special.
+      // A top-level DM message has no `threadTs`, so it is not thread-scoped and goes standing with
+      // no store read — flat DM behaviour is byte-unchanged.
+      await divertInboundToUnifiedWindow(args.to, {
+        message,
+        token: seat.token,
+        // `vendorTs` (OPE-1716): the trigger's OWN ts, which on Slack is its send time — the first
+        // latency anchor, recorded on the ingress row and acted on by nothing.
+        window: { wakeId, origin, addressing: "direct-mention", ...spreadVendorTs(slackVendorEventTime(ev.ts)) },
+        surfaceKey: p.surfaceKey,
+        auth,
+      });
+      // Record the wake off the critical path (best-effort — a touch failure never affects the reply).
+      args.waitUntil(touchDmSeatFn(p.org, p.surfaceKey, atIso).catch(() => {}));
+  // OPE-794 — file this DM wake on the live seat generation's tail ring, AFTER it landed, and only
+  // the TRIGGER. The registry key is the DM window key, the same row the seat itself lives in.
+      args.waitUntil(
+        recordWakeTail(p.org, dmWindowRegistryKey(p.surfaceKey), seat.token, {
+          kind: "wake",
+          at: atIso,
+          from: "human",
+          trust: wakeTrust,
+          // THE AUTHOR GRAIN (OPE-1747) — the same `authorRefuted` the DM's own taint join and
+          // external-policy verdict above read, through the one core road.
+          ...tailAuthorGrain({ trust: wakeTrust, refuted: authorRefuted }),
+          author: ev.userId ?? "unknown",
+          ...(ev.userId ? { authorId: ev.userId } : {}),
+          ...(ev.ts ? { id: ev.ts } : {}),
+          platform: "slack",
+          container: p.surfaceKey,
+          text: ev.text ?? "",
+        }),
+      );
+    };
+
+    // THE IN-MEMORY ATTACHMENT REGISTRY, seeded from an event whose files the front door has already
+    // ADMITTED. Every Events API path gets this inside `parseMessageEvent`, beside its own
+    // `parseSlackFiles` call. The SHORTCUT route cannot (OPE-1442): its files must clear the
+    // readability gate and the wake gates first, and both of those live here rather than in the
+    // parser, so that route seeds through this helper instead. Image-only, matching what
+    // `describe_image` resolves; the durable half for another process is `persistAttachments` below.
+    const registerAttachments = (ev: ParsedMessageEvent): void => {
+      for (const a of ev.attachments ?? []) {
+        if (a.kind === "image" && a.id && a.url) {
+          registerSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, ...(ev.teamId ? { teamId: ev.teamId } : {}) });
+        }
+      }
+    };
+
+    // DURABLE ATTACHMENT REGISTRY (task #107): mirror this message's uploads into the durable
+    // operational store so a DELEGATED worker — a one-shot task in a SEPARATE process from this
+    // seat — can resolve a file id the seat saw (the in-memory registry is process-local). Trusted
+    // provenance: the url_private is the EVENT-supplied string (never a model string), org resolved
+    // from the same event. Off the hot path (waitUntil); fail-open on an unresolvable partition (the
+    // in-memory registry still serves the same-process seat). Persists NON-IMAGE files too, which the
+    // image-only in-memory registry never records — the raw-bytes read path (read_file_upload) needs them.
+    const persistAttachments = (ev: ParsedMessageEvent): void => {
+      const atts = ev.attachments;
+      if (!atts || atts.length === 0) return;
+      let org: string;
+      try {
+        org = resolvePartition(bindableFor(ev)).org;
+      } catch {
+        return; // unresolvable partition → in-memory registry only (fail-open)
+      }
+      for (const a of atts) {
+        if (a.id && a.url) {
+          args.waitUntil(persistSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, teamId: ev.teamId }, org));
+        }
+      }
+    };
+
+    // 🔴 A TENANT REFUSAL STILL HAS TO HAND THE PLATFORM ITS WRITES (cold review, 2026-09-10).
+    // The fence tracks its `surface.wake_dropped` row with `holdRouteWork`, which only pushes the
+    // promise into THIS delivery's pending bag (slack-route-hold.ts). The bag is drained by
+    // `routeHoldQuiesced`, and the one place that runs it is the wrapped `waitUntil` this handler was
+    // given (see `held` in the route builder above). So a branch that refuses and returns 200 WITHOUT
+    // calling `args.waitUntil` hands the platform nothing: the serverless invocation freezes the
+    // moment the response is written and the row never lands. The refusal itself is unaffected — it
+    // is decided before any of this — but the audit row is the drop's ONLY durable signal, because a
+    // webhook function's console output does not reach the operator. One empty `waitUntil` is enough:
+    // the wrapper quiesces the whole tracked bag, not just the promise handed to it.
+    const fencedAck = (res: Response): Response => {
+      args.waitUntil(Promise.resolve());
+      return res;
+    };
+
+    if (decision.kind === "forward") {
+      // A fresh Request so slackChannel can re-read the body and re-verify the signature — and, on a
+      // body carrying an unfenced attachment, one built over the fenced bytes. See `forwardNative`.
+      return forwardNative();
+    }
+
+    if (decision.kind === "dm-wake") {
+      // A DM-FAMILY message — a 1:1 (OPE-351 stage 2) or a group DM (stage 4). OURS, UNCONDITIONALLY:
+      // diverted into the surface's own standing window rather than forwarded to eve's native
+      // `onDirectMessage` (1:1) or handed to the engagement gate that refused it (group DM). The
+      // `OE_DM_SEAT_ROTATION=0` escape hatch that used to short-circuit to a native forward here is
+      // gone (OPE-368) — it was the last supported way to leave a DM un-windowed, i.e. un-wakeable by
+      // a delegated worker's completion, which is precisely the seat class the retired OPE-306
+      // delegation anchor existed to serve.
+      const dev = parseMessageEvent(decision.env);
+      // An unparseable envelope has nothing to wake on — a no-op 200. It carries no channel and no
+      // ts, so it cannot be keyed to a surface and gets a log line rather than an audit row.
+      if (!dev) {
+        console.log(`[open-everywhere:slack-front] ${decision.dmKind} wake dropped — the envelope parsed to no channel/ts`);
+        return OK();
+      }
+      // 🔴 THE TENANT FENCE, AS EARLY AS THIS BRANCH CAN ASK IT (OPE-1644). `scheduleDmWake` below
+      // is the chokepoint and refuses the same delivery on its own, so this is not the fence — it is
+      // what keeps an unadmitted workspace from spending THESE on the way there: the bot-author
+      // probe's audit rows, `persistAttachments` (which registers a FOREIGN workspace's
+      // `url_private` files for a delegated worker to fetch) and a durable dedupe write all sit
+      // between here and it. The parse above has already seeded the in-memory attachment LRU, which
+      // is the one cost no placement in this branch avoids.
+      if (slackFrontTenantFenceDeclined(dev, `dm-${decision.dmKind}`, "front-dm-branch")) return fencedAck(OK());
+      // A bot-authored DM is never a wake — a no-op 200. NOT a forward: forwarding a bot_message
+      // would hand eve's native door a turn the DM window is meant to own.
+      //
+      // 🔴 THE DROP IS COUNTED (OPE-1022). This used to be a bare `return OK()`, which made the DM
+      // door the one wake path in the deployment that could swallow a real, well-formed event with
+      // no audit row and no log line. Slack stamps `bot_id` on every Web-API post, a user token
+      // included, so any script-driven probe lands here — and on 2026-08-23 that silence read as a
+      // dead Slack surface for a drop that was working exactly as designed. Our own reply echo is
+      // excluded inside the helper, so the row means "somebody else's bot spoke here", not chatter.
+      //
+      // 🔴 NAMED EXCEPTIONS ONLY (OPE-1023, OPE-1739, OPE-1754). `wake.e2eDrivers` lists the
+      // deployment's e2e driver identities across every surface, and this door reads its `slack`
+      // entries alone — each a `teamId:botId` pair. A LISTED identity's DM is admitted and woken
+      // like a human's. Nothing but a whole-pair match is admitted. Empty is the
+      // shipped value, and an empty list matches nothing in `isE2eDriver`, so an unconfigured
+      // deployment reaches the drop below with the same verdict and the same row it always had.
+      // `getBotIdentity()` is only awaited AFTER a pair matches, which is why the hot echo leg
+      // gains no lookup.
+      //
+      // The self-check is the loop guard: an operator who wrote OUR OWN bot record into the setting
+      // would otherwise have every reply re-wake the seat forever. Refusing the match costs nothing
+      // (the identity read is a cached promise) and removes the only configuration that could loop.
+      //
+      // The leading `dev.botId` test is what keeps the HUMAN path free: without it every human DM
+      // would resolve the settings object to ask a question only a bot author can answer.
+      const driverAdmitted = Boolean(dev.botId) && dmDoorAdmitsDriver(dev) && dev.botId !== (await getBotIdentity()).botId;
+      if (driverAdmitted) {
+        // LOUD, not silent: the row is what lets a soak review tell an admitted driver DM from a
+        // human DM. It rides `waitUntil` for the same reason the drop's row does — the route 200s
+        // and wakes before the write would land.
+        args.waitUntil(
+          auditDmDriverAdmitted(dev, decision.dmKind).catch(() => {
+            /* observability only — never block or change the decision */
+          }),
+        );
+        console.log(
+          `[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: bot-authored DM ADMITTED — the named e2e driver identity (bot ${dev.botId} in team ${dev.teamId ?? "?"})`,
+        );
+        // …and then FALLS THROUGH to the ordinary DM path below. No separate wake: the whole point
+        // is that the driver's DM takes the same route a human's does.
+      } else if (dev.botId) {
+        // The identity read and the audit write both ride `waitUntil`, so neither delays the 200.
+        // That matters most on the echo leg: Slack re-delivers every reply the bot posts, so this
+        // is the hottest path through the DM door, and it must stay as fast as the bare drop was.
+        // `.catch` because an unhandled rejection inside `waitUntil` can fail the invocation, and
+        // an observability write must never change what the route does.
+        args.waitUntil(
+          (async () => {
+            const { botId: selfBotId } = await getBotIdentity();
+            if (await auditDmBotAuthorDrop(dev, decision.dmKind, selfBotId)) {
+              console.log(
+                `[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: bot-authored DM dropped — no turn (bot ${dev.botId} in team ${dev.teamId ?? "?"}; the DM door admits no bot author)`,
+              );
+            }
+          })().catch(() => {
+            /* observability only — never block or change the decision */
+          }),
+        );
+        return OK();
+      }
+      // 🔴 MENTION-SIBLING SUPPRESSION, GROUP DM ONLY. Slack fires BOTH an `app_mention` and a
+      // `message.mpim` for a group-DM message that @mentions the bot, and the mention branch below
+      // diverts the app_mention into this same seat — so without this drop the room would answer
+      // twice. It is the exact rule the channel wake path applies to a `message.channels` sibling,
+      // applied here because the DM branch returns before ever reaching that code.
+      //
+      // …AND DELIBERATELY NOT FOR A 1:1, where it would be the more dangerous mistake. The mention
+      // branch does not divert an `im` (see there), so nothing else owns a 1:1's mention-bearing
+      // message; suppressing it would turn "@bot are you there?" in a DM into total silence. Whether
+      // Slack even fires app_mention inside an `im` is unmeasured here, and a rule whose failure mode
+      // is a DEAF DM is not the place to bet on a vendor behaviour nobody has checked. Fail-open on an
+      // unresolvable bot identity (same posture as the channel path): an occasional double beats a drop.
+      //
+      // 🔴 AND NOT FOR AN EDIT, for the reason {@link mentionSiblingSuppressed} states in full: Slack
+      // raises no `app_mention` for a `message_changed`, so there is no second event to prefer and
+      // the drop is total silence. The rule is the SHARED helper rather than a copy — this leg and
+      // the channel leg refused the same edit for the same wrong reason, and a second copy is how
+      // the next exemption reaches only one of them.
+      if (decision.dmKind === "mpim") {
+        const { userId: dmBotUserId } = await getBotIdentity();
+        if (
+          mentionSiblingSuppressed({
+            authoredText: dev.authoredText,
+            ...(dev.subtype === undefined ? {} : { subtype: dev.subtype }),
+            ...(dmBotUserId === undefined ? {} : { botUserId: dmBotUserId }),
+          })
+        ) {
+          return OK();
+        }
+      }
+      persistAttachments(dev); // durable upload registry (task #107) — so a delegated worker can read this DM's files
+      // Same two-layer idempotency as every other wake candidate: a Slack RETRY must not double-wake.
+      if (!(await notYetSeen(decision.env, dev))) return OK();
+      // Serialized on the surface's OWN FIFO key — a DM's bursts must not interleave, and its queue is
+      // never shared with a channel supervisor's or a thread's. The mention-carried divert below
+      // enqueues on the SAME key, so a group DM's two legs can never run concurrently on one seat.
+      args.waitUntil(
+        fifo.enqueue(dmFifoKey(dev.channelId), async () => {
+          await deliverWithStrandRetry(() => scheduleDmWake(dev, decision.dmKind, driverAdmitted));
+          console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: woke — diverted to the DM window seat`);
+        }),
+      );
+      return OK();
+    }
+
+    if (decision.kind === "shortcut") {
+      // 🔴 A SHORTCUT IS AN ADDRESSED WAKE. Somebody pressed a named button aimed at this app, so
+      // there is nothing to judge: it takes the `direct-mention` road, exactly like a single-window
+      // @mention and a DM, and never the engagement or name-drop judge that exists to answer "was
+      // the agent addressed?". What it does NOT bypass is any gate: the shortcut is mapped onto the
+      // ordinary ParsedMessageEvent and handed to the SAME dispatchers, so the partition, seat,
+      // window, spend gate, external-participant policy and wake-trust tier are all derived by the
+      // code a mention already goes through. This branch adds a wake ORIGIN, not a plane.
+      const sc = decision.shortcut;
+      // A GLOBAL shortcut names no conversation, so the invoker's own DM window is where it lands —
+      // the one room the person unambiguously chose by pressing a button with no message in scope.
+      // A message shortcut lands in the conversation the message lives in.
+      const shortcutChannelId = sc.kind === "message" ? sc.channelId : await openDirectMessageChannel(sc.userId);
+      if (!shortcutChannelId) {
+        // Fail-closed, and NAMED: this is the one degradation an operator can act on (grant
+        // `im:write` and reinstall). Slack still gets its fast ack — a shortcut that wakes nothing
+        // must not also look like a broken endpoint.
+        console.log(
+          `[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" from ${sc.userId}: no channel to wake in ` +
+            `(a global shortcut opens the invoker's DM, which needs the im:write bot scope) — nothing woken`,
+        );
+        return new Response(null, { status: 200 });
+      }
+      // A message shortcut can be invoked anywhere the app can see a message, so two facts have to
+      // be ASKED for — a `message_action` payload carries neither. A global shortcut skips the
+      // lookup: its channel is the `im` we just opened, so both answers are already known.
+      //   • `channelType` picks the road (DM window vs channel supervisor). It is the same gap an
+      //     `app_mention` envelope has;
+      //   • `appCanRead` says whether this app is in the room at all, which gates the target
+      //     message's FILES below.
+      const shortcutFacts =
+        sc.kind === "global"
+          ? { channelType: "im" as string | undefined, appCanRead: true }
+          : await channelFactsFor(shortcutChannelId)
+              .then((f) => ({ channelType: f.channelType, appCanRead: f.appCanRead === true }))
+              .catch(() => ({ channelType: undefined as string | undefined, appCanRead: false }));
+      const shortcutChannelType = shortcutFacts.channelType;
+      if (!shortcutChannelType) {
+        // 🔴 AN UNRESOLVED CHANNEL TYPE DROPS (OPE-1442). This used to fall through to the channel
+        // road, which is wrong for the case that actually produces an unresolved type: a DM or a
+        // group DM whose `conversations.info` blipped. A shortcut is ADDRESSED, so the channel road
+        // carries `directMention` into the CHANNEL-SUPERVISOR session for this id — and a DM's
+        // content would land in a channel-shaped seat on a transient API failure. There is no
+        // reading of "I could not tell what room this is" that justifies routing it anyway.
+        console.warn(
+          `[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" in ${shortcutChannelId}: ` +
+            `conversations.info resolved no channel type — dropped (a shortcut never routes on an unresolved room)`,
+        );
+        return new Response(null, { status: 200 });
+      }
+      // 🔴 THE FILE GATE (OPE-1442). Slack delivers a `message_action` for a room the app is NOT in,
+      // and the payload carries that message's `url_private`. Registering it would let the bot token
+      // download bytes out of a room the agent's own channel reads refuse, through a door the
+      // channel-read allowlist never sees. So the files ride only on a POSITIVE readability answer;
+      // otherwise the references are dropped from the event as well, and the wake carries the
+      // message's text alone. The wake itself still happens — the invoker is the principal and the
+      // body is fenced, so the TEXT crossing is the ruled Slack-forward precedent. The BYTES are not.
+      if (sc.kind === "message" && !shortcutFacts.appCanRead && (sc.message?.attachments?.length ?? 0) > 0) {
+        console.warn(
+          `[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" in ${shortcutChannelId}: ` +
+            `withheld ${sc.message?.attachments?.length} file reference(s) — the app cannot read that conversation`,
+        );
+      }
+      const sev = shortcutMessageEvent(sc, shortcutChannelId, shortcutChannelType, now(), { admitAttachments: shortcutFacts.appCanRead });
+      // 🔴 THE TENANT FENCE AT THE INTERACTIVITY INGRESS (OPE-1644 / OPE-1645). Both roads out of
+      // this branch are fenced further down — a DM-shaped shortcut by `scheduleDmWake`, a channel
+      // shortcut by `routeSupervisorEvent` — so this refuses the delivery before either, and before
+      // the attachment registry is seeded from it. It is also the door the ORG-WIDE Grid payload
+      // arrives at: such a payload names an enterprise and NO workspace, which `sev` carries as
+      // `enterpriseId` with `teamId` absent, and which the fence now judges on the enterprise
+      // instead of admitting as "names no tenant".
+      //
+      // IT SITS BELOW THE TWO LOOKUPS ABOVE, not above them, because it needs `sev` to write a row
+      // keyed to a surface. Those lookups cost an unadmitted workspace one `conversations.open` or
+      // `conversations.info` on OUR OWN bot token, which answers `user_not_found` /
+      // `channel_not_found` for a foreign id and discloses nothing.
+      if (slackFrontTenantFenceDeclined(sev, `${sc.kind}-shortcut`, "front-shortcut-branch")) return fencedAck(new Response(null, { status: 200 }));
+      // Keyed on the click, not the message — a person may invoke the same shortcut on the same
+      // message twice on purpose, and only Slack's redelivery of ONE click is a duplicate.
+      if (!(await notYetSeenKey(shortcutWakeKey(sc), sev))) return new Response(null, { status: 200 });
+      // BOTH halves of the attachment registry, seeded ONLY on a click that reaches a DISPATCHER —
+      // the in-memory one for this process's seat, the durable one for a delegated worker in
+      // another. (A dispatcher can still refuse further down, as `routeSupervisorEvent`'s own
+      // fail-closed internal confirmation does; that residual click touches the LRU.)
+      // They sit behind every gate above for the reason `parseSlackShortcutPayload`'s header states:
+      // the in-memory map is a 1000-entry LRU shared with every real upload, so seeding it from
+      // clicks that wake nothing evicts records `describe_image` needs.
+      const seedAttachments = (): void => {
+        registerAttachments(sev);
+        persistAttachments(sev);
+      };
+      if (shortcutChannelType === "im" || shortcutChannelType === "mpim") {
+        seedAttachments();
+        args.waitUntil(
+          fifo.enqueue(dmFifoKey(shortcutChannelId), async () => {
+            await deliverWithStrandRetry(() => scheduleDmWake(sev, shortcutChannelType));
+            console.log(`[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}": woke the ${shortcutChannelType} window ${shortcutChannelId}`);
+          }),
+        );
+        return new Response(null, { status: 200 });
+      }
+      // A CHANNEL shortcut takes the addressed single-window road. On a deployment whose domain does
+      // NOT run the unified window there is no road into a channel seat for anything but a native
+      // @mention, which a shortcut cannot become — `scheduleUnownedWake` refuses a `directMention`
+      // it cannot deliver with a loud warn rather than falling through to the silence-biased
+      // name-drop judge, and that refusal is the honest outcome here too. See the runbook.
+      scheduleUnownedWake(sev, `${sc.kind}-shortcut`, true, seedAttachments);
+      return new Response(null, { status: 200 });
+    }
+
+    if (decision.kind === "mention") {
+      // An `app_mention`. Default: forward to eve's native slackChannel exactly as before —
+      // byte-identical for every non-single-window domain. SINGLE-WINDOW (SINGLE-LEG divert): when
+      // the shared seam says the unified window owns mentions on this POSITIVELY-internal channel,
+      // we divert the app_mention EVENT ITSELF into the supervisor as an addressed direct-mention
+      // wake and NEVER forward. ONE decision on ONE webhook: the `message.channels` sibling is
+      // ALWAYS dropped (wake path below, unchanged from today), so nothing depends on it — there is
+      // no separate suppress-leg / deliver-leg pair that could disagree across a webhook, TTL
+      // eviction, or a cold instance, so neither a lost-mention nor a double-answer is possible.
+      // It also handles a public-channel app_mention that fires NO sibling at all. Fail-closed: an
+      // unparseable event, unresolvable partition, or any policy error ⇒ forward (today's path).
+      const mev = parseMessageEvent(decision.env);
+      if (mev) persistAttachments(mev); // durable upload registry (task #107) — before the owned/forward branch
+      let owned = false;
+      if (mev) {
+        try {
+          owned = await singleWindowOwnsMention(mev.channelId, resolvePartition(bindableFor(mev)).surfaceKey);
+        } catch {
+          owned = false; // fail-closed → the native mention path keeps ownership
+        }
+      }
+      if (owned && mev) {
+        // Idempotency on the app_mention's own event_id (a Slack retry must not double-wake).
+        if (!(await notYetSeen(decision.env, mev))) return OK();
+        console.log(
+          `[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: single-window — diverting to the unified supervisor (native forward suppressed)`,
+        );
+        // The supervisor route lifts the app_mention/channel_type disqualifiers for this
+        // directMention path (slack-events.ts routeSupervisorEvent) and re-checks its own
+        // fail-closed internal confirmation — the SAME process-local TTL-cached conversations.info
+        // the policy just populated, so the two reads on this one webhook are cache-coherent.
+        scheduleUnownedWake(mev, "single-window-mention", true);
+        return OK();
+      }
+      // 🔴 THE GROUP-DM MENTION LEG (OPE-351 stage 4). An @mention is how a human addresses the bot in
+      // a multi-party room, so it is the MOST common way an mpim wakes — and left forwarding it would
+      // have split the group DM in two: mentions answered by a native, un-wakeable, per-thread eve
+      // session, everything else by the standing window this stage just gave the room. That split is
+      // not a cosmetic inconsistency; the native session is exactly the seat OPE-351 exists to
+      // abolish, so shipping the message leg alone would leave the headline defect (a seat that
+      // delegates and can never be told the answer arrived) unfixed for the room's main entrance.
+      //
+      // IT COSTS A LOOKUP, because a raw `app_mention` envelope carries NO `channel_type` — the front
+      // route genuinely cannot tell a group DM's mention from a channel's without asking Slack. The
+      // read is the shared TTL-cached `conversations.info` (see slackChannelFactsFor for why that is
+      // cheaper than the uncached read the forward it replaces triggers inside eve).
+      //
+      // SCOPED TO `mpim`, NOT TO "DM-FAMILY": an `im` mention still forwards, byte-identically to
+      // stage 2. The 1:1 message leg does not suppress its mention-bearing sibling (see the dm-wake
+      // branch), so diverting an `im` app_mention as well would double-answer every DM in which
+      // somebody typed the bot's name. Fail-closed everywhere: an unresolved channelType (a workspace
+      // without `mpim:read`) or any error ⇒ the native forward below, which is precisely pre-stage-4
+      // behaviour. 🔴 THAT RESIDUAL FORWARD IS THE ONE REMAINING WAY A DM-FAMILY MESSAGE REACHES A
+      // NATIVE-TOKEN SEAT (OPE-368 removed the deliberate `OE_DM_SEAT_ROTATION=0` route). Such a seat
+      // has no window token, so `canDelegateFromSeat` is false, `agent` does not mount, and the memory
+      // index says `"none"` — the honest pre-OPE-306 posture, not a dead affordance.
+      if (mev) {
+        const mentionChannelType = await channelFactsFor(mev.channelId)
+          .then((f) => f.channelType)
+          .catch(() => undefined);
+        if (mentionChannelType === "mpim") {
+          if (!(await notYetSeen(decision.env, mev))) return OK();
+          console.log(
+            `[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: group DM — diverting to the mpim window seat (native forward suppressed)`,
+          );
+          // The event's own `channel_type` is absent, so the divert is TOLD it is an mpim rather than
+          // re-reading a field that was never there; `scheduleDmWake` stamps it onto the wake auth,
+          // which is what makes `bindSlack` bind mode `mpim` on this leg exactly as on the other.
+          args.waitUntil(
+            fifo.enqueue(dmFifoKey(mev.channelId), async () => {
+              await deliverWithStrandRetry(() => scheduleDmWake({ ...mev, channelType: "mpim" }, "mpim"));
+            }),
+          );
+          return OK();
+        }
+        if (mentionChannelType === undefined) {
+          // NAMED, not silent: this is the one degradation an operator can act on (grant `mpim:read`
+          // and reinstall). Everything else about the mention is unchanged, so it is a log line, not
+          // a failure — a channel mention reaches here too whenever conversations.info is unavailable.
+          console.log(
+            `[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: channel type unresolved (conversations.info unavailable; a group-DM mention needs the mpim:read scope) — forwarding to the native mention path`,
+          );
+        }
+      }
+      // ── THE EXTERNAL-PARTICIPANT POLICY, ON THE NATIVE FORWARD (OPE-507 / OPE-504) ──────────────
+      //
+      // 🔴 THIS IS THE LAST UNGATED SLACK WAKE, AND IT IS THE MOST LIKELY ONE. The three wake routes
+      // in slack-events.ts and the DM seat above all read the policy — but an `app_mention` in an
+      // ordinary NON-single-window channel takes none of them: it is handed to eve's native
+      // `slackChannel`, which owns the turn end to end and has no seam the policy could reach. So the
+      // gate has to sit HERE, above the forward, exactly where teams-front.ts puts its own.
+      //
+      // 🔴 IT COSTS A PROBE, SO IT IS SKIPPED WHEN IT CANNOT MATTER. Unlike the three routes, this
+      // leg resolves no author facts of its own, so gating it means one `users.info` call. The inert
+      // check runs first: on the shipped `taint` / `engage` pair no evidence is resolved at all and
+      // this whole block is a single config read. The probe is TTL-cached per author on top of that.
+      //
+      // FAIL-OPEN on anything unreadable — an unparseable event, an unresolvable partition, a probe
+      // that cannot answer. Every carriage leg in this plane fails open, and a policy error must not
+      // be the thing that takes a workspace's mentions off the air.
+      if (mev) {
+        try {
+          const p = resolvePartition(bindableFor(mev));
+          const roomKey = domainKeyOf(p);
+          if (!externalPolicyIsInert(slackExternalPolicyForRoom(roomKey))) {
+            const internal = (await channelFactsFor(mev.channelId).catch(() => ({ internal: false }))).internal;
+            const facts = await authorFactsFor(internal, mev.userId, mev.teamId);
+            const wakeTrust = resolveWakeTrust({
+              authorIsBot: Boolean(mev.botId),
+              authorId: mev.userId,
+              surfaceInternal: facts.surfaceInternal,
+              channelKey: roomKey,
+            });
+            const verdict = await applySlackExternalPolicy(mev, p, { trust: wakeTrust, refuted: facts.refuted }, "native-mention-forward");
+            if (verdict !== "proceed") {
+              console.log(`[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: suppressed — externalPolicy verdict "${verdict}" (native forward withheld)`);
+              return OK();
+            }
+          }
+        } catch {
+          // fail-open → the native forward below keeps today's behaviour
+        }
+      }
+      return forwardNative();
+    }
+
+    if (decision.kind === "approval-click") {
+      // 🔴 THE TENANT FENCE AT THE INTERACTIVITY INGRESS (OPE-1680). ABOVE the handler, because the
+      // handler is the whole consequence: it loads the pending row, CASes a decision, tests the
+      // clicker against the config-as-code admin roster and EXECUTES the approved act. A foreign
+      // workspace's `U…` reaching that is the aliasing the fence exists for — most sharply on a
+      // payload naming NO workspace (an org-wide Grid install), where `handleApprovalPayload` passes
+      // no `clickContext` and `resolveApprovalClick` then reads the clicker's tenant off the CARD's
+      // own room, i.e. off the ADMITTED workspace. See `slackInteractivityTenantFenceDeclined`.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "approval-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours: handled entirely by our code (load → CAS decide → approver check → execute →
+      // chat.update), never Eve's. Fast empty 200 — Slack interactivity wants a quick ack,
+      // not a rendered reply.
+      //
+      // 🔴 `args.waitUntil` RIDES ALONG (OPE-1709), and it is the HELD one (see the route hold
+      // above), so the deferred work is quiesced before the delivery's own promise resolves. What
+      // it moves off this path is the session-grant release: an "Approve for session" click on a
+      // fan-out decides and EXECUTES the sibling cards the grant already covers, and that loop has
+      // no business inside Slack's three-second interactivity budget.
+      if (await handleApproval(decision.payload, { waitUntil: args.waitUntil })) {
+        return new Response(null, { status: 200 });
+      }
+      // Defensive: classification said "ours" but the handler disagreed (a mismatch, e.g. a
+      // stale/foreign action_id shape) — fall through to forwarding so the click is never
+      // silently swallowed.
+      return forwardNative();
+    }
+
+    if (decision.kind === "setkey-click") {
+      // THE TENANT FENCE (OPE-1680), above the handler for the same reason the approval branch states.
+      // The intake's owner check is over a bare per-workspace member id, so an unadmitted workspace's
+      // click is a claim on somebody else's credential intake.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "setkey-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours (credentials/intake.ts): verify the clicker owns the intake, then views.open the modal —
+      // the trigger_id lives in the payload we already classified. Fast empty 200 (Slack wants a quick
+      // interactivity ack; the modal opens via the views.open API call, not this response body).
+      if (await handleSetKeyClick(decision.payload)) {
+        return new Response(null, { status: 200 });
+      }
+      return forwardNative();
+    }
+
+    if (decision.kind === "connect-click") {
+      // THE TENANT FENCE (OPE-1680), above the handler. This branch MINTS AN OAUTH URL against a
+      // connector, so an unadmitted workspace reaching it is a foreign tenant driving this
+      // deployment's connector plane on our own credentials.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "connect-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours (connections/connector-card.ts): re-verify standing host-side, then mint an ephemeral
+      // OAuth URL / open the api-key intake. Fast empty 200 (Slack wants a quick interactivity ack;
+      // the ephemeral URL / intake button is posted via a separate API call, not this response body).
+      if (await handleConnectClick(decision.payload)) {
+        return new Response(null, { status: 200 });
+      }
+      return forwardNative();
+    }
+
+    if (decision.kind === "grant-click") {
+      // THE TENANT FENCE (OPE-1680), above the handler — and above the vendor round trip below, which
+      // is the most expensive thing an unadmitted workspace could make this deployment spend: the
+      // approve leg opens a session under the OWNER's account (a consent probe, a token mint, an MCP
+      // handshake and a `tools/list`) before it CASes.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "grant-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours (access/credential-grant-card.ts): the OWNER answered a credential-grant ask in their
+      // own DM. Core verifies the signed payload's `user.id` IS that ask's owner, then approves or
+      // declines and answers the owner ephemerally through a separate API call.
+      //
+      // 🔴 ACK BEFORE THE VENDOR READ. An approval opens the owner's MCP connection before its
+      // CAS — consent probe, token mint, handshake and `tools/list` — and a healthy cold catalogue
+      // can cross Slack's three-second interactivity deadline. Classification and the tenant fence
+      // have already proved this is our signed `oe_grant:` action, so the empty 200 goes out now and
+      // the route's held `waitUntil` keeps exactly one resolution alive afterwards. The approve CAS
+      // remains the exactly-once decider if Slack redelivers a click whose first ACK was lost.
+      //
+      // A handler disagreement is an invariant violation after classification, not a reason to
+      // forward after acknowledging: eve does not own `oe_grant:` and cannot answer it. Keep it loud
+      // without rejecting the host's background promise or changing the already-sent response.
+      args.waitUntil(
+        Promise.resolve()
+          .then(async () => {
+            if (!(await handleGrantCardClick(decision.payload))) {
+              console.warn("[open-everywhere:slack-front] classified grant click was not claimed by the grant handler");
+            }
+          })
+          .catch(() => {
+            // The handler is total in production. Keep an impossible injected/runtime rejection
+            // visible without putting vendor or credential-bearing error text into the route log.
+            console.warn("[open-everywhere:slack-front] grant click failed after acknowledgement");
+          }),
+      );
+      return new Response(null, { status: 200 });
+    }
+
+    if (decision.kind === "input-click") {
+      // THE TENANT FENCE (OPE-1680), above the handler, for the same reason every other interactivity
+      // branch carries it: a tap RESUMES a parked turn, which is this deployment spending on a scope
+      // an unadmitted workspace never had standing to decide.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "input-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours (core channels/approval-card.ts): somebody tapped a bridged eve approval this
+      // deployment posted onto a unified origin. The handler resolves the ticket, admits the tap
+      // through the SAME floor the typed answer takes, and delivers `respond([{requestId, optionId}])`
+      // to the parked WINDOW session.
+      //
+      // 🔴 THE DELIVERY GOES BY SESSION ID (OPE-1863). `args.from` is CHANNEL-LOCAL — on this route
+      // it addresses `slack:<token>`, while the parked session lives at `unified:<token>` — so the
+      // settle threw "the target session was not found" and every tap left the approval parked.
+      // `args.attachSession` dispatches by durable session id from any channel, and
+      // `approvalCardRespondVia` is the one road every surface binds. Bound HERE and injected because
+      // the route handler is the only place eve hands out either primitive.
+      //
+      // The 200 goes out AFTER the settle, deliberately, and the cost is stated rather than hidden:
+      // Slack expects this endpoint to answer in about three seconds, and a settle that runs longer
+      // leaves the tapper waiting on whatever Slack does then. Acking first and settling in the
+      // background would fix the delay and WIDEN the handler's own non-atomic window — see the
+      // "THE LIMIT OF THAT" paragraph in `slack-approval-card.ts`, which also records that the
+      // past-deadline behaviour is unmeasured here.
+      const respondToApproval: ApprovalRespondFn = approvalCardRespondVia(args.attachSession);
+      const tap = await handleApprovalCardClick(decision.payload, respondToApproval);
+      console.log(`[open-everywhere:slack] oe_input: tap — ${tap.reason}`);
+      // `handled:false` means the payload carried our prefix but not a shape the handler could read.
+      // Forward it rather than swallow it, the same defensive shape the grant and setkey branches
+      // take: a click this deployment cannot act on is better handed on than silently dropped.
+      if (!tap.handled) return forwardNative();
+      return new Response(null, { status: 200 });
+    }
+
+    if (decision.kind === "setkey-submit") {
+      // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
+      // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
+      // no `channel`, which is the case the fence's row writer keys to `SLACK_INTERACTIVITY_SURFACE`.
+      // The refusal answers with the SAME empty 200 a successful close does, never the `errors`
+      // object: an inline validation message would tell a foreign tenant it reached a live modal.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "setkey-submit", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // Ours: encrypt + store the pasted value host-side (the model never sees it). A view_submission
+      // must answer with a JSON body — empty ⇒ Slack closes the modal (success), an `errors` object ⇒
+      // inline validation (expired/used/blank). `handled:false` (a callback_id we don't own slipped
+      // through) falls through to forwarding.
+      const result = await handleSetKeyViewSubmission(decision.payload);
+      if (result.handled) {
+        return result.response
+          ? new Response(JSON.stringify(result.response), { status: 200, headers: { "content-type": "application/json" } })
+          : new Response(null, { status: 200 });
+      }
+      return forwardNative();
+    }
+
+    if (decision.kind === "join") {
+      // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
+      // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
+      // opposite polarity from the mention suppression below: unresolved identity means we
+      // can't prove the joiner is us, so nobody wakes (vs. "an occasional double is better
+      // than a dropped reply" for suppression).
+      const jev = parseChannelJoinEvent(decision.env);
+      if (!jev) return OK();
+      const { userId: joinBotUserId } = await getBotIdentity();
+      if (!joinBotUserId || jev.userId !== joinBotUserId) return OK();
+
+      // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
+      // double intro is exactly the annoyance the durable half exists to prevent.
+      const joinKey = wakeKey(decision.env, jev.channelId, jev.ts);
+      if (dedupe.seen(joinKey, now())) return OK();
+      dedupe.mark(joinKey, now());
+      try {
+        const org = resolvePartition(bindableForJoin(jev)).org;
+        if (!(await markEventSeen(org, joinKey, new Date(now()).toISOString()))) return OK();
+      } catch {
+        /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+      }
+
+      const joinSend = send; // the same 0.31 `from(address).send(…)` adapter built above
+      // A fresh join can't contend with an existing thread FIFO (its thread root is the
+      // join notice itself), so no queueing — same reasoning as the name-drop wake.
+      args.waitUntil(
+        routeChannelJoinEvent(jev, liveChannelJoinDeps(joinSend)).then(logOutcome("channel-join", jev.channelId, jev.ts)),
+      );
+      return OK();
+    }
+
+    if (decision.kind === "reaction") {
+      // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
+      const rev = parseSlackReactionEvent(decision.env);
+      if (!rev) return OK();
+
+      // 🔴 THE TENANT FENCE (OPE-1680), and this branch is on the fence's list for a reason the other
+      // five do not share: the ✋ STOP arm reaches `args.attachSession`, eve's I/O-free CANCEL door,
+      // so an unadmitted workspace's reaction can HALT a running session in the admitted one. The
+      // rest of the branch also writes a durable dedupe row and records feedback against our own
+      // replies. A reaction arrives on the Events API rather than the interactivity URL, so its
+      // workspace is the one the PARSER already read off the envelope, and its Grid rung comes from
+      // `slackEnterpriseIdFromEnvelope` — the same two fields `fenceDeclined` reads for a message.
+      //
+      // IT SITS BELOW THE PARSE, not above it: the parse is pure and free, and it is what lets the
+      // refusal row name the channel the reaction happened in rather than a placeholder.
+      const reactionEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+      if (
+        slackInteractivityTenantFenceDeclined(
+          {
+            ...(rev.teamId === undefined ? {} : { teamId: rev.teamId }),
+            ...(reactionEnterpriseId === undefined ? {} : { enterpriseId: reactionEnterpriseId }),
+            channelId: rev.channelId,
+            userId: rev.reactorId,
+          },
+          "reaction",
+          "front-reaction-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+
+      // Same two-layer idempotency as every other wake candidate: a Slack RETRY (same
+      // event_id) must not double-record a reaction. In-memory first, then the durable store
+      // (a retry usually lands on a fresh serverless instance). Fail-open on an unresolvable
+      // partition — dedupe prevents a double row, not a security hole.
+      const rkey = wakeKey(decision.env, rev.channelId, rev.messageTs);
+      if (dedupe.seen(rkey, now())) return OK();
+      dedupe.mark(rkey, now());
+      try {
+        const org = resolvePartition(bindableForReaction(rev)).org;
+        if (!(await markEventSeen(org, rkey, new Date(now()).toISOString()))) return OK();
+      } catch {
+        /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+      }
+
+      // Resolve the bot identity once (cached) so the route can tell the bot's own reaction
+      // from a human's and whether the target is the bot's own reply. A reaction can't
+      // contend with any thread FIFO (it starts no turn), so no queueing — just fire it.
+      // `args.attachSession` rides in for the ✋ STOP arm (OPE-418): it is eve's I/O-free cancel
+      // door, and handing it in here is what lets a stop happen PRE-DISPATCH — no session mint,
+      // no model call, and therefore no spend and no cap to be over.
+      const identity = await getBotIdentity();
+      args.waitUntil(
+        routeReactionEvent(rev, liveReactionDeps(identity, args.attachSession)).then((o) =>
+          console.log(`[open-everywhere:slack-front] reaction ${rev.channelId}/${rev.messageTs}: ${o.recorded ? "recorded" : "not recorded"} — ${o.reason}`),
+        ),
+      );
+      return OK();
+    }
+
+    // Wake path. Parse the message; a non-message or id-less envelope is a no-op 200.
+    const ev = parseMessageEvent(decision.env);
+    if (!ev) return OK();
+    persistAttachments(ev); // durable upload registry (task #107) — so a delegated worker can read this message's files
+
+    // Mention-sibling suppression — see {@link mentionSiblingSuppressed} for the whole rule and for
+    // why an EDIT is exempt from it.
+    const { userId: botUserId } = await getBotIdentity();
+    if (mentionSiblingSuppressed({ authoredText: ev.authoredText, ...(ev.subtype === undefined ? {} : { subtype: ev.subtype }), ...(botUserId === undefined ? {} : { botUserId }) })) {
+      return OK();
+    }
+
+    // Idempotency: a retried (or duplicated) event must not double-wake. In-memory first (free,
+    // same-instance), then the durable store (cross-instance — a Slack retry usually lands on a
+    // fresh serverless instance). One small statement, well inside Slack's 3s ack window.
+    if (!(await notYetSeen(decision.env, ev))) return OK();
+
+    if (!ev.threadTs) {
+      // TOP-LEVEL message: never an engagement wake — but possibly a name-drop candidate
+      // (per-domain opt-in, fail-closed; slack-events.ts routeNameDropEvent), or — when
+      // ambientSupervisor is on for this domain — a supervisor wake. The reply thread it may
+      // start is rooted at this message's ts, so a name-drop can't contend with any existing
+      // FIFO chain; the supervisor wake serializes on the supervisor token instead.
+      scheduleUnownedWake(ev, "name-drop");
+      return OK();
+    }
+
+    // SEATED-CHANNEL short-circuit (task #100): where the channel has a standing seat, that seat owns
+    // ALL in-thread traffic. A mention was diverted into it (no native per-thread session exists), so
+    // an engaged thread's follow-up must ride the seat, NEVER the native per-thread token below
+    // (routeMessageEvent), or it would wake a fresh empty session off the wrong token. The seat's own
+    // deterministic stop leg (slack-events.ts routeSupervisorEvent) honours the engagement row a
+    // diverted mention enrolls.
+    //
+    // 🔴 THE ENGAGEMENT READ IS BACK, AND OPE-1695 IS WHY. This branch used to fire only on a WINDOW
+    // domain, which implied `ambientSupervisor`, so reaching the seat road was guaranteed. Every
+    // channel is seated now, so in an ADDRESSED-ONLY room the same call would fall through to the
+    // name-drop judge and answer nothing — the seat would reply to a mention and then go deaf on its
+    // own thread. The read says which it is: an ENGAGED thread (the seat is holding this
+    // conversation) takes the seat road whatever the chattiness flag says; a thread nobody engaged is
+    // ordinary room traffic and still obeys the flag. Fail-closed: an unreadable row is NOT engaged.
+    const p = resolvePartition(bindableFor(ev));
+    if (seatedSurface(p.surfaceKey)) {
+      const seatEngaged = await isThreadEngaged(p, ev.threadTs).catch(() => false);
+      scheduleUnownedWake(ev, "in-thread-window", false, undefined, seatEngaged);
+      return OK();
+    }
+
+    // In-thread branch (one engagement read decides it): an ENGAGED thread takes the
+    // delivery path (rolled-in reply); a NON-engaged in-thread message runs the trigger
+    // check instead — a name-drop can now pull the bot into a live sub-thread it wasn't in
+    // (slack-events.ts shouldNameDropWake no longer disqualifies inThread).
+    // Fail-closed isThreadEngaged reads an error as NOT engaged → the hard-gated trigger
+    // path, never a spurious delivery.
+    const engaged = await isThreadEngaged(p, ev.threadTs);
+    if (!engaged) {
+      // Trigger-check path: like the top-level name-drop it roots on the existing thread
+      // and can't contend with a FIFO chain, so it follows the same non-queued waitUntil
+      // shape rather than the per-thread queue (the supervisor branch enqueues on its own key).
+      scheduleUnownedWake(ev, "name-drop-thread");
+      return OK();
+    }
+
+    // Per-thread FIFO: serialize this thread's bursts; hand the promise to waitUntil so the
+    // route returns 200 now while the wake continues in the background. (The FIFO is
+    // deliberately per-instance: cross-instance ORDERING would need a lease/queue, and the
+    // failure mode — two burst replies racing — is cosmetic, unlike the duplicate-delivery
+    // problem the durable dedupe above closes.)
+    const threadKey = slackContinuationToken(ev.channelId, ev.threadTs);
+    args.waitUntil(
+      fifo.enqueue(threadKey, () => routeMessageEvent(ev, liveDeps(send)).then(logOutcome("engaged-thread", ev.channelId, ev.threadTs!))),
+    );
+    return OK();
+  }
+}
+
+/**
+ * Compose the engagement front route with a wrapped `slackChannel`. `inner` must have been
+ * built with `route: INTERNAL_SLACK_ROUTE`. Returns the SAME channel value (preserving Eve's
+ * internal `__kind`/adapter/receive) with the public front route prepended — so Slack's URL
+ * hits us, and both routes share one channel name → one session namespace.
+ */
+export function frontSlackChannel<C extends Channel<any, any, any>>(inner: C, opts: FrontOptions = {}): C {
+  const innerPost = inner.routes.find(
+    (r): r is HttpRouteDefinition<any> => r.method === "POST" && r.path === INTERNAL_SLACK_ROUTE,
+  );
+  if (!innerPost) {
+    throw new Error(
+      `frontSlackChannel: wrapped slackChannel must be built with route: "${INTERNAL_SLACK_ROUTE}" ` +
+        `(found paths: ${inner.routes.map((r) => r.path).join(", ")})`,
+    );
+  }
+  const front = buildFrontHandler(innerPost.handler, opts);
+  return { ...inner, routes: [POST(PUBLIC_SLACK_ROUTE, front), ...inner.routes] };
+}