@open-everywhere/provider-slack 0.6.0 → 0.8.0

package/agent/channels/slack-commands.ts

@@ -36,18 +36,23 @@ import { defineChannel, POST } from "eve/channels";
 import { verifySlackSignature } from "./slack-front.js";
 import { slackSigningSecret } from "../setup/credentials.js";
 import {
+  commandFailureText,
   bindFrom,
   runOeCommand,
   oeSlash,
   parseSlackCommandText,
   resolvePartition,
+  auditSurfaceModeFrom,
   getOperationalStore,
   admittedTenantsFromConfig,
   unadmittedTenantLog,
   UNADMITTED_TENANT_DROP_REASON,
   type BindableContext,
+  type SurfaceBinding,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackTenantAdmission } from "./slack-tenant-fence.js";
+import { slackAuthorIsMember, slackChannelFactsFor } from "./slack-events.js";
+import { slackMode } from "./slack-identity.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:slack-commands] ${msg}`);
@@ -63,6 +68,21 @@ function formField(params: URLSearchParams, name: string): string | undefined {
   return v && v.length > 0 ? v : undefined;
 }
 
+/** What the route learned about a command's trust before it binds. `dmPartnerTrust` is the invoker's own
+ *  verdict in a 1:1 DM. `room` is a channel's `conversations.info` verdict, present whenever Slack answered
+ *  it, whoever typed the command. `invokerMember` is present only when `users.info` CONFIRMED the invoker a
+ *  member (see {@link slashRoomVerdict}). The person's binding stamps `room` only beside `invokerMember`;
+ *  the room's binding stamps it alone (OPE-2588). */
+export interface SlashTrustFacts {
+  readonly dmPartnerTrust?: "internal" | "external";
+  readonly room?: { readonly extShared: boolean };
+  readonly invokerMember?: true;
+}
+
+/** Which verdict a slash binding resolves: the PERSON's (the room's verdict folded with the invoker
+ *  check, which every member gate reads) or the ROOM's alone (which the room's budget reads). */
+export type SlashTrustLeg = "person" | "room";
+
 /** Build the BindableContext the identity seam (bindFrom/bindSlack) expects from Slack's
  *  slash-command form fields. Slack's slash-command payload carries no `channel_type` /
  *  `is_private` bit (unlike an app_mention/message event) — `bindSlack`'s existing fallbacks
@@ -75,16 +95,36 @@ function formField(params: URLSearchParams, name: string): string | undefined {
  *  reads — so a Grid declared once now answers here the same way it answers at every other door,
  *  instead of resolving as though the line were absent.
  *
- *  🔴 STATE ITS REACH EXACTLY, because this door is narrower than the wake doors. For a CHANNEL
- *  command it does NOT change `binding.trust`: this payload carries no `conversations.info` verdict,
- *  so `slackTrust(undefined, undefined, "channel")` fails closed to `external`, and `bindFrom` takes
- *  that raw verdict ahead of any vouch. So a channel `/oe` stays `trust: "external"` with the rung
- *  and without it, and the budget scope `domainNameForScope` picks is unchanged. The rung reaches
- *  `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), where the mapper leaves trust
- *  undefined and the vouch is what answers. Spread conditionally, like every other door: a
- *  single-workspace install stamps nothing. */
-export function bindableForSlashCommand(params: URLSearchParams): BindableContext {
+ *  🔴 STATE ITS REACH EXACTLY. For a CHANNEL command the rung does NOT change `binding.trust`: the
+ *  room's own verdict answers there (see below), and `bindFrom` takes that raw verdict ahead of any
+ *  vouch. The rung reaches `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), and only
+ *  when the invoker probe gave no verdict: the mapper then leaves trust undefined and the vouch
+ *  answers (see below). Spread conditionally, like every other door: a single-workspace install
+ *  stamps nothing.
+ *
+ *  🔴 A CHANNEL COMMAND CARRIES THE ROOM'S OWN VERDICT (OPE-2579). Slack's slash payload carries no
+ *  sharing bit, so before this every channel `/oe` bound `slackTrust(undefined, undefined,
+ *  "channel")`, which fails closed to `external`. A member in an internal channel was then refused
+ *  `/oe suggest on` as an outsider. The route now passes {@link slashRoomVerdict}'s answer as
+ *  `is_ext_shared` + `trust_checked`, the two attributes a channel message stamps from the same
+ *  TTL-cached `conversations.info`. So a channel command reads the room's `internal` or `external` as a
+ *  message in that room does. On the `person` leg (the default) the verdict is stamped only for an
+ *  invoker `users.info` confirms a member. On the `room` leg it is stamped for anybody, because that
+ *  leg answers the room's budget, not a member gate (OPE-2588, {@link bindSlashCommand}). No verdict
+ *  stamps nothing, and the command stays fail-closed `external`.
+ *
+ *  🔴 A DM COMMAND CARRIES THE INVOKER'S OWN VERDICT (OPE-2579). In a 1:1 DM the invoker IS the
+ *  partner, and the route passes {@link slashInvokerDmTrust}'s answer as `dm_partner_trust`, the
+ *  attribute the chat DM leg stamps from the same `users.info` probe. Before this, a workspace vouch
+ *  alone answered a DM command, so a guest or a Connect stranger in their DM with the app read
+ *  `internal` here while the same person read `external` in a DM turn. A verdict outranks the vouch
+ *  in both directions, exactly as in a DM turn: a guest reads `external` under a workspace vouch, and
+ *  a confirmed member reads `internal` with no declaration at all. No verdict leaves the attribute
+ *  unset and the binding resolves as before. This reaches every `/oe` command typed in a DM, not
+ *  only `watch`. */
+export function bindableForSlashCommand(params: URLSearchParams, invoker?: SlashTrustFacts, leg: SlashTrustLeg = "person"): BindableContext {
   const enterpriseId = formField(params, "enterprise_id");
+  const room = invoker?.room && (leg === "room" || invoker.invokerMember === true) ? invoker.room : undefined;
   return {
     channel: { kind: "slack" },
     session: {
@@ -94,6 +134,8 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
             team_id: formField(params, "team_id") ?? "",
             channel_id: formField(params, "channel_id") ?? "",
             ...(enterpriseId ? { enterprise_id: enterpriseId } : {}),
+            ...(invoker?.dmPartnerTrust ? { dm_partner_trust: invoker.dmPartnerTrust } : {}),
+            ...(room ? { is_ext_shared: String(room.extShared), trust_checked: "true" } : {}),
           },
           principalId: formField(params, "user_id") ?? "",
           principalType: "slack-user",
@@ -103,6 +145,120 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
   };
 }
 
+/** How long each trust read (the invoker probe, the room read) may take before the route answers without
+ *  it. Slack wants its ack inside three seconds, and `slackForm`'s 429 backoff can wait longer than that. */
+const INVOKER_PROBE_MS = 1_500;
+
+/**
+ * The invoker's own membership verdict for a 1:1 DM command, in `dm_partner_trust`'s vocabulary, or
+ * `{}` when there is none to give (OPE-2579). It is the chat DM leg's reading of the same probe
+ * (slack-front.ts `liveDmPartnerTrust`): `slackAuthorIsMember` decides, so the two doors cannot
+ * drift on what a guest is. A channel or group DM asks nothing here: there the ROOM's verdict is the
+ * binding's trust, and {@link slashRoomVerdict} reads it.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. No user id, no bot token, a refused `users.info`, a transport
+ * failure or a probe slower than {@link INVOKER_PROBE_MS} all answer `{}`, which leaves the binding
+ * exactly as it resolved before this probe existed. An unanswered probe never invents a guest, and
+ * never invents a member.
+ */
+export async function slashInvokerDmTrust(
+  params: URLSearchParams,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<{ readonly dmPartnerTrust?: "internal" | "external" }> {
+  const userId = formField(params, "user_id");
+  if (!userId || slackMode(undefined, formField(params, "channel_id")) !== "dm") return {};
+  const member = await withinAckBudget(probe(userId, formField(params, "team_id")));
+  return member === undefined ? {} : { dmPartnerTrust: member ? "internal" : "external" };
+}
+
+/** The room facts {@link slashRoomVerdict} reads: `slackChannelFactsFor`'s shape, which every channel wake reads. */
+export type SlashRoomFacts = (channelId: string) => Promise<{ readonly channelType?: string; readonly extShared?: boolean; readonly trustChecked?: boolean }>;
+
+/**
+ * A CHANNEL command's room verdict and invoker check, or `{}` when there is no room verdict to give
+ * (OPE-2579). The room read is `slackChannelFactsFor`, the TTL-cached `conversations.info` every
+ * channel wake reads, so the command door and the message door cannot disagree about one room.
+ *
+ * 🔴 THE INVOKER LEG, AND IT FAILS CLOSED. A channel message keeps the room's verdict on the auth and marks
+ * a guest author on the side (slack-events.ts `slackWakeAuthorFacts`), because one guest's message must not
+ * demote the channel's memory for everybody. A command has no session to protect: its binding exists for
+ * one answer, and `/oe suggest on` and `/oe watch more|less` read `binding.trust` as "is this person a
+ * member". So the route folds the author leg into the binding's `trust`, the composition Discord and
+ * Teams make: `invokerMember` is set only when `users.info` CONFIRMS the invoker a member, and the
+ * person's binding stamps the room's verdict only beside it. A guest, a Slack Connect stranger, and a
+ * person the probe could not check (no `users:read`, a refusal, a timeout) all leave `trust` fail-closed
+ * `external`. The message door fails OPEN on an unanswered probe because it marks a turn. Here `trust`
+ * IS the member gate, and a channel has no declaration to fall back to the way a DM command does.
+ *
+ * 🔴 THE ROOM'S VERDICT IS RETURNED FOR EVERY INVOKER (OPE-2588). `/oe budget` names the room's budget,
+ * and a channel's turns are charged under the room's domain, whoever typed them. So {@link bindSlashCommand}
+ * binds the room's verdict alone into `roomTrust`, and the budget reads that. A guest's `trust` is
+ * unchanged, and `/oe budget` reads both to refuse a guest in an internal channel (commands/core.ts
+ * `budgetWithheldFrom`). `/oe cover on` refuses outside a DM before it reads trust.
+ *
+ * 🔴 ONLY A ROOM IN THE CHANNEL MODE IS STAMPED. A 1:1 DM has its own leg ({@link slashInvokerDmTrust}).
+ * A group DM, or a room whose type Slack did not report, stamps nothing, so its binding is unchanged.
+ * Stamping a sharing verdict on a group DM the binding still calls a channel would mix two modes' rules.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. A failed or refused `conversations.info`, a response without the check,
+ * or a read slower than {@link INVOKER_PROBE_MS} answers `{}`. The command then binds `external`, as
+ * before this read existed. The room read and the invoker probe run in parallel inside one ack budget.
+ */
+export async function slashRoomVerdict(
+  params: URLSearchParams,
+  roomFacts: SlashRoomFacts = slackChannelFactsFor,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<SlashTrustFacts> {
+  const channelId = formField(params, "channel_id");
+  if (!channelId || slackMode(undefined, channelId) === "dm") return {};
+  const userId = formField(params, "user_id");
+  const [facts, member] = await Promise.all([
+    withinAckBudget(roomFacts(channelId)),
+    userId ? withinAckBudget(probe(userId, formField(params, "team_id"))) : Promise.resolve(undefined),
+  ]);
+  if (!facts || facts.trustChecked !== true || typeof facts.extShared !== "boolean") return {};
+  if (facts.channelType !== "channel" && facts.channelType !== "group") return {};
+  return { room: { extShared: facts.extShared }, ...(member === true ? { invokerMember: true as const } : {}) };
+}
+
+/** Both legs, for whichever kind of room the command came from. Never throws. */
+export async function slashTrustFacts(params: URLSearchParams): Promise<SlashTrustFacts> {
+  return slackMode(undefined, formField(params, "channel_id")) === "dm" ? slashInvokerDmTrust(params) : slashRoomVerdict(params);
+}
+
+/**
+ * The slash command's binding, with the room's trust and the person's trust kept apart (OPE-2588).
+ *
+ * `trust` is the PERSON leg: the member gate `/oe suggest on`, `/oe watch more|less` and `/oe cover on`
+ * read. `roomTrust` is the ROOM leg: the same `bindFrom` walk over the room's verdict alone, so the
+ * declarations and the fail-closed default apply to it unchanged. `/oe budget` and the caps behind
+ * `raise` and `clear` read it through `roomTrustOf`. Before this the binding carried one value, so a
+ * guest in an internal channel read the external domain's budget while that channel's turns were
+ * charged under the internal domain. Now `/oe budget` refuses that guest, because a guest must not read
+ * an internal room's caps and spend (Tommy's ruling on #1431).
+ *
+ * In a DM both legs bind the same context, so the two values are equal. Every other field comes from
+ * the person's binding. The two bindings differ only in the two trust attributes, which move no key.
+ */
+export function bindSlashCommand(params: URLSearchParams, facts: SlashTrustFacts): SurfaceBinding {
+  const person = bindFrom(bindableForSlashCommand(params, facts, "person"));
+  const room = bindFrom(bindableForSlashCommand(params, facts, "room"));
+  return { ...person, roomTrust: room.trust };
+}
+
+/** `p`'s answer, or `undefined` when it throws or takes longer than {@link INVOKER_PROBE_MS}. */
+async function withinAckBudget<T>(p: Promise<T>): Promise<T | undefined> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<undefined>((resolve) => {
+    timer = setTimeout(() => resolve(undefined), INVOKER_PROBE_MS);
+  });
+  try {
+    return await Promise.race([p.catch(() => undefined), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * Make a refused slash command OBSERVABLE, the same way `slack.ts`'s `auditWakeDropped` makes a
  * refused wake observable: the webhook function's console output never reaches `vercel logs`, so
@@ -122,16 +278,18 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
  */
 async function auditCommandDropped(teamId: string | undefined, channelId: string | undefined, reason: string, enterpriseId?: string): Promise<void> {
   try {
-    const p = resolvePartition({
+    const bindable = {
       channel: { kind: "slack" },
       session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-    } as BindableContext);
+    } as BindableContext;
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action: "surface.wake_dropped",
       detail: { reason, door: "slash-command", channel: channelId ?? null, team: teamId ?? null, enterprise: enterpriseId ?? null },
     });
@@ -141,6 +299,9 @@ async function auditCommandDropped(teamId: string | undefined, channelId: string
 }
 
 function ephemeralResponse(text: string): Response {
+  // OPE-2490: an empty reply means the command's card posted in this channel and IS the answer. An
+  // empty 200 acknowledges the command, and Slack then shows nothing beside the card.
+  if (text.length === 0) return new Response(null, { status: 200 });
   return new Response(JSON.stringify({ response_type: "ephemeral", text }), {
     status: 200,
     headers: { "content-type": "application/json" },
@@ -218,17 +379,17 @@ export default defineChannel({
       }
 
       const cmd = parseSlackCommandText(formField(params, "text"));
-      const binding = bindFrom(bindableForSlashCommand(params));
+      const binding = bindSlashCommand(params, await slashTrustFacts(params));
       try {
         const reply = await runOeCommand(cmd, binding, { attachSession });
         return ephemeralResponse(reply);
       } catch (err) {
-        // runOeCommand's budget-raise/clear branches can throw a user-facing validation error
-        // (e.g. proposing from a DM with no explicit scope) — surface it verbatim. Never let a
-        // thrown error escape as a 500; Slack's slash-command UX for that is an ugly
-        // "operation_timeout"/dispatch_failed toast.
+        // A PersonFacingError is already worded for the person — it renders as-is. Anything else
+        // (a store or network failure, a planner's model-facing refusal) renders the generic line,
+        // and its message goes to the log only (OPE-2486). Never let a thrown error escape as a
+        // 500; Slack's slash-command UX for that is an ugly "operation_timeout"/dispatch_failed toast.
         log(`"${expected}" command failed softly: ${String(err)}`);
-        return ephemeralResponse(`Couldn't complete that: ${err instanceof Error ? err.message : String(err)}`);
+        return ephemeralResponse(commandFailureText(err));
       }
     }),
   ],

package/agent/channels/slack-context.ts

@@ -38,11 +38,6 @@ import { loadThreadContextMessages } from "eve/channels/slack";
 import type { SlackMessage } from "eve/channels/slack";
 import { MAX_MESSAGES, renderContext, type ContextLine } from "@open-everywhere/core/agent/adapter-api.js";
 
-// Re-export the shared render + line shape so slack-wake-backscroll.ts (which imports them from
-// here) keeps compiling unchanged after the extraction, and any future Slack consumer has one
-// import site. The mapping (`linesFromMessages`) is defined below — it's Slack-message-shaped.
-export { renderContext, type ContextLine };
-
 // When the rendered slice fills MAX_MESSAGES exactly, there's very likely more history above
 // it (both fetchers below request MAX_MESSAGES-worth from Slack, so filling the cap usually
 // means older messages were left out) — tell the model this is a bounded slice, not the whole

package/agent/channels/slack-events.ts

@@ -23,6 +23,7 @@ import { slackBotToken } from "../setup/credentials.js";
 import { RateLimitExhaustedError } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   resolvePartition,
+  auditSurfaceModeFrom,
   cancelAnchoredTurn,
   turnAnchorKey,
   STOP_HAND_SLACK_NAME,
@@ -113,6 +114,7 @@ import {
   dmTrustTtlMs,
   engagedFollowUpContract,
   dispatchNativeWakeWithRetry,
+  coverForWake,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   slackMode,
@@ -129,9 +131,8 @@ import { holdRouteWork } from "./slack-route-hold.js";
 import { fetchWakeBackscrollLines, fetchWakeEnvelopeBackscroll, RAW_FETCH_REACHBACK_HOURS, WAKE_BACKSCROLL_MAX, type WakeBackscrollLines } from "./slack-wake-backscroll.js";
 // The silence vocabulary (NO_REPLY_SENTINEL / PREFER_NO_REPLY_TOOL) MOVED to normalized-wake.ts —
 // the shared wake renderer that emits it — so no per-surface dialect can drift its own copy.
-// PREFER_NO_REPLY_TOOL is re-exported here for existing importers; provider-neutral callers reach
-// NO_REPLY_SENTINEL through turn-delivery.ts (OPE-114 Stage 0), never through this provider file.
-export { PREFER_NO_REPLY_TOOL };
+// Provider-neutral callers reach NO_REPLY_SENTINEL through turn-delivery.ts (OPE-114 Stage 0), never
+// through this provider file.
 import { registerSlackAttachment } from "./slack-attachments.js";
 // Provider-neutral turn/delivery helpers lifted to turn-delivery.ts (OPE-114 Stage 0). The
 // Slack code below still consumes these three (turnEffectsFor builds on FinalMessageAction,
@@ -165,6 +166,7 @@ import {
   type ReactionIngestOutcome,
   type ReactionVerb,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 /**
  * Minimal Slack `event_callback` envelope shape (the subset the parser reads). Mirrors
@@ -260,6 +262,12 @@ export interface ParsedMessageEvent {
    * wake envelope's `<previous-body>` (wake-envelope.ts) so a judged turn can diff old↔new.
    */
   readonly previousText?: string;
+  /**
+   * TRUE ⇒ a `message_changed` edit whose words and files are exactly the pre-edit ones
+   * ({@link isUnchangedSlackEdit}). Absent on every other event, and on an edit that carries no
+   * `previous_message` to compare against, so an unknown edit reads as a real one.
+   */
+  readonly unchangedEdit?: true;
   /** True when the text @mentions the bot — those go through the normal mention path. */
   readonly isAppMention: boolean;
   /** Image/file attachment REFERENCES parsed off Slack's `files[]` (docs Part B) — surfaced in
@@ -724,6 +732,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   for (const a of attachments) {
     if (a.kind === "image" && a.id && a.url) registerSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, teamId });
   }
+  const unchangedEdit = previousMessage !== undefined && isUnchangedSlackEdit(inner, previousMessage);
   return {
     channelId,
     ts,
@@ -737,6 +746,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
     text,
     authoredText,
     previousText: typeof previousMessage?.text === "string" ? previousMessage.text : undefined,
+    ...(unchangedEdit ? { unchangedEdit: true as const } : {}),
     // `app_mention` arrives as its own event type; a `message` whose text contains the bot
     // ref is also a mention. We don't know our own bot id here, so the event-type check is
     // the reliable signal; the route also filters app_mention so the mention path owns it.
@@ -749,6 +759,49 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   };
 }
 
+/**
+ * Does a `message_changed` edit leave the message's WORDS and FILES as they were? Pure.
+ *
+ * 🔴 WHY THIS EXISTS (OPE-2577). Slack raises `message_changed` for more than a person's edit. It
+ * raises one each time the message's METADATA changes: a link unfurl, and, in the person's DM with
+ * the app, each `agents.sessions.setStatus` call that OE itself makes on the session's root message
+ * (slack-agent-session.ts: the title at the door, `processing` at turn start, `active` or
+ * `suspended` at the park). The event is hidden: `conversations.history` never lists it, and its
+ * `ts` is a fresh notice stamp. Its inner message is the person's own message, with the person's
+ * own author. So before this predicate, the DM door woke the seat on every one of them, as a NEW
+ * inbound wake. Ship #252 measured it: one DM drew three more wakes within 15 seconds, the
+ * reply-freshness gate refused the answer to the person's real wake as `stale-conversation`, and the
+ * answer landed under a later edit wake. A voice clip was lost, because an edit is never heard again
+ * (slack-voice-clips.ts).
+ *
+ * An edit that changes no words and no files says nothing new, so no door wakes on it. A REAL edit
+ * still wakes: any difference in the typed text, in the quoted-message text Slack parks in
+ * `attachments[]` ({@link resolveSlackInboundText}), or in a file's id or its tombstone mark (a deleted file
+ * stays as `mode: "tombstone"`) makes this false.
+ */
+export function isUnchangedSlackEdit(inner: Record<string, unknown>, previous: Record<string, unknown>): boolean {
+  const textOf = (m: Record<string, unknown>): string => resolveSlackInboundText(typeof m.text === "string" ? m.text : "", m);
+  if (typeof previous.text !== "string") return false; // no pre-edit text to compare ⇒ treat it as a real edit
+  if (textOf(inner) !== textOf(previous)) return false;
+  // Each file's identity, plus a tombstone mark: Slack keeps a deleted file's `id` on the message and
+  // marks it `mode: "tombstone"`, so a removal changes the key even when the id set does not. Only that
+  // one mode counts, so a field that one copy carries and the other omits cannot turn a metadata-only
+  // edit into a real one.
+  const fileKeys = (m: Record<string, unknown>): string =>
+    (Array.isArray(m.files) ? m.files : [])
+      .map((f) => {
+        const o = typeof f === "object" && f !== null ? (f as Record<string, unknown>) : {};
+        const key = [o["id"], o["url_private"], o["name"]].find((v) => typeof v === "string") ?? "";
+        return `${String(key)}${o["mode"] === "tombstone" ? ":tombstone" : ""}`;
+      })
+      .sort()
+      .join("\n");
+  return fileKeys(inner) === fileKeys(previous);
+}
+
+/** The log reason both Slack wake doors give when they drop an {@link isUnchangedSlackEdit} edit. */
+export const UNCHANGED_EDIT_DROP_REASON = "an edit that changed no words and no files (a metadata-only message_changed) — not news";
+
 // --- judged replies: the wake instruction + the silence sentinel -------------
 //
 // An engaged thread forwards EVERY human reply to the session (that's what engagement
@@ -1236,7 +1289,7 @@ function seatWakeAddressing(opts: SlackWakeOpts): "direct-mention" | "name-drop"
  * surface", which an mpim is — inventing a fourth value for it would extrapolate a Tag-derived
  * vocabulary with no evidence behind the new entry.
  */
-export function slackDmWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake {
+function slackDmWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake {
   return slackJudgedWake(ev, "direct-mention", opts, "dm");
 }
 
@@ -1296,7 +1349,7 @@ export interface MessageRouteDeps {
    */
   readonly confirmInternal?: (channelId: string) => Promise<boolean>;
   /** Append a durable audit row. Optional; best-effort. */
-  readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+  readonly audit?: (action: string, detail: AuditDetail) => Promise<void>;
   /** Resolve the trigger author's display name for the envelope (fail-soft). Optional so
    *  existing test doubles keep compiling AND so a wake never depends on a name lookup — absent
    *  or throwing ⇒ the raw id renders. Live wiring points this at {@link fetchUserProfileNames}. */
@@ -1319,7 +1372,7 @@ export function bindableFor(ev: ParsedMessageEvent): BindableContext {
  *  them off — the interactivity CLICK routes (OPE-1680), which carry a signed payload rather than a
  *  message. ONE builder, so a row written from a click keys to the same partition a message from the
  *  same room would. */
-function bindableForSlackIds(ids: {
+export function bindableForSlackIds(ids: {
   readonly teamId?: string | undefined;
   readonly channelId: string;
   readonly channelType?: string | undefined;
@@ -1513,15 +1566,16 @@ function wakeState(ev: ParsedMessageEvent, threadTs: string, extra?: Record<stri
 
 /** Best-effort durable audit row from a route dep (`engagement.stop` / etc.). Resolves the
  *  partition from the surface key so the row is org/surface-scoped like every other audit. */
-async function appendRouteAudit(surfaceKey: string, action: string, detail: Record<string, unknown>): Promise<void> {
+async function appendRouteAudit(surfaceKey: string, action: string, detail: AuditDetail): Promise<void> {
   try {
     // surfaceKey is `platform/workspace/surface` — split to the partition fields the audit row needs.
     const [platform = "slack", workspace = "", surface = ""] = surfaceKey.split("/");
-    const org = resolvePartition({
+    const bindable = {
       channel: { kind: platform },
       session: { auth: { current: { attributes: { team_id: workspace, channel_id: surface }, principalId: "", principalType: "slack-user" } } },
-    } as Parameters<typeof resolvePartition>[0]).org;
-    await getOperationalStore().appendAudit({ ts: new Date().toISOString(), org, platform, workspace, surface, action, detail });
+    } as Parameters<typeof resolvePartition>[0];
+    const org = resolvePartition(bindable).org;
+    await getOperationalStore().appendAudit({ ts: new Date().toISOString(), org, platform, workspace, surface, ...auditSurfaceModeFrom(bindable), action, detail });
   } catch (err) {
     console.warn(`[open-everywhere:slack] route audit write failed: ${String(err)}`);
   }
@@ -1556,7 +1610,7 @@ async function appendRouteAudit(surfaceKey: string, action: string, detail: Reco
  * new thread still gets told why it's being ignored. Fail-open by contract — a dedupe-store
  * outage posts anyway.
  */
-export async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, threadRootTs: string): Promise<SpendGateDecision> {
+async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, threadRootTs: string): Promise<SpendGateDecision> {
   return slackSpendGate({
     bindable: bindableFor(ev),
     mode: slackMode(ev.channelType, ev.channelId),
@@ -1607,7 +1661,7 @@ export async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, t
  * changes the decision. The route never WAITS on the audit sink — it holds the write open instead,
  * so the row lands after the 200 rather than racing the freeze that follows it.
  */
-function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, detail: Record<string, unknown> = {}): void {
+function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, detail: AuditDetail = {}): void {
   // HELD ON THE ROUTE, not fire-and-forget (OPE-1648). Every engagement route runs inside the front
   // route's `waitUntil`, but a `void`-ed write is OUTSIDE the promise that holds it — so the row
   // raced the freeze that follows the 200 exactly as the mention door's did.
@@ -1617,7 +1671,7 @@ function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, deta
 /** The awaitable half of {@link auditEngagementWakeDropped}. Never throws. The DM door hands the
  *  promise to `waitUntil` directly, because that route returns a 200 immediately and the serverless
  *  invocation can freeze before an unawaited write lands. */
-async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, detail: Record<string, unknown>): Promise<void> {
+async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, detail: AuditDetail): Promise<void> {
   await appendWakeRow(ev, "surface.wake_dropped", reason, detail);
 }
 
@@ -1625,7 +1679,7 @@ async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, deta
  *  DM door's admission row below. It resolves the event's own partition, so a row is always keyed to
  *  the surface it happened on, and it swallows every failure: an observability write must never
  *  block a route or change its decision. */
-async function appendWakeRow(ev: ParsedMessageEvent, action: string, reason: string, detail: Record<string, unknown>): Promise<void> {
+async function appendWakeRow(ev: ParsedMessageEvent, action: string, reason: string, detail: AuditDetail): Promise<void> {
   await appendWakeRowForIds({ teamId: ev.teamId, channelId: ev.channelId, channelType: ev.channelType, userId: ev.userId }, ev.ts, action, reason, detail);
 }
 
@@ -1637,16 +1691,18 @@ async function appendWakeRowForIds(
   ts: string | null,
   action: string,
   reason: string,
-  detail: Record<string, unknown>,
+  detail: AuditDetail,
 ): Promise<void> {
   try {
-    const p = resolvePartition(bindableForSlackIds(ids));
+    const bindable = bindableForSlackIds(ids);
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action,
       detail: { reason, channel: ids.channelId, ts, ...detail },
     });
@@ -1955,6 +2011,9 @@ export async function auditDmDriverAdmitted(ev: ParsedMessageEvent, dmKind: "im"
     dmKind,
     botId: ev.botId ?? null,
     team: ev.teamId ?? null,
+    // The event's subtype, so a reader can tell a typed message from an edit or an upload without
+    // a second source (OPE-2577 had to infer it from the notice-shaped `ts`).
+    subtype: ev.subtype ?? null,
   });
 }
 
@@ -2043,10 +2102,6 @@ function authForEvent(ev: ParsedMessageEvent, facts?: ChannelFacts): OpenEverywh
   });
 }
 
-// Keep mode resolution referenced (the wake scopes to a channel, never mpim/dm here) so a
-// future spike that needs it doesn't re-derive — and to assert the import stays live.
-export const _engagementWakeMode = (ev: ParsedMessageEvent) => slackMode(ev.channelType, ev.channelId);
-
 // --- name-drop wake: judged replies to unmentioned TOP-LEVEL messages ---------
 //
 // Claude Tag's documented behaviour ("a top-level message without a mention may still
@@ -2154,7 +2209,7 @@ export function shouldNameDropWake(input: NameDropInput): ReplyDecision {
  * disqualifiers would go stale the first time somebody adds one to the policy above, and the arm
  * would then reach a message the policy had just started dropping.
  */
-export function nameDropAbstained(input: NameDropInput): boolean {
+function nameDropAbstained(input: NameDropInput): boolean {
   if (input.textMatchesName) return false;
   return shouldNameDropWake({ ...input, textMatchesName: true }).deliver;
 }
@@ -2717,11 +2772,6 @@ export function botDisplayName(): Promise<string | undefined> {
   return botDisplayNamePromise;
 }
 
-/** Reset the cached display name (tests only). */
-export function _resetBotDisplayName(): void {
-  botDisplayNamePromise = undefined;
-}
-
 // Positively confirm a channel is internal via conversations.info, TTL-cached (channels
 // change shared-ness rarely; the API is rate-limited). Any failure → { internal: false }
 // (fail-closed). The SAME response also carries the channel's descriptive metadata
@@ -3234,7 +3284,7 @@ function externalPolicyDropReason(verdict: SlackExternalVerdict): string {
  * On `withhold` it costs one TTL-cached `users.info` per DISTINCT hydrated author, resolved in
  * parallel, and the render budget caps the hydration at ten lines.
  */
-export async function withholdNameDropContext(
+async function withholdNameDropContext(
   nw: NormalizedWake,
   policy: ExternalPolicy,
   teamId: string | undefined,
@@ -3552,17 +3602,20 @@ async function fetchChannelTranscript(channelId: string): Promise<string | undef
 // `handle` = the person's SELF-SET display name (Tag treats the handle as the better human-address
 // signal). Both are UNTRUSTED, attacker-controllable profile content — the wake renderer XML-escapes
 // them wherever they land in the envelope frame.
-const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string } | undefined>>();
-export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string } | undefined> {
+const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string; email?: string } | undefined>>();
+export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string; email?: string } | undefined> {
   let p = userProfileCache.get(userId);
   if (!p) {
     p = (async () => {
       const info = await slackForm("users.info", `user=${encodeURIComponent(userId)}`);
       if (info?.ok !== true) return undefined;
-      const user = info.user as { profile?: { display_name?: string; real_name?: string }; real_name?: string; name?: string } | undefined;
+      const user = info.user as { profile?: { display_name?: string; real_name?: string; email?: string }; real_name?: string; name?: string } | undefined;
       const handle = user?.profile?.display_name?.trim() || undefined;
       const name = user?.profile?.real_name?.trim() || user?.real_name?.trim() || user?.name?.trim() || undefined;
-      return { name, handle };
+      // The workspace-verified address, present only under the `users:read.email` scope (OPE-2482): the
+      // identifier a person can check beside a self-set name.
+      const email = user?.profile?.email?.trim() || undefined;
+      return { name, handle, ...(email ? { email } : {}) };
     })();
     userProfileCache.set(userId, p);
   }
@@ -4050,7 +4103,7 @@ export interface SupervisorRouteDeps {
     window?: UnifiedWindowWake;
   }) => Promise<void>;
   /** Append a durable audit row (e.g. `engagement.stop`). Optional; best-effort. */
-  readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+  readonly audit?: (action: string, detail: AuditDetail) => Promise<void>;
   /**
    * ENGAGE the trigger's thread as a PARTICIPATING surface (task #100 — window-riding stop parity):
    * called ONLY on an ADDRESSED `directMention` so a mention diverted into the window enrolls its
@@ -4107,6 +4160,11 @@ export interface SupervisorRouteDeps {
  * route's own singleWindow + internal facts — a directMention flag on a non-single-window or
  * non-internal wake degrades safely to the plain channel-watch treatment. Unset ⇒ byte-identical.
  */
+/** The Slack user ids a message mentions (`<@U…>` or `<@U…|name>`), in the order it names them. Pure. */
+export function slackMentionedUserIds(text: string | undefined): string[] {
+  return [...(text ?? "").matchAll(/<@([UW][A-Z0-9]+)(?:\|[^>]*)?>/g)].map((m) => m[1]!);
+}
+
 export async function routeSupervisorEvent(
   ev: ParsedMessageEvent,
   deps: SupervisorRouteDeps,
@@ -4506,7 +4564,7 @@ export async function routeSupervisorEvent(
     // `priorContext` map above) and the hydrated lines are decided by one transform, and it returns
     // the wake BY REFERENCE on the `taint` opt-out grain, so nothing moves for a deployment that
     // opted out. Run only on the name-drop tier, which is the only tier that carries the slot.
-    const wake = slackChannelWatchWake(ev, {
+    const watchWake = slackChannelWatchWake(ev, {
       mode: "supervisor",
       trust: wakeTrust,
       engagementTier,
@@ -4543,6 +4601,25 @@ export async function routeSupervisorEvent(
         ? { contextLines: nameDropRendered, contextSource: nameDropContext?.source, readMoreHint: nameDropContext?.readMoreHint }
         : {}),
     });
+    // 🔴 OUT-OF-OFFICE COVER (OPE-2513). A message that mentions a person with live cover gets OE's cover note on
+    // THIS wake, and nothing else changes: the binding, the auth bag and the room's memory stay the room's, so the
+    // answer can use only what this room already knows. No window, no wake id, no cover (cover/wake.ts).
+    const cover = await coverForWake({
+      org: p.org,
+      platform: "slack",
+      workspace: p.workspace,
+      surface: p.surface,
+      surfaceKey: p.surfaceKey,
+      channelId: ev.channelId,
+      roomPublic: ev.channelType === "channel",
+      wakeId: window?.wakeId,
+      mentionedIds: slackMentionedUserIds(ev.authoredText),
+      ...(ev.userId ? { askerId: ev.userId } : {}),
+      ...(trigger.authorName ? { askerName: trigger.authorName } : {}),
+      text: ev.authoredText,
+      now: new Date(atIso),
+    }).catch(() => ({ covered: [] }) as { systemNote?: string });
+    const wake = cover.systemNote ? { ...watchWake, systemNote: watchWake.systemNote ? `${watchWake.systemNote}\n${cover.systemNote}` : cover.systemNote } : watchWake;
     const rendered = renderWake(
       nameDropTier ? await withholdNameDropContext(wake, externalPolicy, ev.teamId, deps.authorIsMember) : wake,
       deps.now,