@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/integrations/slack-interactions.ts

@@ -7,14 +7,20 @@ import {
   ListSlackUserLinkAccessRequestsResponse,
   PrepareSlackUserLinkAccessRequest,
   evaluateSlackTaskPolicy,
+  resolveWorkspaceSlackOrchestrationNoticeSettings,
   resolveWorkspaceSlackReactionSummonSettings,
+  SlackChannelRouteListResponse,
   SlackReactionChannelListResponse,
+  UpdateSlackChannelRoutesRequest,
   SlackUserLinkAccessMutationRequest,
   SlackUserLinkAccessRequest,
   type AccessGrant,
   type FileResourceRef,
   type FirstPartyMcpToolName,
   type HumanInputQuestion,
+  type ResolvedWorkspaceSlackOrchestrationNoticeSettings,
+  type ChildRequiresActionPayload,
+  type SessionAuthorizationListScope,
   type SessionEvent,
   type WorkspaceSlackReactionSummonSettings,
   workspaceSlackReactionChannelAllowed,
@@ -31,13 +37,16 @@ import {
   advanceSlackInteractionDelivery,
   bindSlackInteractionSession,
   cancelSlackUserLinkAccessRequest,
+  claimSlackAppHomeRefresh,
   claimSlackInteractionDelivery,
   claimSlackInteractionProgressDelivery,
   claimSlackInteractionInbox,
   closeSlackInteractionDelivery,
   completeSlackUserLinkAccessIfGranted,
+  decodeSessionListCursor,
   deferSlackInteractionDelivery,
   deleteSlackBotUserLink,
+  enqueueSlackAppHomeRefresh,
   enqueueSlackInteractionInbox,
   getConnectionMetadata,
   getOrCreateSlackInteraction,
@@ -45,36 +54,61 @@ import {
   getSession,
   getSessionEvent,
   getSessionHumanInputRequest,
+  childRequiresActionResolutionExists,
+  getSessionSystemUpdateById,
   getSlackBotPostOperation,
   getSlackBotUserLink,
   getSlackInteractionActionHandle,
   getSlackInteractionByClientEventId,
   getSlackInteractionById,
-  getSlackInteractionByRoute,
+  getSlackInteractionByConnectionRoute,
+  probeSlackActionHandleTenancy,
+  openSlackRoutePrompt,
+  getSlackRoutePromptByOption,
+  settleSlackRoutePrompt,
+  answerSlackRoutePrompt,
+  type SlackRoutableWorkspace,
+  getSlackChannelRoute,
+  listSlackChannelRoutes,
+  upsertSlackChannelRoute,
+  deleteSlackChannelRoute,
+  getSlackUserDmRoute,
+  listNamedSubjectSlackRoutableWorkspaces,
   getActiveSlackTaskPolicy,
   getSlackSharedTaskOrigin,
   getSessionEventByClientEventId,
   getWorkspace,
   getWorkspaceGrant,
+  namedSubjectPersonalWorkspaceId,
+  resolveSlackTargetAuthority,
   listSlackInteractionProgressDeliveryEvidence,
   listSessionEventPage,
   listSessionHumanInputRequests,
   listPendingSlackUserLinkAccessRequests,
+  listSlackInstallationBindings,
+  slackUserLinkAccessRequestTeam,
   rekeySlackInteractionRoute,
   reopenSlackInteractionDelivery,
   reserveSlackInteractionActionHandles,
+  renewSlackAppHomeRefreshClaim,
   releaseSlackInteractionDelivery,
+  releaseSlackAppHomeRefresh,
   releaseSlackInteractionInbox,
   requestSlackUserLinkWorkspaceAccess,
   resolveSlackInstallationRoute,
+  resolveSlackInteractionFirstTaskHint,
   saveSlackInteractionInboxReactionCheckpoint,
   saveSlackSharedTaskOrigin,
   settleSlackInteractionInbox,
+  settleSlackAppHomeRefresh,
   settleSlackInteractionActionHandles,
+  listSessionsForSubject,
+  SessionListAccessError,
   denySlackUserLinkAccessRequest,
   prepareSlackUserLinkAccessRequest,
   SlackUserLinkAccessPersistenceError,
   type SlackInstallationRoute,
+  type SlackAppHomeRefresh,
   type SlackInteraction,
   type SlackInteractionActionHandle,
   type SlackInteractionActionKind,
@@ -88,6 +122,7 @@ import {
   hasPermission,
   requireAccessContext,
   requireAccessGrant,
+  requireSessionAuthorizationListScope,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import { publishDurableSessionEvents } from "@opengeni/events";
@@ -100,6 +135,20 @@ import {
   type SlackMessageBlock,
   SlackBotProviderError,
 } from "./slack-bot";
+import {
+  isSlackDirectMessageConversation,
+  resolveSlackWorkspaceRoute,
+  slackRoutedRequestText,
+  type SlackRouteResolution,
+  type SlackRouteTenancy,
+} from "./slack-routing";
+import {
+  buildSlackAppHomeAccessBlocks,
+  buildSlackAppHomeBlocks,
+  escapeSlackMrkdwn,
+  isSlackAppHomeLinkAction,
+  slackAppHomeOpenedEvent,
+} from "./slack-app-home";
 import { importSlackReactionImage, type ImportedSlackReactionImage } from "../slack-reaction-files";
 
 export const SLACK_INTERACTION_MAX_BODY_BYTES = 256 * 1024;
@@ -112,6 +161,13 @@ export const SLACK_DELIVERY_EVENT_TYPES = [
   "turn.failed",
   "turn.cancelled",
   "session.status.changed",
+  // Orchestration surfacing. Both are filtered again inside the pump: the
+  // workspace must have opted in (both notices default off), and then only a
+  // `child_requires_action` notice and a `limits` / `max_auto_continuations`
+  // goal pause reach Slack, so the thread stays quiet for the deferred child
+  // lifecycle kinds and for human/API/agent pauses the human already made.
+  "system.update.pending",
+  "goal.paused",
 ] as const;
 
 const MAX_SLACK_TEXT_CHARS = 3_500;
@@ -125,6 +181,7 @@ const MAX_SLACK_REACTION_IMAGE_AGGREGATE_BYTES = 16 * 1024 * 1024;
 const MAX_PROGRESS_MESSAGES = 3;
 const SLACK_USER_LINK_TTL_MS = 15 * 60_000;
 const INBOX_LEASE_MS = 30_000;
+const APP_HOME_LEASE_MS = 300_000;
 const DELIVERY_LEASE_MS = 30_000;
 const MAX_DELIVERY_ATTEMPTS = 8;
 const MAX_DELIVERY_RETRY_MS = 5 * 60_000;
@@ -132,6 +189,23 @@ const SLACK_INTERACTION_BOT_SUBJECT_ID = "service:slack-interaction";
 const SLACK_ACTION_TTL_MS = 7 * 24 * 60 * 60_000;
 const MAX_SLACK_APPROVALS_PER_CARD = 8;
 const MAX_SLACK_ACTIONS_PER_CARD = 20;
+/** Blocked-worker cards are pointers, so the question preview stays short. */
+const MAX_SLACK_CHILD_DETAIL_CHARS = 240;
+const SLACK_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+/**
+ * Goal pause reasons the Slack thread announces. `user_pause`, `api`, `agent`,
+ * and `no_progress` are deliberately absent.
+ *
+ * A Map, not a plain object: this lookup is the sole gate of a two-reason
+ * invariant, and a plain object indexed by a payload-derived string answers
+ * `constructor` (and every other prototype key) with a truthy value that would
+ * sail past the `if (!headline)` guard. No payload reaches it with such a
+ * reason today; the gate should not depend on that staying true.
+ */
+const SLACK_GOAL_PAUSED_HEADLINES = new Map<string, string>([
+  ["limits", "Goal paused (budget)"],
+  ["max_auto_continuations", "Goal paused (continuation cap)"],
+]);
 /**
  * Slack delivery restrictions are durable session-level authority, not
  * attacker-adjacent user-message context. Migration 0240 backfills this exact
@@ -340,6 +414,46 @@ export function slackReactionInboxEntry(
   };
 }
 
+/**
+ * Prove a Slack link token may name this workspace.
+ *
+ * Before routing, a token could only ever name the installation's own
+ * workspace, and both intent routes asserted exactly that. A routed
+ * conversation asks for access to the workspace the work would actually land
+ * in, which is a different one, so the assertion becomes: the installation
+ * binding resolves for the token's team, it is the same connection the token
+ * was minted against, and the named workspace belongs to that installation's
+ * organization.
+ *
+ * That is the same fence the route tables carry. It does not widen access by
+ * itself: this only decides which workspace an access REQUEST may be raised
+ * for, and the request still goes through the ordinary approval path.
+ */
+async function resolveSlackLinkTargetInstallation(
+  deps: ApiRouteDeps,
+  link: { slackTeamId: string; connectionId: string },
+  workspaceId: string,
+): Promise<{
+  accountId: string;
+  connectionId: string;
+  workspaceName: string;
+  /** Where the identity link lives, which is not the routed workspace. */
+  identityHome: { accountId: string; workspaceId: string };
+} | null> {
+  const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
+  if (!route || route.connectionId !== link.connectionId || route.accountId.length === 0) {
+    return null;
+  }
+  const workspace = await getWorkspace(deps.db, workspaceId);
+  if (!workspace || workspace.accountId !== route.accountId) return null;
+  return {
+    accountId: route.accountId,
+    connectionId: route.connectionId,
+    workspaceName: workspace.name,
+    identityHome: { accountId: route.accountId, workspaceId: route.workspaceId },
+  };
+}
+
 export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/integrations/slack/events", async (c) => {
     const signed = await readSignedSlackRequest(c, deps);
@@ -357,6 +471,19 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         message: "Slack installation unavailable",
       });
     const event = record(payload.event);
+    const appHomeEvent = slackAppHomeOpenedEvent(payload);
+    if (appHomeEvent) {
+      await enqueueSlackAppHomeRefresh(deps.db, {
+        accountId: installation.accountId,
+        workspaceId: installation.workspaceId,
+        connectionId: installation.connectionId,
+        slackTeamId: appHomeEvent.slackTeamId,
+        slackUserId: appHomeEvent.slackUserId,
+        providerEventId: appHomeEvent.eventId,
+        providerViewHash: appHomeEvent.viewHash,
+      });
+      return c.json({ ok: true });
+    }
     if (event?.type === "reaction_added") {
       const [workspace, connection] = await Promise.all([
         getWorkspace(deps.db, installation.workspaceId),
@@ -383,7 +510,7 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
   app.post("/v1/integrations/slack/commands", async (c) => {
     const signed = await readSignedSlackRequest(c, deps);
     const form = new URLSearchParams(signed.rawBody);
-    if (form.get("command") !== "/opengeni") {
+    if (form.get("command") !== deps.settings.slackCommand) {
       throw new HTTPException(400, { message: "invalid Slack command" });
     }
     const entry = normalizedFormInteraction(form, "slash_command");
@@ -392,6 +519,12 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
       throw new HTTPException(403, {
         message: "Slack installation unavailable",
       });
+    // `<command> info` is a read-only ephemeral explainer. It never reaches the
+    // durable inbox, never verifies channel membership, and never creates a
+    // session, so it is safe anywhere the command is available.
+    if (isSlackInfoCommand(entry.text)) {
+      return c.json(await slackInfoCommandResponse(deps, installation, entry));
+    }
     const client = await createOpenGeniSlackBotInteractionClient(deps, {
       accountId: installation.accountId,
       workspaceId: installation.workspaceId,
@@ -424,6 +557,7 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
     const form = new URLSearchParams(signed.rawBody);
     const payload = parseJsonObject(form.get("payload") ?? "");
     if (payload.type === "block_actions") {
+      if (isSlackAppHomeLinkAction(payload)) return c.json({ ok: true });
       const entry = normalizedBlockActionInteraction(payload);
       const installation = await resolveSlackInstallationRoute(deps.db, entry.slackTeamId);
       if (!installation) {
@@ -482,22 +616,13 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
     if (!link || link.workspaceId !== workspaceId) {
       throw freshSlackLinkRequired();
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (
-      !route ||
-      route.workspaceId !== workspaceId ||
-      route.connectionId !== link.connectionId ||
-      route.accountId.length === 0
-    ) {
-      throw freshSlackLinkRequired();
-    }
-    const workspace = await getWorkspace(deps.db, workspaceId);
-    if (!workspace || workspace.accountId !== route.accountId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw freshSlackLinkRequired();
     }
     try {
       const prepared = await prepareSlackUserLinkAccessRequest(deps.db, {
-        accountId: route.accountId,
+        accountId: installation.accountId,
         workspaceId,
         tokenDigest: createHash("sha256").update(payload.linkToken).digest("hex"),
         connectionId: link.connectionId,
@@ -511,12 +636,13 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         workspaceId,
         requestId: prepared.id,
         subjectId: context.subjectId,
+        identityHome: installation.identityHome,
       });
       if (!completed) throw freshSlackLinkRequired();
       return c.json(
         SlackUserLinkAccessRequest.parse({
           ...completed,
-          workspaceDisplayName: workspace.name,
+          workspaceDisplayName: installation.workspaceName,
         }),
         201,
       );
@@ -624,14 +750,33 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
       const payload = ApproveSlackUserLinkAccessRequest.parse(await c.req.json());
+      // The identity link belongs to the installation, which for a routed
+      // request is a different workspace from the one being granted. The
+      // request row names its Slack team, so the binding resolves from it.
+      const requestId = c.req.param("requestId");
+      const requestTeam = await slackUserLinkAccessRequestTeam(deps.db, {
+        workspaceId,
+        requestId,
+      });
+      const installation = requestTeam
+        ? await resolveSlackInstallationRoute(deps.db, requestTeam.slackTeamId)
+        : null;
       try {
         const request = await approveSlackUserLinkAccessRequest(deps.db, {
           workspaceId,
-          requestId: c.req.param("requestId"),
+          requestId,
           actorSubjectId: grant.subjectId,
           expectedVersion: payload.expectedVersion,
           idempotencyKey: payload.idempotencyKey,
           permissions: payload.permissions,
+          ...(installation
+            ? {
+                identityHome: {
+                  accountId: installation.accountId,
+                  workspaceId: installation.workspaceId,
+                },
+              }
+            : {}),
           ...(payload.role !== undefined ? { role: payload.role } : {}),
         });
         const workspace = await getWorkspace(deps.db, workspaceId);
@@ -690,8 +835,8 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         message: "invalid or expired Slack identity link",
       });
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (!route || route.workspaceId !== workspaceId || route.connectionId !== link.connectionId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw new HTTPException(404, {
         message: "Slack installation not found",
       });
@@ -712,6 +857,7 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         workspaceId,
         requestId: prepared.id,
         subjectId: grant.subjectId,
+        identityHome: installation.identityHome,
       });
       if (completed?.status !== "completed") throw freshSlackLinkRequired();
       const saved = await getSlackBotUserLink(
@@ -745,6 +891,135 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
     },
   );
 
+  app.get("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    // Same gate as the reaction-channel allowlist beside it. The response names
+    // workspaces across the organization, including ones the reader may hold no
+    // grant in, so it is not an ordinary connections read.
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const connectionId = boundedString(c.req.query("connectionId"), 64);
+    if (!connectionId) throw new HTTPException(400, { message: "connectionId is required" });
+    const routes = await listSlackChannelRoutes(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      { connectionId },
+    );
+    // Names are resolved once per distinct target rather than per route.
+    const names = new Map<string, string | null>();
+    for (const route of routes) {
+      if (names.has(route.targetWorkspaceId)) continue;
+      names.set(
+        route.targetWorkspaceId,
+        (await getWorkspace(deps.db, route.targetWorkspaceId))?.name ?? null,
+      );
+    }
+    return c.json(
+      SlackChannelRouteListResponse.parse({
+        routingEnabled: deps.settings.slackWorkspaceRoutingEnabled,
+        routes: routes.map((route) => ({
+          slackChannelId: route.slackChannelId,
+          targetWorkspaceId: route.targetWorkspaceId,
+          targetWorkspaceName: names.get(route.targetWorkspaceId) ?? null,
+          source: route.source,
+          updatedAt: route.updatedAt.toISOString(),
+        })),
+      }),
+    );
+  });
+
+  app.put("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    // Same gate as the reaction-channel allowlist this sits beside: pointing a
+    // channel somewhere is an installation-administration act.
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = UpdateSlackChannelRoutesRequest.parse(await c.req.json());
+    const home = { accountId: grant.accountId, workspaceId };
+    const installation = await listSlackInstallationBindings(deps.db, home);
+    const binding = installation.find(
+      (candidate) => candidate.connectionId === payload.connectionId,
+    );
+    // The connection must be this workspace's own installation, and the route
+    // rows carry its team id, so a missing binding is a refusal rather than a
+    // row written with an empty team the column's own bound would reject.
+    if (!binding) {
+      throw new HTTPException(404, { message: "Slack installation not found" });
+    }
+    // Authorize EVERY target before writing anything. Applying routes one at a
+    // time means a refusal partway through would otherwise leave some channels
+    // moved and the rest not, behind an error that says the save failed.
+    //
+    // An admin may only point a channel at a workspace they could start work in
+    // themselves, and only inside this organization. The table's own CHECK
+    // enforces the second half; this refuses before writing rather than
+    // surfacing a constraint error.
+    // A channel may never be pointed at a personal workspace. The routing
+    // resolver already refuses to treat one as a candidate in a channel, and
+    // this is the same rule at the write boundary, where a durable route would
+    // otherwise smuggle it back in: every message in that channel would land
+    // somewhere nobody else in the channel can see.
+    //
+    // Only the caller's OWN personal workspace has to be excluded, and that is
+    // the whole rule rather than a partial one, because no other person's can
+    // reach this loop. `resolveSlackTargetAuthority` admits exactly two shapes:
+    // a `workspace_memberships` row this subject holds, or this subject's own
+    // personal-workspace pointer. There is no account-admin union, so an
+    // administrator does not thereby reach anyone else's personal workspace.
+    //
+    // Deliberately NOT justified by "the schema forbids a membership row on a
+    // personal workspace". It does not. Migration 0219's `42501` is a
+    // precondition inside the provisioning function, checked at provisioning
+    // time only, and `personal_workspace_has_no_membership_row` is recorded as
+    // `basis: "runtime"` - the parity report's own term for a property nothing
+    // in the schema prevents. It holds because every membership writer either
+    // requires `members:manage` on the target (which a personal-workspace grant
+    // deliberately omits) or excludes personal workspaces outright.
+    const callerPersonalWorkspaceId = await namedSubjectPersonalWorkspaceId(deps.db, {
+      accountId: grant.accountId,
+      subjectId: grant.subjectId,
+    });
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) continue;
+      const authorized = await resolveSlackTargetAuthority(deps.db, {
+        subjectId: grant.subjectId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId,
+      });
+      if (!authorized || !hasPermission(authorized.permissions, "sessions:create")) {
+        throw new HTTPException(403, {
+          message: `you cannot start work in the workspace chosen for ${route.slackChannelId}`,
+        });
+      }
+      if (
+        callerPersonalWorkspaceId !== null &&
+        route.targetWorkspaceId === callerPersonalWorkspaceId
+      ) {
+        throw new HTTPException(422, {
+          message: `a channel cannot be routed to a personal workspace: work started in ${route.slackChannelId} would be invisible to everyone else in it`,
+        });
+      }
+    }
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) {
+        await deleteSlackChannelRoute(deps.db, home, {
+          connectionId: payload.connectionId,
+          slackChannelId: route.slackChannelId,
+        });
+        continue;
+      }
+      await upsertSlackChannelRoute(deps.db, home, {
+        connectionId: payload.connectionId,
+        slackTeamId: binding.slackTeamId,
+        slackChannelId: route.slackChannelId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId,
+        decidedBySubjectId: grant.subjectId,
+        decidedBySlackUserId: "admin",
+        source: "admin",
+      });
+    }
+    return c.json({ ok: true });
+  });
+
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
@@ -783,7 +1058,285 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
   });
 }
 
+async function publishSlackAppHome(
+  deps: ApiRouteDeps,
+  installation: SlackInstallationRoute,
+  refresh: SlackAppHomeRefresh,
+  renewLease: () => Promise<void>,
+): Promise<void> {
+  const link = await getSlackBotUserLink(
+    deps.db,
+    installation.workspaceId,
+    installation.connectionId,
+    refresh.slackUserId,
+  );
+  const grant = link
+    ? await getWorkspaceGrant(deps.db, link.subjectId, installation.workspaceId, {
+        principalKind: "human_session",
+      })
+    : null;
+  if (
+    !grant ||
+    grant.accountId !== installation.accountId ||
+    !hasPermission(grant.permissions, "sessions:read")
+  ) {
+    const client = await createOpenGeniSlackBotInteractionClient(deps, {
+      accountId: installation.accountId,
+      workspaceId: installation.workspaceId,
+      connectionId: installation.connectionId,
+      subjectId: "service:slack-app-home",
+    });
+    await publishSlackAppHomeAccessView(
+      client,
+      refresh,
+      renewLease,
+      buildSlackAppHomeAccessBlocks({
+        title: link ? "OpenGeni access needed" : "Connect your OpenGeni account",
+        message: link
+          ? "Your Slack identity is linked, but it does not currently have access to this OpenGeni workspace."
+          : "Link this Slack identity to see your active tasks, requests, and recent results here.",
+        actionLabel: link ? "Request access" : "Connect OpenGeni",
+        actionUrl: slackAppHomeLinkUrl(
+          deps,
+          installation,
+          refresh.slackTeamId,
+          refresh.slackUserId,
+        ),
+      }),
+    );
+    return;
+  }
+
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    accountId: installation.accountId,
+    workspaceId: installation.workspaceId,
+    connectionId: installation.connectionId,
+    subjectId: grant.subjectId,
+  });
+  // Host session authorization is resolved at publication time, before the
+  // database query, so App Home cannot leak rows through a stale broad list.
+  const authorizationScope = await requireSessionAuthorizationListScope(deps, grant, "core");
+  const sessions: Awaited<ReturnType<typeof listSessionsForSubject>>["sessions"] = [];
+  try {
+    let cursor: ReturnType<typeof decodeSessionListCursor> | undefined;
+    do {
+      await renewLease();
+      const page = await listSessionsForSubject(deps.db, installation.workspaceId, {
+        subjectId: grant.subjectId,
+        limit: 500,
+        ...(cursor ? { cursor } : {}),
+        ...(authorizationScope ? { authorizationScope } : {}),
+      });
+      if (!cursor) sessions.push(...page.pinned);
+      sessions.push(...page.sessions);
+      if (!page.nextCursor) break;
+      cursor = decodeSessionListCursor(page.nextCursor) ?? undefined;
+      if (!cursor) throw new Error("Slack App Home session cursor was invalid");
+    } while (cursor);
+  } catch (error) {
+    if (!(error instanceof SessionListAccessError)) throw error;
+    await publishSlackAppHomeAccessView(
+      client,
+      refresh,
+      renewLease,
+      buildSlackAppHomeAccessBlocks({
+        title: "OpenGeni access changed",
+        message:
+          "Your current OpenGeni access could not be verified. Reconnect before tasks are shown here.",
+        actionLabel: "Reconnect OpenGeni",
+        actionUrl: slackAppHomeLinkUrl(
+          deps,
+          installation,
+          refresh.slackTeamId,
+          refresh.slackUserId,
+        ),
+      }),
+    );
+    return;
+  }
+  const currentLink = await getSlackBotUserLink(
+    deps.db,
+    installation.workspaceId,
+    installation.connectionId,
+    refresh.slackUserId,
+  );
+  const currentGrant = currentLink
+    ? await getWorkspaceGrant(deps.db, currentLink.subjectId, installation.workspaceId, {
+        principalKind: "human_session",
+      })
+    : null;
+  if (
+    !currentLink ||
+    currentLink.subjectId !== grant.subjectId ||
+    !currentGrant ||
+    currentGrant.accountId !== installation.accountId ||
+    !hasPermission(currentGrant.permissions, "sessions:read")
+  ) {
+    await publishSlackAppHomeAccessView(
+      client,
+      refresh,
+      renewLease,
+      buildSlackAppHomeAccessBlocks({
+        title: "OpenGeni access changed",
+        message:
+          "Your current OpenGeni access could not be verified. Reconnect before tasks are shown here.",
+        actionLabel: "Reconnect OpenGeni",
+        actionUrl: slackAppHomeLinkUrl(
+          deps,
+          installation,
+          refresh.slackTeamId,
+          refresh.slackUserId,
+        ),
+      }),
+    );
+    return;
+  }
+  const currentAuthorizationScope = await requireSessionAuthorizationListScope(
+    deps,
+    currentGrant,
+    "core",
+  );
+  if (
+    slackSessionAuthorizationScopeKey(currentAuthorizationScope) !==
+    slackSessionAuthorizationScopeKey(authorizationScope)
+  ) {
+    await publishSlackAppHomeAccessView(
+      client,
+      refresh,
+      renewLease,
+      buildSlackAppHomeAccessBlocks({
+        title: "OpenGeni access changed",
+        message:
+          "Your current task access changed while this view was loading. Reopen Home to refresh it safely.",
+        actionLabel: "Open OpenGeni",
+        actionUrl: slackWorkspaceUrl(deps, installation.workspaceId),
+      }),
+    );
+    return;
+  }
+  if (!refresh.providerViewHash) {
+    await publishSlackAppHomeAccessView(
+      client,
+      refresh,
+      renewLease,
+      buildSlackAppHomeAccessBlocks({
+        title: "Refresh OpenGeni Home",
+        message:
+          "Reopen Home to refresh your tasks safely. OpenGeni does not publish task data without Slack's current view version.",
+        actionLabel: "Open OpenGeni",
+        actionUrl: slackWorkspaceUrl(deps, installation.workspaceId),
+      }),
+    );
+    return;
+  }
+  await renewLease();
+  await client.publishHomeView({
+    userId: refresh.slackUserId,
+    hash: refresh.providerViewHash,
+    blocks: buildSlackAppHomeBlocks({
+      sessions,
+      workspaceUrl: slackWorkspaceUrl(deps, installation.workspaceId),
+      sessionUrl: (sessionId) => slackSessionUrl(deps, installation.workspaceId, sessionId),
+    }),
+  });
+}
+
+async function publishSlackAppHomeAccessView(
+  client: OpenGeniSlackBotClient,
+  refresh: SlackAppHomeRefresh,
+  renewLease: () => Promise<void>,
+  blocks: ReturnType<typeof buildSlackAppHomeAccessBlocks>,
+): Promise<void> {
+  try {
+    await renewLease();
+    await client.publishHomeView({
+      userId: refresh.slackUserId,
+      hash: refresh.providerViewHash,
+      blocks,
+    });
+  } catch (error) {
+    if (!(error instanceof SlackBotProviderError) || error.code !== "hash_conflict") throw error;
+    // Access views contain no task data. If an older authorized publication
+    // advanced Slack's optimistic-concurrency hash, replace it fail-closed
+    // rather than dropping the newer clearing obligation.
+    await renewLease();
+    await client.publishHomeView({
+      userId: refresh.slackUserId,
+      blocks,
+    });
+  }
+}
+
 export async function drainSlackInteractionsOnce(deps: ApiRouteDeps): Promise<boolean> {
+  const appHomeHolder = crypto.randomUUID();
+  const refresh = await claimSlackAppHomeRefresh(deps.db, appHomeHolder, APP_HOME_LEASE_MS);
+  if (refresh) {
+    try {
+      const installation = await resolveSlackInstallationRoute(deps.db, refresh.slackTeamId);
+      if (
+        !installation ||
+        installation.accountId !== refresh.accountId ||
+        installation.workspaceId !== refresh.workspaceId ||
+        installation.connectionId !== refresh.connectionId
+      ) {
+        throw new SlackInteractionPermanentError("slack_app_home_installation_changed");
+      }
+      const renewLease = async () => {
+        if (
+          !(await renewSlackAppHomeRefreshClaim(deps.db, {
+            refresh,
+            claimHolderId: appHomeHolder,
+            claimLeaseMs: APP_HOME_LEASE_MS,
+          }))
+        ) {
+          throw new SlackInteractionPermanentError("slack_app_home_claim_lost");
+        }
+      };
+      await renewLease();
+      await publishSlackAppHome(deps, installation, refresh, renewLease);
+      await settleSlackAppHomeRefresh(deps.db, {
+        refresh,
+        claimHolderId: appHomeHolder,
+      });
+    } catch (error) {
+      const code = safeErrorCode(error);
+      console.error("[slack-interactions] App Home refresh failed", {
+        workspaceId: refresh.workspaceId,
+        connectionId: refresh.connectionId,
+        slackUserId: refresh.slackUserId,
+        providerEventId: refresh.providerEventId,
+        desiredRevision: refresh.desiredRevision,
+        attemptCount: refresh.attemptCount,
+        errorCode: code,
+      });
+      if (error instanceof SlackBotProviderError && error.code === "hash_conflict") {
+        await settleSlackAppHomeRefresh(deps.db, {
+          refresh,
+          claimHolderId: appHomeHolder,
+          errorCode: code,
+        });
+      } else if (
+        refresh.attemptCount >= 5 ||
+        error instanceof SlackInteractionPermanentError ||
+        permanentSlackDeliveryError(error)
+      ) {
+        await settleSlackAppHomeRefresh(deps.db, {
+          refresh,
+          claimHolderId: appHomeHolder,
+          errorCode: code,
+        });
+      } else {
+        await releaseSlackAppHomeRefresh(deps.db, {
+          refresh,
+          claimHolderId: appHomeHolder,
+          errorCode: code,
+          retryAt: new Date(Date.now() + slackDeliveryRetryMs(error, refresh.attemptCount)),
+        });
+      }
+    }
+    return true;
+  }
+
   const holder = crypto.randomUUID();
   const entry = await claimSlackInteractionInbox(deps.db, holder, INBOX_LEASE_MS);
   if (entry) {
@@ -890,6 +1443,467 @@ export function startSlackInteractionPump(
   };
 }
 
+/**
+ * A concurrent creator may have won this thread in another workspace between the
+ * tenancy probe and the insert, in which case `getOrCreateSlackInteraction`
+ * adopts that row. The grant, the imported attachments, and the resolved route
+ * all belong to the workspace this pass chose, so none of them may be used
+ * against the adopted row. Retry instead: the next pass sees the thread through
+ * the probe, routes to it, and authorizes it properly.
+ */
+function requireSlackInteractionMatchesTarget(
+  interaction: Pick<SlackInteraction, "accountId" | "workspaceId">,
+  target: { accountId: string; workspaceId: string },
+): void {
+  if (
+    interaction.accountId !== target.accountId ||
+    interaction.workspaceId !== target.workspaceId
+  ) {
+    throw new SlackInteractionRetryableError("slack_route_creation_pending");
+  }
+}
+
+/**
+ * Gather the durable facts the routing decision needs, then decide.
+ *
+ * With the flag off nothing is read at all: the resolver short-circuits to the
+ * installation's own workspace, so an existing single-workspace install issues
+ * exactly the queries it issued before.
+ */
+async function resolveSlackRouteForEntry(
+  deps: ApiRouteDeps,
+  home: SlackRouteTenancy,
+  entry: SlackInteractionInboxEntry,
+  subjectId: string,
+  options: {
+    threadTenancy: SlackRouteTenancy | null;
+    askEnabled: boolean;
+    botUserId: string | null;
+  },
+): Promise<SlackRouteResolution> {
+  const base = {
+    home,
+    entry,
+    botUserId: options.botUserId,
+    threadTenancy: options.threadTenancy,
+    channelRoute: null,
+    dmRoute: null,
+    personalWorkspaceId: null,
+    candidates: [] as const,
+    routingEnabled: false,
+    askEnabled: false,
+  } as const;
+  // A mapped thread wins outright, and with the flag off nothing is consulted at
+  // all, so neither case reads anything.
+  if (!deps.settings.slackWorkspaceRoutingEnabled || options.threadTenancy) {
+    return resolveSlackWorkspaceRoute(base);
+  }
+  const directMessage = isSlackDirectMessageConversation(entry);
+  const [channelRoute, dmRoute, candidates] = await Promise.all([
+    directMessage
+      ? Promise.resolve(null)
+      : getSlackChannelRoute(deps.db, home, {
+          connectionId: entry.connectionId,
+          slackChannelId: entry.slackChannelId,
+        }),
+    directMessage
+      ? getSlackUserDmRoute(deps.db, home, {
+          connectionId: entry.connectionId,
+          slackUserId: entry.slackUserId,
+        })
+      : Promise.resolve(null),
+    listNamedSubjectSlackRoutableWorkspaces(deps.db, { accountId: home.accountId, subjectId }),
+  ]);
+  return resolveSlackWorkspaceRoute({
+    ...base,
+    channelRoute,
+    dmRoute,
+    candidates,
+    // The candidate set is built from the same derived pointer, so reading it
+    // again would be a second query for an answer already in hand.
+    personalWorkspaceId: candidates.find((candidate) => candidate.personal)?.workspaceId ?? null,
+    routingEnabled: true,
+    askEnabled: options.askEnabled,
+  });
+}
+
+/**
+ * Tell the person exactly why nothing started, in their own bot DM.
+ *
+ * Every branch ends with "No session was created." because the one thing a
+ * refusal must never do is leave someone believing work is under way.
+ *
+ * Only `no_access_to_route` mints an access-request link, and it mints one for
+ * the workspace they actually need rather than the installation's. The other
+ * two branches deliberately do not: a prefix naming something they cannot
+ * reach, and an empty candidate list, both describe a workspace OpenGeni has
+ * not established it will confirm to this person, so they point at an
+ * administrator instead.
+ */
+async function postSlackRouteRefusal(
+  deps: ApiRouteDeps,
+  client: OpenGeniSlackBotClient,
+  entry: SlackInteractionInboxEntry,
+  refusal: Extract<SlackRouteResolution, { kind: "denied" }> & Partial<SlackRouteTenancy>,
+): Promise<void> {
+  const available = refusal.candidates.map((candidate) => candidate.label);
+  const text =
+    refusal.reason === "no_access_to_named"
+      ? `OpenGeni does not see a workspace named ${JSON.stringify(refusal.requested ?? "")} that you can start work in from here.${
+          available.length > 0 ? ` You can use: ${available.join(", ")}.` : ""
+        } No session was created.`
+      : refusal.reason === "no_access_to_route"
+        ? `OpenGeni starts work from this conversation in ${
+            refusal.requested ?? "another workspace"
+          }, and you do not have access to it. Request access: ${linkUrl(
+            deps,
+            {
+              // Minted for the workspace they actually need, not the
+              // installation's. The token only decides which workspace an
+              // access request may be raised for; approval is unchanged.
+              workspaceId: refusal.workspaceId ?? entry.workspaceId,
+              connectionId: entry.connectionId,
+              slackTeamId: entry.slackTeamId,
+              slackUserId: entry.slackUserId,
+            },
+            entry.createdAt.getTime(),
+          )}. No session was created.`
+        : // Deliberately "from this conversation" rather than "for you": in a
+          // channel this also fires for someone whose only workspace is their
+          // own personal one, and telling that person they have no workspace
+          // at all would be false. Their bot DM still works.
+          "OpenGeni has no workspace it can start this task in from this conversation. Ask an OpenGeni administrator to give you access to one, or message OpenGeni directly to work in your own workspace. No session was created.";
+  await client.postMessage({
+    operationId: deterministicUuid(`slack-route-denied:${entry.id}:${refusal.reason}`),
+    userId: entry.slackUserId,
+    text: boundedOutput(text),
+  });
+}
+
+/**
+ * A workspace name as a Slack button label.
+ *
+ * Slack renders a button label as plain text and the stored option snapshot caps
+ * it at 128 bytes, so bound it once at the boundary: the button, the row and
+ * every outcome card then agree. Counted in UTF-8 bytes, because that is what
+ * the CHECK counts.
+ */
+function boundedSlackRouteLabel(label: string): string {
+  const encoder = new TextEncoder();
+  if (encoder.encode(label).length <= 72) return label;
+  let bounded = label;
+  while (bounded.length > 0 && encoder.encode(`${bounded}...`).length > 72) {
+    bounded = bounded.slice(0, -1);
+  }
+  return `${bounded}...`;
+}
+
+/**
+ * Say where the work went, quietly.
+ *
+ * The line exists to stop work landing somewhere surprising, so it appears only
+ * when the routing decision was a genuine choice: a null label means routing is
+ * off, or the person had exactly one workspace anyway, and a constant footer on
+ * every message would be noise rather than information.
+ *
+ * The label is frozen on the interaction rather than looked up here, because a
+ * workspace rename between the original post and a reconciliation would make the
+ * post ledger's byte comparison raise.
+ */
+export function withWorkspaceLine(
+  label: string | null,
+  text: string,
+  blocks?: SlackMessageBlock[],
+): { text: string; blocks?: SlackMessageBlock[] } {
+  if (!label) return blocks ? { text, blocks } : { text };
+  const suffix = `\n-> ${label}`;
+  // Reserve the suffix rather than truncating after the fact, so the bounded
+  // body plus the line still fits.
+  const body = boundedOutput(text, MAX_SLACK_TEXT_CHARS - suffix.length);
+  const line: SlackMessageBlock = {
+    type: "context",
+    elements: [{ type: "mrkdwn", text: `-> ${label}` }],
+  };
+  return {
+    text: `${body}${suffix}`,
+    ...(blocks ? { blocks: [...blocks, line] } : {}),
+  };
+}
+
+/**
+ * The post-ledger seed for one interaction's messages.
+ *
+ * The ledger binds one operation id to a digest over the rendered bytes, so
+ * adding the workspace line under an unchanged id would wedge every interaction
+ * with a claimed-but-unposted row. But bumping the id for interactions whose
+ * bytes did NOT change is not free either: their ledger rows become unreachable,
+ * so a repair or a cross-deploy retry posts a duplicate instead of finding the
+ * completed original, and an action handle still points at the old operation.
+ *
+ * Only a labelled interaction renders different bytes, and the label is written
+ * once at insert and never updated, so it is a stable discriminator. Version the
+ * id on the label rather than on the release: a labelled interaction can only
+ * have been created by an image that already renders the line, and every
+ * pre-existing and unlabelled interaction keeps its exact ledger identity.
+ */
+export function slackPostSeed(
+  interaction: Pick<SlackInteraction, "routedWorkspaceLabel">,
+  seed: string,
+): string {
+  return interaction.routedWorkspaceLabel ? `${seed}:v2` : seed;
+}
+
+/** Sources that mean somebody, or something, actually chose this workspace. */
+const SLACK_ROUTE_SOURCES_WORTH_NAMING: ReadonlySet<string> = new Set([
+  // Not "thread": a mapped thread reuses the interaction that already exists,
+  // so it inherits the label frozen when that interaction was created and never
+  // reaches the writer below.
+  "prefix",
+  "channel",
+  "dm_route",
+  "dm_personal",
+]);
+
+/**
+ * The label to freeze on a new interaction, or null to say nothing.
+ *
+ * `installation` and `sole_candidate` both mean there was only ever one place
+ * this could go, so naming it on every message would be noise.
+ *
+ * Bounded with the picker's own button cap so the frozen label and the button
+ * that produced it agree; the column allows 128 bytes, which is headroom.
+ */
+async function routedWorkspaceLabelFor(
+  deps: ApiRouteDeps,
+  resolution: Extract<SlackRouteResolution, { kind: "resolved" }>,
+): Promise<string | null> {
+  if (!SLACK_ROUTE_SOURCES_WORTH_NAMING.has(resolution.source)) return null;
+  const label = resolution.label ?? (await getWorkspace(deps.db, resolution.workspaceId))?.name;
+  if (!label) return null;
+  const bounded = boundedSlackRouteLabel(label);
+  return bounded.length > 0 ? bounded : null;
+}
+
+/** How long a first-use picker stays answerable. */
+const SLACK_ROUTE_PROMPT_TTL_MS = 24 * 60 * 60 * 1000;
+
+/** Buttons a card can carry before it stops being readable. */
+const MAX_SLACK_ROUTE_PROMPT_BUTTONS = 5;
+
+/**
+ * Ask, once, where this conversation should work.
+ *
+ * The card is a bot DM rather than an ephemeral message: `chat.postEphemeral`
+ * returns no durable `(channel, ts)` and no `client_msg_id` echo, and the whole
+ * post ledger and its reconciliation are built on both.
+ *
+ * Nothing is created in any workspace here. The request is parked on the prompt
+ * row and re-queued only once the person answers, so a picker that is never
+ * answered leaves no session, no interaction and no half-started work.
+ */
+async function askSlackRouteChoice(
+  deps: ApiRouteDeps,
+  client: OpenGeniSlackBotClient,
+  home: SlackRouteTenancy,
+  entry: SlackInteractionInboxEntry,
+  candidates: readonly SlackRoutableWorkspace[],
+): Promise<void> {
+  const offered = candidates.slice(0, MAX_SLACK_ROUTE_PROMPT_BUTTONS);
+  // Slack renders a button label as plain text and the stored snapshot caps it
+  // at 128 bytes, so bound it once here: the button, the stored row and every
+  // outcome card then agree, and the full name still shows in OpenGeni.
+  const bounded = offered.map((candidate) => ({
+    ...candidate,
+    label: boundedSlackRouteLabel(candidate.label),
+  }));
+  const opened = await openSlackRoutePrompt(deps.db, home, {
+    connectionId: entry.connectionId,
+    inboxId: entry.id,
+    slackTeamId: entry.slackTeamId,
+    slackUserId: entry.slackUserId,
+    slackChannelId: entry.slackChannelId,
+    slackMessageTs: entry.slackMessageTs,
+    providerEventId: entry.providerEventId,
+    triggerKind: entry.triggerKind,
+    requestText: entry.text,
+    hasFiles: entry.hasFiles,
+    slackThreadTs: entry.slackThreadTs,
+    messageOperationId: deterministicUuid(`slack-route-prompt:${entry.id}`),
+    expiresAt: new Date(Date.now() + SLACK_ROUTE_PROMPT_TTL_MS),
+    candidates: bounded,
+  });
+  if (!opened) return;
+  // The prompt commits before the card is posted, so a transient Slack failure
+  // would otherwise leave a pending row with no card in front of anybody and
+  // silently deaden the conversation. Post unconditionally instead: the
+  // operation id is persisted on the prompt and the card is rendered from the
+  // prompt's own stored options, so a replay reproduces identical bytes and the
+  // post ledger returns the completed original rather than posting twice.
+  const where = opened.prompt.slackChannelId.startsWith("D")
+    ? "your messages with OpenGeni"
+    : `<#${opened.prompt.slackChannelId}>`;
+  const blocks: SlackMessageBlock[] = [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `OpenGeni can start this task in more than one workspace. Pick where ${where} should work. This choice is remembered.`,
+      },
+    },
+    {
+      type: "actions",
+      block_id: "opengeni-route-choice",
+      elements: [
+        ...opened.prompt.options.map((option) => ({
+          type: "button" as const,
+          action_id: "opengeni.route.select",
+          value: option.id,
+          text: { type: "plain_text" as const, text: option.candidateLabel },
+        })),
+        {
+          type: "button" as const,
+          action_id: "opengeni.route.cancel",
+          value: opened.prompt.options[0]?.id ?? opened.prompt.id,
+          text: { type: "plain_text" as const, text: "Not now" },
+        },
+      ],
+    },
+  ];
+  // Deliberately unconditional rather than derived from the live candidate
+  // count: a replay must render identical bytes, and membership can change
+  // between attempts.
+  const url = slackWorkspaceUrl(deps, home.workspaceId);
+  blocks.push({
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: url
+        ? `You can change this later in <${url}|OpenGeni>, under Capabilities, then Slack.`
+        : "You can change this later in OpenGeni, under Capabilities, then Slack.",
+    },
+  });
+  await client.postMessage({
+    operationId: opened.prompt.messageOperationId,
+    userId: opened.prompt.slackUserId,
+    text: boundedOutput(
+      `OpenGeni can start this task in more than one workspace. Pick where ${where} should work.`,
+    ),
+    blocks,
+  });
+}
+
+/**
+ * Process one click on a picker.
+ *
+ * The stored option row is a prompt-time snapshot and is NEVER authority: the
+ * chosen workspace is re-authorized live, because access can have been revoked
+ * between the question and the answer.
+ */
+async function handleSlackRouteChoice(
+  deps: ApiRouteDeps,
+  home: SlackRouteTenancy,
+  entry: SlackInteractionInboxEntry,
+  actionId: string,
+  optionId: string,
+): Promise<void> {
+  if (!deps.settings.slackWorkspaceRoutingEnabled) {
+    // A card can outlive the flag being turned back off. Honouring the click
+    // would write a route row and start work through a path the operator has
+    // disabled.
+    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
+  }
+  const found = await getSlackRoutePromptByOption(deps.db, home, optionId);
+  if (!found) throw new SlackInteractionPermanentError("slack_route_prompt_invalid");
+  const { prompt, chosen } = found;
+  // The same authorization pinning ordinary action handles use: a different
+  // Slack human clicking someone else's card is ignored, not obeyed.
+  if (prompt.slackUserId !== entry.slackUserId) {
+    throw new SlackInteractionPermanentError("slack_route_prompt_user_mismatch");
+  }
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    ...home,
+    connectionId: entry.connectionId,
+    subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
+  });
+  // The post ledger binds one operation id to a digest over the text, so the
+  // outcome has to be part of the seed. A second click on a settled card
+  // renders different bytes than the first, and reusing one id would wedge the
+  // ledger rather than saying so.
+  const replaceCard = async (outcome: string, text: string) => {
+    await client.updateMessage({
+      operationId: deterministicUuid(
+        `slack-route-answered:${prompt.id}:${actionId}:${chosen.id}:${outcome}`,
+      ),
+      channelId: entry.slackChannelId,
+      timestamp: entry.slackMessageTs,
+      text,
+      // Every button goes with the card, so a sibling option cannot be pressed
+      // after the question is settled.
+      blocks: [{ type: "section", text: { type: "mrkdwn", text } }],
+    });
+  };
+
+  if (actionId === "opengeni.route.cancel") {
+    const cancelled = await settleSlackRoutePrompt(deps.db, home, {
+      promptId: prompt.id,
+      status: "cancelled",
+    });
+    await replaceCard(
+      cancelled ? "cancelled" : "already_settled",
+      cancelled
+        ? "OpenGeni did not start this task. No session was created."
+        : "OpenGeni already settled this choice.",
+    );
+    return;
+  }
+
+  const link = await getSlackBotUserLink(
+    deps.db,
+    home.workspaceId,
+    entry.connectionId,
+    entry.slackUserId,
+  );
+  const grant = link
+    ? await resolveSlackTargetAuthority(deps.db, {
+        subjectId: link.subjectId,
+        targetAccountId: chosen.candidateAccountId,
+        targetWorkspaceId: chosen.candidateWorkspaceId,
+      })
+    : null;
+  if (!grant || !hasPermission(grant.permissions, "sessions:create")) {
+    // Fail closed WITHOUT touching the card: the person may still have another
+    // workspace on it that they can use, and replacing the card would take the
+    // remaining buttons away and leave a pending prompt nobody can answer.
+    await client.postMessage({
+      operationId: deterministicUuid(`slack-route-denied:${prompt.id}:${chosen.id}`),
+      userId: entry.slackUserId,
+      text: boundedOutput(
+        `OpenGeni cannot start work in ${chosen.candidateLabel}: you do not have access to it. No session was created. Pick another workspace on the card, or ask an OpenGeni administrator for access.`,
+      ),
+    });
+    return;
+  }
+
+  const answered = await answerSlackRoutePrompt(deps.db, home, {
+    promptId: prompt.id,
+    targetAccountId: chosen.candidateAccountId,
+    targetWorkspaceId: chosen.candidateWorkspaceId,
+    answeredBySubjectId: grant.subjectId,
+    decidedBySlackUserId: entry.slackUserId,
+  });
+  if (!answered.answered) {
+    await replaceCard(
+      "settled",
+      "OpenGeni already settled this choice. No new session was created.",
+    );
+    return;
+  }
+  await replaceCard(
+    "answered",
+    `OpenGeni will use *${chosen.candidateLabel}* here. You can change this in OpenGeni under Capabilities, then Slack.`,
+  );
+}
+
 async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractionInboxEntry) {
   if (entry.triggerKind === "block_action") {
     await processSlackBlockAction(deps, entry);
@@ -899,6 +1913,11 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     await processSlackReactionInboxEntry(deps, entry);
     return;
   }
+  // HOME is the installation binding's tenancy: it owns the bot credential and
+  // connection, this inbox row, the identity links, and the post ledgers. TARGET
+  // is the tenancy the resulting session lives in. They are equal today; the
+  // routing resolver is what makes them diverge.
+  const home = { accountId: entry.accountId, workspaceId: entry.workspaceId } as const;
   const installation = await resolveSlackInstallationRoute(deps.db, entry.slackTeamId);
   if (
     !installation ||
@@ -909,8 +1928,7 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     throw new SlackInteractionPermanentError("slack_task_installation_changed");
   }
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...home,
     connectionId: entry.connectionId,
     subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
   });
@@ -937,17 +1955,21 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     privateHandoff: policyDecision.disposition === "private_handoff",
   });
   const routeKey = routePolicy.initialRouteKey;
-  const existing = await getSlackInteractionByRoute(
-    deps.db,
-    entry.workspaceId,
-    entry.connectionId,
+  // A mapped thread keeps the workspace it was created in, so the continuation
+  // lookup is connection-scoped rather than workspace-fenced.
+  const existing = await getSlackInteractionByConnectionRoute(deps.db, {
+    accountId: home.accountId,
+    connectionId: entry.connectionId,
     routeKey,
-  );
+  });
   if (entry.triggerKind === "thread_reply" && !existing) return;
-
+  // The identity link is a HOME fact: `slack_bot_user_links` is unique on
+  // `(connection_id, slack_user_id)` and RLS-visible only under the
+  // installation's own tenancy. It is read before the target is chosen because
+  // the routing decision needs the subject it names.
   const link = await getSlackBotUserLink(
     deps.db,
-    entry.workspaceId,
+    home.workspaceId,
     entry.connectionId,
     entry.slackUserId,
   );
@@ -955,20 +1977,59 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     await client.postMessage({
       operationId: deterministicUuid(`slack-link:${entry.id}`),
       userId: entry.slackUserId,
-      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry)}. No session was created.`,
+      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry, entry.createdAt.getTime())}. No session was created.`,
     });
     return;
   }
-  const grant = await getWorkspaceGrant(deps.db, link.subjectId, entry.workspaceId, {
-    principalKind: "human_session",
+  const resolution = await resolveSlackRouteForEntry(deps, home, entry, link.subjectId, {
+    botUserId: installation.botUserId,
+    threadTenancy: existing
+      ? { accountId: existing.accountId, workspaceId: existing.workspaceId }
+      : null,
+    askEnabled: true,
+  });
+  if (resolution.kind === "ask") {
+    await askSlackRouteChoice(deps, client, home, entry, resolution.candidates);
+    return;
+  }
+  if (resolution.kind === "denied") {
+    await postSlackRouteRefusal(deps, client, entry, resolution);
+    return;
+  }
+  const target: { accountId: string; workspaceId: string } = {
+    accountId: resolution.accountId,
+    workspaceId: resolution.workspaceId,
+  };
+  const grant = await resolveSlackTargetAuthority(deps.db, {
+    subjectId: link.subjectId,
+    targetAccountId: target.accountId,
+    targetWorkspaceId: target.workspaceId,
   });
-  if (!grant || grant.accountId !== entry.accountId) {
-    throw new SlackInteractionPermanentError("identity_access_revoked");
+  if (!grant) {
+    // Never quietly serve this from a workspace the person did not name. A
+    // routed workspace the subject cannot reach is a refusal with the existing
+    // access-request path, minted for the workspace they actually need.
+    if (resolution.source === "installation" || resolution.source === "thread") {
+      throw new SlackInteractionPermanentError("identity_access_revoked");
+    }
+    await postSlackRouteRefusal(deps, client, entry, {
+      kind: "denied",
+      reason: "no_access_to_route",
+      requested: resolution.label,
+      candidates: [],
+      ...target,
+    });
+    return;
   }
+  // An override addresses the message; it is not part of the request.
+  const routedEntry: SlackInteractionInboxEntry = {
+    ...entry,
+    text: slackRoutedRequestText(entry.text, resolution, installation.botUserId),
+  };
 
   const alreadyDurable = await getSlackInteractionByClientEventId(
     deps.db,
-    entry.workspaceId,
+    target.workspaceId,
     entry.connectionId,
     `slack:${entry.providerEventId}`,
   );
@@ -991,14 +2052,13 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     if (!boundInteraction) {
       throw new Error("Durable Slack interaction could not bind its reserved session");
     }
-    await ensureSlackSharedTaskOrigin(deps, boundInteraction, entry, policyResolution);
+    await ensureSlackSharedTaskOrigin(deps, boundInteraction, entry, home, policyResolution);
     const shouldRepairAcknowledgement =
       interaction.triggeringProviderEventId === entry.providerEventId ||
       (usesPrivateBotDm(boundInteraction, entry) && boundInteraction.ackSlackMessageTs === null);
     if (shouldRepairAcknowledgement) {
       const boundClient = await createOpenGeniSlackBotInteractionClient(deps, {
-        accountId: entry.accountId,
-        workspaceId: entry.workspaceId,
+        ...home,
         connectionId: entry.connectionId,
         subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
         sessionId: eventSessionId,
@@ -1008,7 +2068,8 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     return;
   }
 
-  let preparedEntry = entry;
+  let preparedEntry = routedEntry;
+  let preparedModelContext: string | null = null;
   let preparedAttachments: PreparedSlackReactionTask = {
     resources: [],
     attachments: [],
@@ -1019,7 +2080,8 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     const prepared = await prepareSlackInvocationEntry(
       deps,
       client,
-      entry,
+      routedEntry,
+      target,
       policyDecision.disposition === "private_handoff"
         ? async () => {
             await requireSlackSharedReadAuthorization(deps, client, entry, policyResolution);
@@ -1027,31 +2089,33 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
         : undefined,
     );
     preparedEntry = prepared.entry;
+    preparedModelContext = prepared.modelContext;
     preparedAttachments = prepared.attachments;
   }
 
   if (existing?.sessionId) {
     const remounted = await remountSlackReactionTaskForSession(
       deps,
-      entry.workspaceId,
+      target.workspaceId,
       existing.sessionId,
       preparedAttachments,
     );
-    await continueSlackSession(
-      deps,
-      grant,
-      existing,
-      slackInvocationPreparedEntry(preparedEntry, remounted),
-      remounted.resources,
-    );
+    const prepared = slackInvocationPreparedMessage(preparedEntry, remounted, preparedModelContext);
+    await continueSlackSession(deps, grant, existing, prepared.entry, remounted.resources, {
+      modelContext: prepared.modelContext,
+    });
     return;
   }
   if (!hasPermission(grant.permissions, "sessions:create")) {
     throw new SlackInteractionPermanentError("sessions_create_denied");
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...target,
+    // Frozen here, after authorization, so a workspace name is never shown to
+    // someone who could not reach it. Null when the routing decision was not a
+    // genuine choice, which is what keeps the line off every message in an
+    // install that only ever had one workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, resolution),
     connectionId: entry.connectionId,
     slackTeamId: entry.slackTeamId,
     slackChannelId: entry.slackChannelId,
@@ -1062,32 +2126,36 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     owningSubjectId: grant.subjectId,
     visibility: routePolicy.visibility,
   });
+  requireSlackInteractionMatchesTarget(interaction, target);
   if (interaction.sessionId) {
     const remounted = await remountSlackReactionTaskForSession(
       deps,
-      entry.workspaceId,
+      interaction.workspaceId,
       interaction.sessionId,
       preparedAttachments,
     );
-    await continueSlackSession(
-      deps,
-      grant,
-      interaction,
-      slackInvocationPreparedEntry(preparedEntry, remounted),
-      remounted.resources,
-    );
+    const prepared = slackInvocationPreparedMessage(preparedEntry, remounted, preparedModelContext);
+    await continueSlackSession(deps, grant, interaction, prepared.entry, remounted.resources, {
+      modelContext: prepared.modelContext,
+    });
     return;
   }
   const preferredModel = await getLatestSessionModelForSubject(
     deps.db,
-    entry.workspaceId,
+    interaction.workspaceId,
     grant.subjectId,
   );
   let session: Awaited<ReturnType<typeof createSessionForRequest>>;
   try {
-    session = await createSessionForRequest(deps, grant, entry.workspaceId, {
+    const prepared = slackInvocationPreparedMessage(
+      preparedEntry,
+      preparedAttachments,
+      preparedModelContext,
+    );
+    session = await createSessionForRequest(deps, grant, interaction.workspaceId, {
       requestedSessionId: interaction.sessionReservationId,
-      initialMessage: slackInvocationPreparedEntry(preparedEntry, preparedAttachments).text,
+      initialMessage: prepared.entry.text,
+      ...(prepared.modelContext ? { modelContext: prepared.modelContext } : {}),
       instructions: SLACK_SESSION_INSTRUCTIONS,
       firstPartyMcpTools: slackTaskFirstPartyMcpTools(deps.settings),
       resources: preparedAttachments.resources,
@@ -1118,10 +2186,9 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     sessionId: session.id,
   });
   if (!bound) throw new Error("Slack route could not bind its durable session");
-  await ensureSlackSharedTaskOrigin(deps, bound, entry, policyResolution);
+  await ensureSlackSharedTaskOrigin(deps, bound, entry, home, policyResolution);
   const boundClient = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...home,
     connectionId: entry.connectionId,
     subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
     sessionId: session.id,
@@ -1164,6 +2231,7 @@ async function ensureSlackSharedTaskOrigin(
   deps: ApiRouteDeps,
   interaction: SlackInteraction,
   entry: SlackInteractionInboxEntry,
+  home: { accountId: string; workspaceId: string },
   resolution:
     | Awaited<ReturnType<typeof slackTaskPolicyDecision>>
     | {
@@ -1189,6 +2257,11 @@ async function ensureSlackSharedTaskOrigin(
     sourceChannelId: entry.slackChannelId,
     sourceThreadTs: entry.slackThreadTs ?? entry.slackMessageTs,
     initiatingSlackUserId: interaction.initiatingSlackUserId,
+    // The task policy governs what may be read out of the Slack conversation,
+    // which is an installation-surface concern, so its frozen revision keeps
+    // home tenancy while the row itself follows the routed task.
+    policyAccountId: home.accountId,
+    policyWorkspaceId: home.workspaceId,
     policyRevisionId: resolution.activePolicy.revision.id,
     policyHash: resolution.activePolicy.revision.policyHash,
     policyActivationVersion: resolution.activePolicy.head.activationVersion,
@@ -1225,8 +2298,15 @@ async function prepareSlackInvocationEntry(
   deps: ApiRouteDeps,
   client: OpenGeniSlackBotClient,
   entry: SlackInteractionInboxEntry,
+  // Imported attachments become File resources of the session's workspace, so
+  // they follow TARGET tenancy rather than the installation's.
+  target: { accountId: string; workspaceId: string },
   authorizeRead?: () => Promise<void>,
-): Promise<{ entry: SlackInteractionInboxEntry; attachments: PreparedSlackReactionTask }> {
+): Promise<{
+  entry: SlackInteractionInboxEntry;
+  attachments: PreparedSlackReactionTask;
+  modelContext: string | null;
+}> {
   const context = entry.slackThreadTs
     ? await client.threadReplies({
         channelId: entry.slackChannelId,
@@ -1255,53 +2335,58 @@ async function prepareSlackInvocationEntry(
     exactMessage = exact.messages.find((message) => message.timestamp === entry.slackMessageTs);
   }
   const attachments = exactMessage
-    ? await prepareSlackMessageAttachments(deps, client, entry, exactMessage.files)
+    ? await prepareSlackMessageAttachments(
+        deps,
+        client,
+        entry,
+        target,
+        exactMessage.files,
+        authorizeRead,
+      )
     : {
         resources: [],
         attachments: [],
         omissionCodes: entry.hasFiles ? ["attachment_unavailable"] : [],
         omittedCount: entry.hasFiles ? 1 : 0,
       };
-  const baseText =
+  const modelContext =
     entry.triggerKind === "app_mention"
-      ? slackInvocationTaskText(entry, {
+      ? slackInvocationModelContext(entry.slackMessageTs, {
           messages: context.messages,
           nextCursor: context.nextCursor,
           kind: entry.slackThreadTs ? "thread" : "channel",
         })
-      : entry.text;
+      : null;
   return {
-    entry: { ...entry, text: baseText },
+    entry,
     attachments,
+    modelContext,
   };
 }
 
-function slackInvocationPreparedEntry(
+function slackInvocationPreparedMessage(
   entry: SlackInteractionInboxEntry,
   attachments: PreparedSlackReactionTask,
-): SlackInteractionInboxEntry {
+  modelContext: string | null,
+): { entry: SlackInteractionInboxEntry; modelContext: string | null } {
   const manifest = slackAttachmentManifest(
     attachments,
     "Imported invocation attachments",
     "invocation",
   );
-  return manifest ? { ...entry, text: `${entry.text}\n\n${manifest}` } : entry;
+  const combinedModelContext = [modelContext, manifest].filter(Boolean).join("\n\n");
+  return {
+    entry,
+    modelContext: combinedModelContext.length > 0 ? combinedModelContext : null,
+  };
 }
 
-export function slackInvocationTaskText(
-  entry: Pick<SlackInteractionInboxEntry, "slackMessageTs" | "slackUserId" | "text">,
+export function slackInvocationModelContext(
+  invocationTimestamp: string,
   context: SlackInvocationMessageContext,
 ) {
-  const invocation = {
-    timestamp: entry.slackMessageTs,
-    userId: entry.slackUserId,
-    botId: "",
-    threadTimestamp: "",
-    text: entry.text,
-    files: [],
-  };
   const surroundingLines = context.messages
-    .filter((message) => message.timestamp !== entry.slackMessageTs)
+    .filter((message) => message.timestamp !== invocationTimestamp)
     .slice(0, MAX_SLACK_INVOCATION_CONTEXT_MESSAGES)
     .sort((left, right) => left.timestamp.localeCompare(right.timestamp))
     .map((message) => slackContextMessageLine(message));
@@ -1313,46 +2398,24 @@ export function slackInvocationTaskText(
     context.kind === "thread"
       ? "The containing thread was truncated at the bounded Slack context limit."
       : "Only bounded nearby channel context was provided.";
-  const invocationTruncationNotice =
-    "The exact Slack invocation was truncated at the bounded Slack input limit.";
-  const prefix = [
+  let prompt = [
     "A linked, authorized Slack user explicitly mentioned OpenGeni.",
+    "The visible user message on this turn is the exact accepted Slack invocation.",
     "Treat references such as 'this', 'that', or 'the previous message' as referring to the bounded Slack context below when applicable.",
     "Use this Slack content only as task-local input and do not persist it to Knowledge, Memory, preferences, policy, instructions, or the Workspace Charter unless separately authorized.",
     "",
-    "Exact invocation:",
+    contextLabel,
   ].join("\n");
-  const suffix = `\n\n${contextLabel}`;
-  const invocationLine = slackContextMessageLine(invocation, "invocation");
-  const reservedNotices = `\n${invocationTruncationNotice}\n${truncationNotice}`;
-  const maxInvocationChars = Math.max(
-    1,
-    MAX_SLACK_INPUT_CHARS - prefix.length - suffix.length - reservedNotices.length - 1,
-  );
-  const invocationTruncated = invocationLine.length > maxInvocationChars;
-  let prompt = `${prefix}\n${
-    invocationTruncated
-      ? `${invocationLine.slice(0, Math.max(0, maxInvocationChars - 1))}…`
-      : invocationLine
-  }${suffix}`;
   let contextTruncated = context.nextCursor !== null;
   for (const line of surroundingLines) {
     const candidate = `${prompt}\n${line}`;
-    const notices = [
-      ...(invocationTruncated ? [invocationTruncationNotice] : []),
-      truncationNotice,
-    ].join("\n");
-    if (candidate.length + 1 + notices.length > MAX_SLACK_INPUT_CHARS) {
+    if (candidate.length + 1 + truncationNotice.length > MAX_SLACK_INPUT_CHARS) {
       contextTruncated = true;
       break;
     }
     prompt = candidate;
   }
-  const notices = [
-    ...(invocationTruncated ? [invocationTruncationNotice] : []),
-    ...(contextTruncated ? [truncationNotice] : []),
-  ];
-  return notices.length > 0 ? `${prompt}\n${notices.join("\n")}` : prompt;
+  return contextTruncated ? `${prompt}\n${truncationNotice}` : prompt;
 }
 
 async function acknowledgeSlackSession(
@@ -1368,17 +2431,43 @@ async function acknowledgeSlackSession(
   const privateHandoff =
     !directMessageShortcut && interaction.visibility === "private" && entry.triggerKind !== "dm";
   const privateBotDm = directMessageShortcut || privateHandoff;
-  const operationId = deterministicUuid(`slack-ack:${interaction.id}`);
-  const text = directMessageShortcut
-    ? `OpenGeni started a private task from the selected DM message. ${openSessionText(deps, entry.workspaceId, interaction.sessionId)} Reply in this bot-DM thread to continue, or reply \`stop\` to stop. The source DM was not opened to the bot or made workspace-visible.`
+  const operationId = deterministicUuid(slackPostSeed(interaction, `slack-ack:${interaction.id}`));
+  // The acknowledgement carries exactly one session link plus the Status/Stop
+  // buttons. The how-to prose it used to repeat forever now rides along once,
+  // on this Slack identity's first accepted task in this installation.
+  const started = directMessageShortcut
+    ? `OpenGeni started a private task from the selected DM message. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} The source DM was not opened to the bot or made workspace-visible.`
     : privateHandoff
-      ? `OpenGeni started a private task from the selected Slack conversation. ${openSessionText(deps, entry.workspaceId, interaction.sessionId)} Reply in this bot-DM thread to continue, or reply \`stop\` to stop. Results stay private unless a separate authorized publication is approved.`
-      : `OpenGeni started this task. ${openSessionText(deps, entry.workspaceId, interaction.sessionId)} Reply in this thread to continue, or reply \`stop\` to stop. Start a new top-level DM or invoke /opengeni again for a new session.`;
+      ? `OpenGeni started a private task from the selected Slack conversation. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} Results stay private unless a separate authorized publication is approved.`
+      : `OpenGeni started this task. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)}`;
+  // The post ledger binds this fixed operation id to a digest over the message
+  // text, and this function re-runs on every acknowledgement repair. Resolving
+  // the hint freezes it durably before the post, so a repair renders identical
+  // bytes; a failure here raises into the retryable inbox path rather than
+  // binding the ledger to a hint-less acknowledgement it can never revise.
+  const showHint = await resolveSlackInteractionFirstTaskHint(deps.db, {
+    // The identity link is HOME; the interaction row is TARGET.
+    workspaceId: entry.workspaceId,
+    interactionWorkspaceId: interaction.workspaceId,
+    connectionId: entry.connectionId,
+    slackUserId: entry.slackUserId,
+    interactionId: interaction.id,
+  });
+  const text = `${started}${showHint ? slackFirstTaskHintText(deps) : ""}`;
   const controls = await controlActionBlocks(deps, interaction, {
     messageOperationId: operationId,
     sessionEventSequence: 0,
     state: "active",
   });
+  // The approval and control cards let `text` and `blocks[0]` diverge, so the
+  // line is appended to each independently rather than assuming they match.
+  const acknowledgement = withWorkspaceLine(
+    interaction.routedWorkspaceLabel,
+    text,
+    controls.length > 0
+      ? ([{ type: "section", text: { type: "mrkdwn", text } }, ...controls] as SlackMessageBlock[])
+      : undefined,
+  );
   const ack = await client.postMessage({
     operationId,
     ...(privateBotDm
@@ -1389,15 +2478,8 @@ async function acknowledgeSlackSession(
             ? {}
             : { threadTimestamp: entry.slackThreadTs ?? entry.slackMessageTs }),
         }),
-    text,
-    ...(controls.length > 0
-      ? {
-          blocks: [
-            { type: "section", text: { type: "mrkdwn", text } },
-            ...controls,
-          ] as SlackMessageBlock[],
-        }
-      : {}),
+    text: acknowledgement.text,
+    ...(acknowledgement.blocks ? { blocks: acknowledgement.blocks } : {}),
   });
   if (entry.triggerKind === "slash_command" || privateBotDm) {
     const rekeyed = await rekeySlackInteractionRoute(deps.db, {
@@ -1412,14 +2494,38 @@ async function acknowledgeSlackSession(
   }
 }
 
+/**
+ * The one-time onboarding sentence shown on a Slack identity's first
+ * acknowledged task in one installation.
+ *
+ * Rendering is a pure function of the configured command plus the frozen
+ * `firstTaskHint` fact, so every re-render of the same acknowledgement produces
+ * the same bytes for the digest-bound post ledger.
+ *
+ * Note the one remaining input that is not frozen: the text embeds
+ * `settings.slackCommand`. Changing that setting between an acknowledgement
+ * post and a later repair of the same interaction would diverge the digest and
+ * conflict its post operation. The command is deployment configuration that
+ * must already match the registered Slack slash command, so it does not change
+ * under a live installation; a deployment that does rename it should drain
+ * in-flight Slack interactions first.
+ */
+function slackFirstTaskHintText(deps: ApiRouteDeps): string {
+  const command = deps.settings.slackCommand;
+  return `\n\nFirst time here: reply in this thread to continue this task, or reply \`stop\` to stop it. Start a new top-level DM or run \`${command}\` again for a new task. Run \`${command} info\` any time for the full summary.`;
+}
+
 async function processSlackReactionInboxEntry(
   deps: ApiRouteDeps,
   entry: SlackInteractionInboxEntry,
 ) {
+  // Reaction summon is configured on the installation surface, so the settings,
+  // the connection scopes, and the identity link are all HOME reads.
+  const home = { accountId: entry.accountId, workspaceId: entry.workspaceId } as const;
   const [workspace, connection, link] = await Promise.all([
-    getWorkspace(deps.db, entry.workspaceId),
-    getConnectionMetadata(deps.db, entry.workspaceId, entry.connectionId, null),
-    getSlackBotUserLink(deps.db, entry.workspaceId, entry.connectionId, entry.slackUserId),
+    getWorkspace(deps.db, home.workspaceId),
+    getConnectionMetadata(deps.db, home.workspaceId, entry.connectionId, null),
+    getSlackBotUserLink(deps.db, home.workspaceId, entry.connectionId, entry.slackUserId),
   ]);
   const settings = resolveWorkspaceSlackReactionSummonSettings(workspace?.settings);
   if (
@@ -1433,23 +2539,55 @@ async function processSlackReactionInboxEntry(
   ) {
     return;
   }
-  const grant = await getWorkspaceGrant(deps.db, link.subjectId, entry.workspaceId, {
-    principalKind: "human_session",
+  // A reaction is never a direct message, so the routing decision here is the
+  // channel's remembered answer, the sole candidate, or the installation's own
+  // workspace. It runs before the provider context read so an unauthorized
+  // subject never causes OpenGeni to read the Slack conversation.
+  const routeResolution = await resolveSlackRouteForEntry(deps, home, entry, link.subjectId, {
+    // A reaction carries no message text of the reacting person, so no prefix.
+    botUserId: null,
+    threadTenancy: null,
+    askEnabled: false,
   });
-  if (!grant || grant.accountId !== entry.accountId) {
-    throw new SlackInteractionPermanentError("identity_access_revoked");
+  if (routeResolution.kind === "ask") {
+    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
   }
-  if (
-    !hasPermission(grant.permissions, "sessions:create") ||
-    !hasPermission(grant.permissions, "sessions:control")
-  ) {
-    throw new SlackInteractionPermanentError("reaction_session_permissions_denied");
+  if (routeResolution.kind === "denied") {
+    const summonClient = await createOpenGeniSlackBotInteractionClient(deps, {
+      ...home,
+      connectionId: entry.connectionId,
+      subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
+    });
+    await postSlackRouteRefusal(deps, summonClient, entry, routeResolution);
+    return;
   }
+  let target: { accountId: string; workspaceId: string } = {
+    accountId: routeResolution.accountId,
+    workspaceId: routeResolution.workspaceId,
+  };
+  const authorizeTarget = async () => {
+    const resolved = await resolveSlackTargetAuthority(deps.db, {
+      subjectId: link.subjectId,
+      targetAccountId: target.accountId,
+      targetWorkspaceId: target.workspaceId,
+    });
+    if (!resolved) {
+      throw new SlackInteractionPermanentError("identity_access_revoked");
+    }
+    if (
+      !hasPermission(resolved.permissions, "sessions:create") ||
+      !hasPermission(resolved.permissions, "sessions:control")
+    ) {
+      throw new SlackInteractionPermanentError("reaction_session_permissions_denied");
+    }
+    return resolved;
+  };
+  let grant = await authorizeTarget();
 
   const clientEventId = `slack:${entry.providerEventId}`;
   const durableInteraction = await getSlackInteractionByClientEventId(
     deps.db,
-    entry.workspaceId,
+    target.workspaceId,
     entry.connectionId,
     clientEventId,
   );
@@ -1481,8 +2619,7 @@ async function processSlackReactionInboxEntry(
     await reopenSlackInteractionDelivery(deps.db, boundInteraction);
     if (shouldRepairAcknowledgement) {
       const client = await createOpenGeniSlackBotInteractionClient(deps, {
-        accountId: entry.accountId,
-        workspaceId: entry.workspaceId,
+        ...home,
         connectionId: entry.connectionId,
         subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
         sessionId: eventSessionId,
@@ -1493,8 +2630,7 @@ async function processSlackReactionInboxEntry(
   }
 
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...home,
     connectionId: entry.connectionId,
     subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
   });
@@ -1525,18 +2661,25 @@ async function processSlackReactionInboxEntry(
       if (!saved) throw new Error("Slack reaction inbox checkpoint claim was lost");
     },
   });
-  const preparedTask = await prepareSlackReactionTask(deps, client, entry, context);
   const routeKey = slackRouteKey(entry.slackChannelId, context.threadTimestamp);
-  const existing = await getSlackInteractionByRoute(
-    deps.db,
-    entry.workspaceId,
-    entry.connectionId,
+  const existing = await getSlackInteractionByConnectionRoute(deps.db, {
+    accountId: home.accountId,
+    connectionId: entry.connectionId,
     routeKey,
-  );
+  });
+  if (
+    existing &&
+    (existing.accountId !== target.accountId || existing.workspaceId !== target.workspaceId)
+  ) {
+    // A mapped thread keeps the workspace it was created in.
+    target = { accountId: existing.accountId, workspaceId: existing.workspaceId };
+    grant = await authorizeTarget();
+  }
+  const preparedTask = await prepareSlackReactionTask(deps, client, entry, target, context);
   if (existing?.sessionId) {
     const appendedTask = await remountSlackReactionTaskForSession(
       deps,
-      entry.workspaceId,
+      existing.workspaceId,
       existing.sessionId,
       preparedTask,
     );
@@ -1550,8 +2693,11 @@ async function processSlackReactionInboxEntry(
     return;
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...target,
+    // A reaction routes exactly like a mention, so it names its workspace the
+    // same way. Resolved after `authorizeTarget`, so a name never reaches
+    // somebody who could not reach the workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, routeResolution),
     connectionId: entry.connectionId,
     slackTeamId: entry.slackTeamId,
     slackChannelId: entry.slackChannelId,
@@ -1562,10 +2708,11 @@ async function processSlackReactionInboxEntry(
     owningSubjectId: grant.subjectId,
     visibility: "workspace",
   });
+  requireSlackInteractionMatchesTarget(interaction, target);
   if (interaction.sessionId) {
     const appendedTask = await remountSlackReactionTaskForSession(
       deps,
-      entry.workspaceId,
+      interaction.workspaceId,
       interaction.sessionId,
       preparedTask,
     );
@@ -1588,13 +2735,13 @@ async function processSlackReactionInboxEntry(
   }
   const preferredModel = await getLatestSessionModelForSubject(
     deps.db,
-    entry.workspaceId,
+    interaction.workspaceId,
     grant.subjectId,
   );
   const preparedEntry = slackReactionPreparedEntry(entry, context, preparedTask);
   let session: Awaited<ReturnType<typeof createSessionForRequest>>;
   try {
-    session = await createSessionForRequest(deps, grant, entry.workspaceId, {
+    session = await createSessionForRequest(deps, grant, interaction.workspaceId, {
       requestedSessionId: interaction.sessionReservationId,
       initialMessage: preparedEntry.text,
       instructions: SLACK_SESSION_INSTRUCTIONS,
@@ -1644,11 +2791,15 @@ async function acknowledgeSlackReactionSession(
   if (!interaction.sessionId) {
     throw new Error("Slack reaction acknowledgement requires a bound session");
   }
+  const started = `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`;
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, started);
   await client.postMessage({
-    operationId: deterministicUuid(`slack-reaction-ack:${interaction.id}`),
+    operationId: deterministicUuid(
+      slackPostSeed(interaction, `slack-reaction-ack:${interaction.id}`),
+    ),
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`,
+    text: rendered.text,
   });
 }
 
@@ -1761,16 +2912,25 @@ async function prepareSlackReactionTask(
   deps: ApiRouteDeps,
   client: OpenGeniSlackBotClient,
   entry: SlackInteractionInboxEntry,
+  target: { accountId: string; workspaceId: string },
   context: SlackReactionMessageContext,
 ): Promise<PreparedSlackReactionTask> {
-  return await prepareSlackMessageAttachments(deps, client, entry, context.reactedMessage.files);
+  return await prepareSlackMessageAttachments(
+    deps,
+    client,
+    entry,
+    target,
+    context.reactedMessage.files,
+  );
 }
 
 async function prepareSlackMessageAttachments(
   deps: ApiRouteDeps,
   client: OpenGeniSlackBotClient,
   entry: SlackInteractionInboxEntry,
+  target: { accountId: string; workspaceId: string },
   exactFiles: readonly { id: string; name: string; title: string }[],
+  authorizeSharedRead?: () => Promise<void>,
 ): Promise<PreparedSlackReactionTask> {
   if (exactFiles.length === 0) {
     return { resources: [], attachments: [], omissionCodes: [], omittedCount: 0 };
@@ -1790,12 +2950,13 @@ async function prepareSlackMessageAttachments(
       name: file.name,
       title: file.title,
     })),
+    ...(authorizeSharedRead ? { authorizeSharedRead } : {}),
   });
   const downloaded: Awaited<ReturnType<OpenGeniSlackBotClient["downloadReactionImage"]>>[] = [];
   let aggregateBytes = 0;
   for (const image of prepared) {
     try {
-      const value = await client.downloadReactionImage(image);
+      const value = await client.downloadReactionImage(image, authorizeSharedRead);
       if (
         value.bytes.byteLength > SLACK_REACTION_IMAGE_MAX_BYTES ||
         aggregateBytes + value.bytes.byteLength > MAX_SLACK_REACTION_IMAGE_AGGREGATE_BYTES
@@ -1828,8 +2989,8 @@ async function prepareSlackMessageAttachments(
         await importSlackReactionImage(
           { db: deps.db, objectStorage: deps.objectStorage },
           {
-            accountId: entry.accountId,
-            workspaceId: entry.workspaceId,
+            accountId: target.accountId,
+            workspaceId: target.workspaceId,
             connectionId: entry.connectionId,
             slackTeamId: entry.slackTeamId,
             slackChannelId: entry.slackChannelId,
@@ -1968,9 +3129,11 @@ async function acceptSlackReactionTask(
   resources: FileResourceRef[],
 ) {
   const clientEventId = `slack:${entry.providerEventId}`;
+  // Session events and user messages belong to the workspace that owns the
+  // session, which is the workspace the grant authorized, not the installation.
   const existing = await getSessionEventByClientEventId(
     deps.db,
-    entry.workspaceId,
+    grant.workspaceId,
     sessionId,
     clientEventId,
   );
@@ -1980,7 +3143,7 @@ async function acceptSlackReactionTask(
     }
     return;
   }
-  await acceptSessionUserMessage(deps, grant, entry.workspaceId, sessionId, {
+  await acceptSessionUserMessage(deps, grant, grant.workspaceId, sessionId, {
     text: entry.text,
     resources,
     clientEventId,
@@ -1993,6 +3156,7 @@ async function continueSlackSession(
   interaction: SlackInteraction,
   entry: SlackInteractionInboxEntry,
   resources: FileResourceRef[] = [],
+  options: { modelContext?: string | null } = {},
 ) {
   if (
     !interaction.sessionId ||
@@ -2023,7 +3187,7 @@ async function continueSlackSession(
   }
   const pending = await listSessionHumanInputRequests(
     deps.db,
-    entry.workspaceId,
+    interaction.workspaceId,
     interaction.sessionId,
     { status: "pending", limit: 2 },
   );
@@ -2063,8 +3227,9 @@ async function continueSlackSession(
   if (!hasPermission(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
-  await acceptSessionUserMessage(deps, grant, entry.workspaceId, interaction.sessionId, {
+  await acceptSessionUserMessage(deps, grant, interaction.workspaceId, interaction.sessionId, {
     text: entry.text,
+    ...(options.modelContext ? { modelContext: options.modelContext } : {}),
     resources,
     clientEventId: `slack:${entry.providerEventId}`,
   });
@@ -2085,6 +3250,9 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   const separator = entry.text.lastIndexOf(":");
   const actionId = separator > 0 ? entry.text.slice(0, separator) : "";
   const handleId = separator > 0 ? entry.text.slice(separator + 1) : "";
+  // The block-action inbox row carries HOME tenancy, exactly like every other
+  // inbox row: it is the installation binding that received the click.
+  const home = { accountId: entry.accountId, workspaceId: entry.workspaceId } as const;
   const route = await resolveSlackInstallationRoute(deps.db, entry.slackTeamId);
   if (
     !route ||
@@ -2094,19 +3262,39 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   ) {
     throw new SlackInteractionPermanentError("slack_action_installation_changed");
   }
+  // A route choice is not an action handle: the picker exists BEFORE any
+  // session, so there is no handle row to load and the ordinary path below
+  // would refuse it. Branch first.
+  if (actionId === "opengeni.route.select" || actionId === "opengeni.route.cancel") {
+    await handleSlackRouteChoice(deps, home, entry, actionId, handleId);
+    return;
+  }
+  // A handle lives in the workspace that owns its session, which is not the
+  // installation's workspace once routing is on. Learn that scope from the
+  // content-free probe, then read the full handle under it: every authorization
+  // check below is unchanged and still runs in the handle's own tenancy.
+  const handleTenancy =
+    (await probeSlackActionHandleTenancy(deps.db, {
+      accountId: home.accountId,
+      connectionId: entry.connectionId,
+      handleId,
+    })) ?? home;
   const handle = await getSlackInteractionActionHandle(deps.db, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...handleTenancy,
     handleId,
   });
   if (!handle || SLACK_ACTION_ID_BY_KIND[handle.actionKind] !== actionId) {
     throw new SlackInteractionPermanentError("slack_action_handle_invalid");
   }
+  // An action handle is a TARGET fact: it is composite-FK'd to its interaction
+  // and its RESTRICTIVE session-visibility policy resolves the session under the
+  // handle's own tenancy, so every read, settle and interaction lookup below
+  // uses the handle's scope rather than the installation's.
+  const target = { accountId: handle.accountId, workspaceId: handle.workspaceId } as const;
   if (handle.status !== "pending") return;
   if (handle.expiresAt.getTime() <= Date.now()) {
     await settleSlackInteractionActionHandles(deps.db, {
-      accountId: entry.accountId,
-      workspaceId: entry.workspaceId,
+      ...target,
       handleId: handle.id,
       result: "expired",
       stale: true,
@@ -2118,14 +3306,15 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   }
   const [interaction, link, post] = await Promise.all([
     getSlackInteractionById(deps.db, {
-      accountId: entry.accountId,
-      workspaceId: entry.workspaceId,
+      ...target,
       interactionId: handle.interactionId,
     }),
-    getSlackBotUserLink(deps.db, entry.workspaceId, entry.connectionId, entry.slackUserId),
+    // Identity stays HOME.
+    getSlackBotUserLink(deps.db, home.workspaceId, entry.connectionId, entry.slackUserId),
+    // The post ledger is written by the bot credential, so it stays HOME too.
     getSlackBotPostOperation(
       deps.db,
-      entry.workspaceId,
+      home.workspaceId,
       entry.connectionId,
       handle.messageOperationId,
     ),
@@ -2146,34 +3335,51 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   ) {
     throw new SlackInteractionPermanentError("slack_action_authority_changed");
   }
-  const grant = await getWorkspaceGrant(deps.db, link.subjectId, entry.workspaceId, {
-    principalKind: "human_session",
+  const grant = await resolveSlackTargetAuthority(deps.db, {
+    subjectId: link.subjectId,
+    targetAccountId: target.accountId,
+    targetWorkspaceId: target.workspaceId,
   });
-  if (
-    !grant ||
-    grant.accountId !== entry.accountId ||
-    !hasPermission(grant.permissions, "sessions:control")
-  ) {
+  if (!grant || !hasPermission(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...home,
     connectionId: entry.connectionId,
     subjectId: grant.subjectId,
     sessionId: handle.sessionId,
   });
   const outcome = await executeSlackAction(deps, grant, interaction, handle);
+  // A control click replaces the message it was pressed on. When that message
+  // is this interaction's acknowledgement and this interaction won the one-time
+  // onboarding hint, the update carries the hint forward: otherwise pressing
+  // Status would permanently destroy the only copy of prose a Slack identity is
+  // ever shown. The handle's message operation identifies the acknowledgement
+  // exactly, independent of route rekeying. Later control cards have their own
+  // operation ids, so the hint still appears on exactly one message.
+  const acknowledgementOperationId = deterministicUuid(
+    slackPostSeed(interaction, `slack-ack:${interaction.id}`),
+  );
+  const updateText =
+    interaction.firstTaskHint === true && handle.messageOperationId === acknowledgementOperationId
+      ? `${outcome.text}${slackFirstTaskHintText(deps)}`
+      : outcome.text;
+  // A control click replaces a message that already carried the line, so the
+  // replacement carries it too rather than quietly stripping it.
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, updateText, [
+    { type: "section", text: { type: "mrkdwn", text: updateText } },
+  ]);
   await client.updateMessage({
-    operationId: deterministicUuid(`slack-action-update:${handle.id}:${outcome.result}`),
+    operationId: deterministicUuid(
+      slackPostSeed(interaction, `slack-action-update:${handle.id}:${outcome.result}`),
+    ),
     channelId: entry.slackChannelId,
     timestamp: entry.slackMessageTs,
-    text: outcome.text,
-    blocks: [{ type: "section", text: { type: "mrkdwn", text: outcome.text } }],
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
   });
   await settleSlackInteractionActionHandles(deps.db, {
-    accountId: entry.accountId,
-    workspaceId: entry.workspaceId,
+    ...target,
     handleId: handle.id,
     result: outcome.result,
     ...(outcome.stale ? { stale: true } : {}),
@@ -2348,9 +3554,20 @@ async function executeSlackAction(
   }
   const session = await getSession(deps.db, grant.workspaceId, handle.sessionId);
   if (!session) throw new SlackInteractionPermanentError("slack_action_session_missing");
+  // The result post no longer advertises recurrence. The Status card is where
+  // the requester finds it, and only while this exact requester still holds
+  // schedule authority in this workspace. The deep link and the schedules
+  // authority behind it are unchanged: the browser rechecks both.
+  const recurring =
+    hasPermission(grant.permissions, "sessions:read") &&
+    hasPermission(grant.permissions, "scheduled_tasks:manage")
+      ? makeRecurringText(deps, grant.workspaceId, handle.sessionId)
+      : null;
   return {
     result: "status",
-    text: `${mention}OpenGeni task status: *${session.status.replaceAll("_", " ")}*.`,
+    text: `${mention}OpenGeni task status: *${session.status.replaceAll("_", " ")}*.${
+      recurring ? `\n\n${recurring}` : ""
+    }`,
     ...(session.status === "cancelled" || session.status === "failed"
       ? {}
       : { controlState: "active" as const }),
@@ -2367,18 +3584,25 @@ async function publishSlackSharedResult(
   if (!handle.targetId || !interaction.sessionId) {
     throw new SlackInteractionPermanentError("slack_shared_publication_target_invalid");
   }
-  const [origin, activePolicy, event] = await Promise.all([
+  const publicationHome = await resolveSlackDeliveryHome(deps, interaction);
+  const [origin, event] = await Promise.all([
     getSlackSharedTaskOrigin(deps.db, {
       accountId: interaction.accountId,
       workspaceId: interaction.workspaceId,
       interactionId: interaction.id,
     }),
-    getActiveSlackTaskPolicy(deps.db, {
-      accountId: interaction.accountId,
-      workspaceId: interaction.workspaceId,
-    }),
     getSessionEvent(deps.db, interaction.workspaceId, handle.targetId),
   ]);
+  // The Slack task policy governs what may be read out of, and published back
+  // to, the Slack conversation, so it is an installation-surface fact. The
+  // origin froze which tenancy that was; a row written before routing existed
+  // carries null and implied its own, because the two could not differ then.
+  const activePolicy = origin
+    ? await getActiveSlackTaskPolicy(deps.db, {
+        accountId: origin.policyAccountId ?? origin.accountId,
+        workspaceId: origin.policyWorkspaceId ?? origin.workspaceId,
+      })
+    : null;
   if (
     !origin ||
     origin.connectionId !== interaction.connectionId ||
@@ -2400,8 +3624,7 @@ async function publishSlackSharedResult(
     };
   }
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: interaction.accountId,
-    workspaceId: interaction.workspaceId,
+    ...publicationHome,
     connectionId: interaction.connectionId,
     subjectId: grant.subjectId,
     sessionId: interaction.sessionId,
@@ -2480,31 +3703,22 @@ async function validatedSlackRequester(
     SlackInteraction,
     "accountId" | "workspaceId" | "connectionId" | "initiatingSlackUserId" | "owningSubjectId"
   >,
+  // Identity links are HOME facts, unique on (connection_id, slack_user_id) and
+  // RLS-visible only under the installation's own tenancy.
+  home: { accountId: string; workspaceId: string },
 ) {
   if (!interaction.initiatingSlackUserId) {
-    return { authorized: false, canSchedule: false, mention: "" };
+    return { authorized: false, mention: "" };
   }
-  const [link, grant] = await Promise.all([
-    getSlackBotUserLink(
-      deps.db,
-      interaction.workspaceId,
-      interaction.connectionId,
-      interaction.initiatingSlackUserId,
-    ),
-    getWorkspaceGrant(deps.db, interaction.owningSubjectId, interaction.workspaceId, {
-      principalKind: "human_session",
-    }),
-  ]);
+  const link = await getSlackBotUserLink(
+    deps.db,
+    home.workspaceId,
+    interaction.connectionId,
+    interaction.initiatingSlackUserId,
+  );
   const authorized = link?.subjectId === interaction.owningSubjectId;
-  const canSchedule =
-    authorized &&
-    grant?.accountId === interaction.accountId &&
-    hasPermission(grant.permissions, "sessions:read") &&
-    hasPermission(grant.permissions, "sessions:control") &&
-    hasPermission(grant.permissions, "scheduled_tasks:manage");
   return {
     authorized,
-    canSchedule,
     mention: authorized ? slackRequesterMention(interaction) : "",
   };
 }
@@ -2610,7 +3824,7 @@ async function slackApprovalCard(
   requesterAuthorized: boolean,
 ): Promise<{ text: string; blocks?: SlackMessageBlock[]; operationId: string }> {
   const operationId = deterministicUuid(
-    `slack-delivery:${interaction.id}:${event.sequence}:approval`,
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:approval`),
   );
   const approvals = slackApprovalSummaries(event.payload);
   const fallback = approvals.length
@@ -2763,7 +3977,7 @@ async function slackHumanInputCard(
   );
   if (!request || request.status !== "pending") return null;
   const operationId = deterministicUuid(
-    `slack-delivery:${interaction.id}:${event.sequence}:human-input`,
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:human-input`),
   );
   const text = `${mention}OpenGeni needs your input:\n${formatQuestions(request.questions)}\nReply in this thread${request.allowSkip ? " or choose Skip" : ""}.`;
   if (!requesterAuthorized || !interaction.initiatingSlackUserId) return { text, operationId };
@@ -2831,6 +4045,157 @@ async function slackHumanInputCard(
   return { text, blocks, operationId };
 }
 
+/**
+ * A child of a Slack-originated session is never itself mapped to a Slack
+ * thread, so the parent's bounded `child_requires_action` notice is the only
+ * path that can tell the human that a worker they started is blocked. The card
+ * is a pointer, not a second question card: one bounded preview of the first
+ * question (or the waiting approval count) plus the child link. The child's own
+ * OpenGeni card remains the place the human actually answers.
+ *
+ * Every deferred child lifecycle kind (`child_progress`,
+ * `child_waiting_capacity`, `child_requires_action_resolved`, `child_paused`)
+ * returns null here so Slack stays quiet, and so does every non-child machine
+ * input that shares the `system.update.pending` event type.
+ *
+ * The caller has already proven that this workspace turned the notice on. The
+ * card defaults off per workspace because the in-app rail and priority feed
+ * already surface a blocked child.
+ */
+/**
+ * The exact durable notice behind one `system.update.pending` event, or null
+ * when it no longer describes a blocked worker.
+ *
+ * Slack delivery runs behind the session: a widened retry window, a replica
+ * claim, or simply a later page can reach this event after the child already
+ * got its answer. Two facts have to agree before a card is worth posting.
+ *
+ * A resolution supersedes a still-`pending` notice in the same commit, so
+ * `superseded` (and an explicitly `cancelled` notice) is already a "no longer
+ * blocked" fact. But a notice the parent's turn has claimed is `delivered` and
+ * keeps that state forever, so state alone is not enough - the resolution row
+ * for that exact (child, turn, generation) boundary is checked as well, on the
+ * parent's own rows. A re-freeze is a new generation and a new notice.
+ *
+ * Every read is wrapped: a malformed or unreadable durable row is not a
+ * delivery failure. Throwing would burn a delivery attempt and, after
+ * MAX_DELIVERY_ATTEMPTS, close this interaction's whole delivery over one
+ * notice nobody could have posted anyway. Silence is the correct outcome, and
+ * it is the same outcome every other unpostable notice already takes.
+ */
+async function resolveSlackBlockedChildNotice(
+  deps: ApiRouteDeps,
+  interaction: SlackInteraction,
+  sessionId: string,
+  updateId: string,
+): Promise<ChildRequiresActionPayload | null> {
+  try {
+    const update = await getSessionSystemUpdateById(
+      deps.db,
+      interaction.workspaceId,
+      sessionId,
+      updateId,
+    );
+    if (!update || update.payload.type !== "child_requires_action") return null;
+    if (update.state === "superseded" || update.state === "cancelled") return null;
+    const resolved = await childRequiresActionResolutionExists(
+      deps.db,
+      interaction.workspaceId,
+      sessionId,
+      {
+        childSessionId: update.payload.childSessionId,
+        childTurnId: update.payload.childTurnId,
+        childTurnGeneration: update.payload.childTurnGeneration,
+      },
+    );
+    return resolved ? null : update.payload;
+  } catch {
+    return null;
+  }
+}
+
+async function slackChildRequiresActionCard(
+  deps: ApiRouteDeps,
+  interaction: SlackInteraction,
+  event: SessionEvent,
+  mention: string,
+): Promise<{ text: string } | null> {
+  const sessionId = interaction.sessionId;
+  if (!sessionId) return null;
+  const preview = record(event.payload);
+  if (boundedString(preview?.kind, 64) !== "child_requires_action") return null;
+  const updateId = boundedString(preview?.updateId, 64);
+  if (!updateId || !SLACK_UUID_PATTERN.test(updateId)) return null;
+  // The bounded event preview is lossy by construction. Resolve the exact
+  // durable notice under the ordinary workspace scope; the child session is
+  // never read, only linked.
+  const notice = await resolveSlackBlockedChildNotice(deps, interaction, sessionId, updateId);
+  if (!notice) return null;
+  const questions = notice.requests.filter((request) => request.kind === "human_input");
+  const approvals = notice.requests.filter((request) => request.kind === "approval");
+  const first = questions[0];
+  const detail = first
+    ? `${boundedSlackChildDetail(first.firstQuestion)}${
+        first.questionCount > 1 ? ` (+${first.questionCount - 1} more)` : ""
+      }`
+    : approvals.length > 0
+      ? `${approvals.length} tool approval${approvals.length > 1 ? "s are" : " is"} waiting for a human.`
+      : "";
+  const link = slackSessionUrl(deps, interaction.workspaceId, notice.childSessionId);
+  const lines = [`${mention}A worker you started needs input.`];
+  if (detail) lines.push(`> ${detail}`);
+  if (link) lines.push(`<${link}|Open in OpenGeni>`);
+  return { text: boundedOutput(lines.join("\n")) };
+}
+
+/**
+ * A goal that paused because it ran out of budget or hit the continuation cap
+ * stops making progress with nobody watching, so the Slack thread gets one
+ * bounded line. A `user_pause` / `api` / `agent` pause is a decision the human
+ * or their agent already made, and `no_progress` is not a stop the human must
+ * act on, so none of them post. `goal.resumed` never posts.
+ *
+ * The caller has already proven that this workspace turned the notice on; it
+ * defaults off per workspace.
+ */
+function slackGoalPausedText(
+  deps: ApiRouteDeps,
+  interaction: SlackInteraction,
+  event: SessionEvent,
+  mention: string,
+): string | null {
+  if (!interaction.sessionId) return null;
+  const reason = boundedString(record(event.payload)?.reason, 64);
+  const headline = reason ? SLACK_GOAL_PAUSED_HEADLINES.get(reason) : undefined;
+  if (!headline) return null;
+  const link = slackSessionUrl(deps, interaction.workspaceId, interaction.sessionId);
+  return boundedOutput(`${mention}${headline}.${link ? ` <${link}|Open in OpenGeni>` : ""}`);
+}
+
+/**
+ * The installation tenancy that owns this interaction's Slack credential.
+ *
+ * `slack_interactions.connection_id` deliberately has no composite
+ * `(workspace_id, connection_id)` foreign key, so a routed interaction may point
+ * at the installation's connection from another workspace.
+ *
+ * A binding that does not resolve, or that now names a different connection, is
+ * NOT turned into a new delivery precondition: this code previously used the
+ * interaction's own tenancy unconditionally, so falling back to it keeps every
+ * delivery that used to succeed succeeding. The fallback cannot post from the
+ * wrong workspace either, because `claimSlackBotPostOperation` selects the
+ * connection under the tenancy it is given and fails when it does not own it.
+ */
+async function resolveSlackDeliveryHome(
+  deps: ApiRouteDeps,
+  interaction: Pick<SlackInteraction, "accountId" | "workspaceId" | "connectionId" | "slackTeamId">,
+): Promise<{ accountId: string; workspaceId: string }> {
+  const installation = await resolveSlackInstallationRoute(deps.db, interaction.slackTeamId);
+  return installation && installation.connectionId === interaction.connectionId
+    ? { accountId: installation.accountId, workspaceId: installation.workspaceId }
+    : { accountId: interaction.accountId, workspaceId: interaction.workspaceId };
+}
+
 async function deliverSlackSessionEvents(
   deps: ApiRouteDeps,
   interaction: SlackInteraction,
@@ -2850,14 +4215,65 @@ async function deliverSlackSessionEvents(
     });
     return;
   }
+  // The bot credential is owned by the installation's workspace and every
+  // provider call is fenced on it, so the delivery client is always built from
+  // HOME even when the session it reports on lives in another workspace.
+  const home = await resolveSlackDeliveryHome(deps, interaction);
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
-    accountId: interaction.accountId,
-    workspaceId: interaction.workspaceId,
+    ...home,
     connectionId: interaction.connectionId,
     subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
     sessionId: interaction.sessionId,
   });
-  const requester = await validatedSlackRequester(deps, interaction);
+  const requester = await validatedSlackRequester(deps, interaction, home);
+  // Both orchestration notices are per-workspace and OFF unless this workspace
+  // turned them on. Resolved lazily so an ordinary page of turn/progress events
+  // costs no extra workspace read, and memoized so one page resolves once. A
+  // disabled notice takes the same "nothing to post for this event" path as an
+  // undeliverable one: no post operation, no progress slot, and the delivery
+  // cursor still advances past the event exactly as it would have.
+  let orchestrationNotices: ResolvedWorkspaceSlackOrchestrationNoticeSettings | null = null;
+  const orchestrationNoticeEnabled = async (
+    notice: keyof ResolvedWorkspaceSlackOrchestrationNoticeSettings,
+  ): Promise<boolean> => {
+    orchestrationNotices ??= resolveWorkspaceSlackOrchestrationNoticeSettings(
+      (await getWorkspace(deps.db, interaction.workspaceId))?.settings,
+    );
+    return orchestrationNotices[notice];
+  };
+  /**
+   * Post one orchestration notice through the SAME durable per-interaction slot
+   * budget as assistant progress, so an orchestration that fans out to many
+   * blocked children cannot turn one Slack task into an unbounded feed. That
+   * budget is deliberately shared rather than a second private allowance: the
+   * ceiling worth enforcing is the total number of posts the human did not ask
+   * for, not a per-category one, and this whole feature exists because an
+   * unsolicited post is worse than a missed one. Beyond the cap the notice goes
+   * silent exactly like a fourth progress message.
+   *
+   * The slot is claimed only once a card is actually going to be posted, so a
+   * skipped, stale, or already-resolved notice never burns one. Claims are
+   * durable and keyed on the session event sequence, so a reaper retry, a
+   * replica claim, or a replayed page reuses the same slot and the same post
+   * operation instead of posting twice or consuming a second slot. The claimed
+   * row never becomes terminal-coalescing evidence: that lookup only joins
+   * `agent.message.completed` events.
+   */
+  const postUnsolicitedNotice = async (event: SessionEvent, text: string, kind: string) => {
+    const slot = await claimSlackInteractionProgressDelivery(deps.db, {
+      accountId: interaction.accountId,
+      workspaceId: interaction.workspaceId,
+      interactionId: interaction.id,
+      claimHolderId,
+      sessionEventSequence: event.sequence,
+      maxProgress: MAX_PROGRESS_MESSAGES,
+    });
+    if (slot.kind === "not_owned") {
+      throw new Error("Slack orchestration notice lost its durable interaction claim");
+    }
+    if (slot.kind !== "claimed") return;
+    await postDelivery(client, interaction, event, text, kind, slot.delivery.operationId);
+  };
   let lastSequence = interaction.lastDeliveredSessionEventSequence;
   let terminal: Exclude<SlackInteraction["terminalDeliveryState"], "open"> | null = null;
   let latestAssistantText = "";
@@ -2985,14 +4401,21 @@ async function deliverSlackSessionEvents(
           card.blocks,
         );
       }
+    } else if (event.type === "system.update.pending") {
+      const card = (await orchestrationNoticeEnabled("childRequiresAction"))
+        ? await slackChildRequiresActionCard(deps, interaction, event, requester.mention)
+        : null;
+      if (card) await postUnsolicitedNotice(event, card.text, "child-blocked");
+    } else if (event.type === "goal.paused") {
+      const paused = (await orchestrationNoticeEnabled("goalPaused"))
+        ? slackGoalPausedText(deps, interaction, event, requester.mention)
+        : null;
+      if (paused) await postUnsolicitedNotice(event, paused, "goal-paused");
     } else if (event.type === "turn.completed") {
       const payloadOutput = safePayloadText(event.payload, "output");
       const hasPublishableOutput = payloadOutput.trim().length > 0;
       const output = hasPublishableOutput ? payloadOutput : latestAssistantText;
       const normalizedOutput = output.trim();
-      const recurringLink = requester.canSchedule
-        ? `\n\n${makeRecurringText(deps, interaction.workspaceId, interaction.sessionId)}`
-        : "";
       const existingProgress = progressEvidence.find(
         (delivery) =>
           slackDeliveryTextsCoalesce(boundedOutput(delivery.text).trim(), normalizedOutput) &&
@@ -3022,46 +4445,49 @@ async function deliverSlackSessionEvents(
         );
         const posted = await getSlackBotPostOperation(
           deps.db,
-          interaction.workspaceId,
+          home.workspaceId,
           interaction.connectionId,
           existingProgress.operationId,
         );
         if (posted?.slackChannelId && posted.slackMessageTimestamp) {
-          const text = boundedOutputWithSuffix(
-            `${requester.mention}${existingProgress.text}`,
-            recurringLink,
+          // The result is the result. Continuation prose and the recurring
+          // action live on the control/Status card and `<command> info`.
+          const text = boundedOutput(`${requester.mention}${existingProgress.text}`);
+          // This rewrites a message that already carried the line, so it has to
+          // carry it too, or the update would quietly strip it.
+          const rendered = withWorkspaceLine(
+            interaction.routedWorkspaceLabel,
+            text,
+            publicationBlocks.length > 0
+              ? ([
+                  { type: "section", text: { type: "mrkdwn", text } },
+                  ...publicationBlocks,
+                ] as SlackMessageBlock[])
+              : undefined,
           );
           await client.updateMessage({
             operationId: deterministicUuid(
-              `slack-terminal-update:${interaction.id}:${event.sequence}`,
+              slackPostSeed(
+                interaction,
+                `slack-terminal-update:${interaction.id}:${event.sequence}`,
+              ),
             ),
             channelId: posted.slackChannelId,
             timestamp: posted.slackMessageTimestamp,
-            text,
-            ...(publicationBlocks.length > 0
+            text: rendered.text,
+            ...(rendered.blocks
               ? {
-                  blocks: [
-                    {
-                      type: "section",
-                      text: {
-                        type: "mrkdwn",
-                        text,
-                      },
-                    },
-                    ...publicationBlocks,
-                  ],
+                  blocks: rendered.blocks,
                 }
               : {}),
           });
         }
       } else {
         const operationId = deterministicUuid(
-          `slack-delivery:${interaction.id}:${event.sequence}:final`,
+          slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:final`),
         );
-        const finalSuffix = `\n\nReply in this thread to continue.${recurringLink}`;
-        const text = boundedOutputWithSuffix(
+        const text = boundedOutput(
           `${requester.mention}${output || "OpenGeni finished this task."}`,
-          finalSuffix,
         );
         const publicationBlocks = hasPublishableOutput
           ? await slackSharedResultPublicationBlocks(
@@ -3159,15 +4585,18 @@ async function postDelivery(
   event: SessionEvent,
   text: string,
   kind: string,
-  operationId = deterministicUuid(`slack-delivery:${interaction.id}:${event.sequence}:${kind}`),
+  operationId = deterministicUuid(
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:${kind}`),
+  ),
   blocks?: SlackMessageBlock[],
 ) {
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, boundedOutput(text), blocks);
   await client.postMessage({
     operationId,
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: boundedOutput(text),
-    ...(blocks ? { blocks } : {}),
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
   });
 }
 
@@ -3247,6 +4676,8 @@ const SLACK_BLOCK_ACTION_IDS = new Set([
   "opengeni.session.pause",
   "opengeni.session.resume",
   "opengeni.shared_result.publish",
+  "opengeni.route.select",
+  "opengeni.route.cancel",
 ]);
 
 export function normalizedBlockActionInteraction(
@@ -3311,7 +4742,14 @@ function humanInputResponse(questions: HumanInputQuestion[], text: string) {
   const matches = question.options.filter(
     (option) => option.id.toLowerCase() === normalized || option.label.toLowerCase() === normalized,
   );
-  if (matches.length !== 1) return null;
+  if (matches.length !== 1) {
+    const other = text.trim();
+    if (!other) return null;
+    return {
+      outcome: "answered" as const,
+      answers: [{ questionId: question.id, values: [], other }],
+    };
+  }
   return {
     outcome: "answered" as const,
     answers: [{ questionId: question.id, values: [matches[0]!.id] }],
@@ -3326,11 +4764,123 @@ function formatQuestions(questions: HumanInputQuestion[]) {
         .slice(0, 10)
         .map((option) => option.label)
         .join(", ");
-      return `${index + 1}. ${boundedOutput(question.prompt)}${options ? ` (${options})` : ""}`;
+      return `${index + 1}. ${boundedOutput(question.prompt)}${
+        options ? ` (${options}, or reply with another value)` : ""
+      }`;
     })
     .join("\n");
 }
 
+export function isSlackInfoCommand(text: string): boolean {
+  return text.trim().toLowerCase() === "info";
+}
+
+type SlackSlashResponse = {
+  response_type: "ephemeral";
+  text: string;
+  unfurl_links: false;
+  unfurl_media: false;
+  blocks?: SlackMessageBlock[];
+};
+
+/**
+ * The ephemeral `<command> info` card.
+ *
+ * It is a projection of what the caller can already do, not an action: no
+ * session, no durable inbox row, no provider post. It re-proves the exact
+ * Slack identity link plus live workspace grants before any
+ * workspace-identifying text is echoed, so an unlinked or access-revoked
+ * identity receives the ordinary connect view instead.
+ */
+async function slackInfoCommandResponse(
+  deps: ApiRouteDeps,
+  installation: SlackInstallationRoute,
+  entry: NormalizedSlackInteraction,
+): Promise<SlackSlashResponse> {
+  const identity = {
+    workspaceId: installation.workspaceId,
+    connectionId: installation.connectionId,
+    slackTeamId: entry.slackTeamId,
+    slackUserId: entry.slackUserId,
+  };
+  const link = await getSlackBotUserLink(
+    deps.db,
+    installation.workspaceId,
+    installation.connectionId,
+    entry.slackUserId,
+  );
+  const grant = link
+    ? await getWorkspaceGrant(deps.db, link.subjectId, installation.workspaceId, {
+        principalKind: "human_session",
+      })
+    : null;
+  if (
+    !grant ||
+    grant.accountId !== installation.accountId ||
+    !hasPermission(grant.permissions, "sessions:read")
+  ) {
+    return ephemeralSlackResponse(
+      link
+        ? `Your Slack identity is linked, but it does not currently have access to this OpenGeni workspace. Request access: ${linkUrl(deps, identity)}. No session was created.`
+        : `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, identity)}. No session was created.`,
+    );
+  }
+  const workspace = await getWorkspace(deps.db, installation.workspaceId);
+  const command = deps.settings.slackCommand;
+  const botMention = slackBotMention(installation.botUserId);
+  // Every line is gated on the grant that actually authorizes it, so the card
+  // stays a projection of what this caller can do rather than a generic manual.
+  const canControl = hasPermission(grant.permissions, "sessions:control");
+  const canCreate = hasPermission(grant.permissions, "sessions:create");
+  const schedules = hasPermission(grant.permissions, "scheduled_tasks:manage")
+    ? slackSchedulesUrl(deps, installation.workspaceId)
+    : null;
+  const workspaceUrl = slackWorkspaceUrl(deps, installation.workspaceId);
+  const workspaceName = (workspace?.name ?? "").trim().slice(0, 120);
+  const destination = workspaceName
+    ? `the *${escapeSlackMrkdwn(workspaceName)}* workspace`
+    : "your OpenGeni workspace";
+  const lines = [
+    "*Working with OpenGeni in Slack*",
+    "",
+    ...(canControl
+      ? [
+          "• *Continue a task:* reply in its Slack thread.",
+          "• *Stop a task:* press *Stop* on its card, or reply `stop` in its thread.",
+        ]
+      : []),
+    ...(canCreate
+      ? [
+          `• *Start a new task:* mention ${botMention} in a channel, run \`${command} <task>\`, or send a new top-level direct message.`,
+        ]
+      : []),
+    ...(schedules
+      ? [
+          `• *Make a result recurring:* press *Status* on the task card and open *Make recurring*, or open <${schedules}|Schedules>.`,
+        ]
+      : []),
+    `• *Where work lands:* ${destination}${workspaceUrl ? ` (<${workspaceUrl}|open OpenGeni>)` : ""}.`,
+  ];
+  const text = lines.join("\n");
+  return ephemeralSlackResponse(text, [
+    { type: "section", text: { type: "mrkdwn", text } },
+  ] as SlackMessageBlock[]);
+}
+
+function ephemeralSlackResponse(text: string, blocks?: SlackMessageBlock[]): SlackSlashResponse {
+  return {
+    response_type: "ephemeral",
+    text,
+    unfurl_links: false,
+    unfurl_media: false,
+    ...(blocks ? { blocks } : {}),
+  };
+}
+
+function slackBotMention(botUserId: string | null): string {
+  return botUserId && /^[UWB][A-Z0-9]{1,63}$/.test(botUserId) ? `<@${botUserId}>` : "@OpenGeni";
+}
+
 function openSessionText(deps: ApiRouteDeps, workspaceId: string, sessionId: string) {
   const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
   if (!base) throw new Error("Slack session acknowledgement requires an absolute web base URL");
@@ -3338,15 +4888,105 @@ function openSessionText(deps: ApiRouteDeps, workspaceId: string, sessionId: str
   return `<${url}|Open in OpenGeni>`;
 }
 
-function makeRecurringText(deps: ApiRouteDeps, workspaceId: string, sessionId: string) {
+function slackWorkspaceUrl(deps: ApiRouteDeps, workspaceId: string): string | null {
+  return safeSlackActionUrl(deps, `/workspaces/${encodeURIComponent(workspaceId)}`);
+}
+
+function slackSessionAuthorizationScopeKey(scope: SessionAuthorizationListScope | null): string {
+  if (scope === null) return "standalone";
+  if (scope.kind === "all") return "all";
+  return JSON.stringify({
+    kind: scope.kind,
+    rootSessionIds: [...scope.rootSessionIds].sort(),
+    sessionIds: [...scope.sessionIds].sort(),
+  });
+}
+
+function slackSessionUrl(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  sessionId: string,
+): string | null {
+  return safeSlackActionUrl(
+    deps,
+    `/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}`,
+  );
+}
+
+function safeSlackActionUrl(deps: ApiRouteDeps, pathname: string): string | null {
   const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
-  if (!base) throw new Error("Slack recurring action requires an absolute web base URL");
-  const url = new URL(`/workspaces/${workspaceId}/schedules`, base);
+  if (!base) return null;
+  try {
+    const url = new URL(pathname, base);
+    if ((url.protocol !== "https:" && url.protocol !== "http:") || url.username || url.password) {
+      return null;
+    }
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+function slackAppHomeLinkUrl(
+  deps: ApiRouteDeps,
+  installation: SlackInstallationRoute,
+  slackTeamId: string,
+  slackUserId: string,
+): string | null {
+  const signingSecret = deps.settings.slackSigningSecret;
+  const base = slackWorkspaceUrl(deps, installation.workspaceId);
+  if (!signingSecret || !base) return base;
+  const url = new URL(
+    `/workspaces/${encodeURIComponent(installation.workspaceId)}/capabilities`,
+    base,
+  );
+  url.hash = new URLSearchParams({
+    slack_link: createSlackUserLinkToken(signingSecret, {
+      workspaceId: installation.workspaceId,
+      connectionId: installation.connectionId,
+      slackTeamId,
+      slackUserId,
+    }),
+  }).toString();
+  return url.toString();
+}
+
+function makeRecurringText(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  sessionId: string,
+): string | null {
+  // Unchanged deep-link contract: the schedules editor plus the exact source
+  // session UUID, and nothing copied out of Slack. A deployment without an
+  // absolute web base URL simply omits the action instead of failing a card.
+  const base = slackSchedulesUrl(deps, workspaceId);
+  if (!base) return null;
+  const url = new URL(base);
   url.searchParams.set("sourceSessionId", sessionId);
   return `<${url.toString()}|Make recurring>`;
 }
 
-function linkUrl(deps: ApiRouteDeps, entry: SlackInteractionInboxEntry) {
+function slackSchedulesUrl(deps: ApiRouteDeps, workspaceId: string): string | null {
+  return safeSlackActionUrl(deps, `/workspaces/${encodeURIComponent(workspaceId)}/schedules`);
+}
+
+function linkUrl(
+  deps: ApiRouteDeps,
+  entry: Pick<
+    SlackInteractionInboxEntry,
+    "workspaceId" | "connectionId" | "slackTeamId" | "slackUserId"
+  >,
+  /**
+   * When this URL goes into a message posted under a deterministic operation
+   * id, the token has to be deterministic too. The post ledger binds that id to
+   * a digest over the text, so a retry that mints a fresh token renders
+   * different bytes and is refused as a conflicting request, permanently. Pass
+   * the originating inbox row's creation time: the token is then stable for that
+   * row and still expires fifteen minutes after the message could first have
+   * been read.
+   */
+  mintedAtMs?: number,
+) {
   const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
   const signingSecret = deps.settings.slackSigningSecret;
   if (!base || !signingSecret) return "OpenGeni Settings → Integrations → Slack";
@@ -3354,7 +4994,7 @@ function linkUrl(deps: ApiRouteDeps, entry: SlackInteractionInboxEntry) {
   // Fragments stay out of HTTP request lines, reverse-proxy logs, Referer
   // headers, and managed-auth callback URLs. Query-form bearers are rejected.
   url.hash = new URLSearchParams({
-    slack_link: createSlackUserLinkToken(signingSecret, entry),
+    slack_link: createSlackUserLinkToken(signingSecret, entry, mintedAtMs),
   }).toString();
   return url.toString();
 }
@@ -3519,17 +5159,16 @@ function boundedText(value: unknown): string | null {
   return trimmed.slice(0, MAX_SLACK_INPUT_CHARS);
 }
 
-function boundedOutput(value: string) {
-  return value.length <= MAX_SLACK_TEXT_CHARS
-    ? value
-    : `${value.slice(0, MAX_SLACK_TEXT_CHARS - 20)}\n… output truncated`;
+/** Single-line, character-bounded preview for a blocked-worker pointer card. */
+function boundedSlackChildDetail(value: string) {
+  const collapsed = value.replace(/\s+/gu, " ").trim();
+  return collapsed.length <= MAX_SLACK_CHILD_DETAIL_CHARS
+    ? collapsed
+    : `${collapsed.slice(0, MAX_SLACK_CHILD_DETAIL_CHARS - 1)}…`;
 }
 
-function boundedOutputWithSuffix(value: string, suffix: string) {
-  const maxValueChars = Math.max(0, MAX_SLACK_TEXT_CHARS - suffix.length);
-  if (value.length <= maxValueChars) return `${value}${suffix}`;
-  const truncation = "\n… output truncated";
-  return `${value.slice(0, Math.max(0, maxValueChars - truncation.length))}${truncation}${suffix}`;
+function boundedOutput(value: string, limit = MAX_SLACK_TEXT_CHARS) {
+  return value.length <= limit ? value : `${value.slice(0, limit - 20)}\n… output truncated`;
 }
 
 function safePayloadText(payload: unknown, field: string) {