@openrig/cli 0.6.14 → 0.7.1

package/daemon/dist/domain/gateway/slack/slack-subsystem.js

@@ -22,7 +22,7 @@ import { downloadPrivateFile, isSlackHost, lookupBotApp, postChatMessage } from
 import { botInboxProblems } from "./bot-inbox.js";
 import { loadConfig } from "./config.js";
 import { resolveSecret } from "./secrets.js";
-import { SeenStore, DeadLetterStore, InboundReceiptStore } from "./state-store.js";
+import { SeenStore, DeadLetterStore, InboundReceiptStore, slackMicros } from "./state-store.js";
 import { makeQueuePorts } from "./queue-access.js";
 import { SlackOutboundDriver, OUTBOUND_OP } from "./outbound-driver.js";
 import { abortableSleep, subsystemSlackDeliver } from "./slack-delivery.js";
@@ -32,12 +32,14 @@ import { ThreadSeatMap, formatPostedStamp } from "./thread-seat-map.js";
 import { makeThreadRouteResolver } from "./thread-routing.js";
 import { resolveInboundChannelDestination, resolveOutboundChannel, unsupportedChannelMapFields } from "./channel-map.js";
 import { resolveRigRepresentative } from "../../queue-owner.js";
+import { recoveryTag } from "../../queue-recovery.js";
 import { getSelfHostId } from "../../hosts/fanout-contract.js";
 import { envelopeChannel, forwardChannelProblems, makeEnvelopeForwarder } from "./forwarding.js";
 import { startSocketInbound } from "./socket-inbound.js";
-import { loadHumanRegistry, resolveSlackHandle } from "../human-registry.js";
+import { HUMAN_ALERT_TAG, loadHumanRegistry, resolveSlackHandle } from "../human-registry.js";
 import { hasLiveHumanGate, isBlockerLive } from "../../queue-repository.js";
 import { formatReplyToChoice, REPLY_TO_CHOICE_ACTOR, REPLY_TO_CHAIN_LIMIT } from "../../reply-to-choice.js";
+import { isHumanSeatSession } from "../../human-route-enforcer.js";
 import { ownerNotificationLevelAtLeast } from "../../queue-transition-log.js";
 // OPR.0.5.6.1 — the delivery rules engine: ONE decision per message replaces
 // the two dial-reads (the S14 default-decision stub). The legacy dial path
@@ -45,21 +47,50 @@ import { ownerNotificationLevelAtLeast } from "../../queue-transition-log.js";
 // registered human (no prefs -> no engine input).
 import { decideDelivery, resolveAvailability, isEscalationClass, formatDeliveryTermination, DELIVERY_TERMINATION_PREFIX, } from "../delivery-rules-engine.js";
 import { armDeliveryDeferral } from "../../policies/delivery-deferral.js";
+import { confirmReleaseAtPost, holdForQuiet } from "../../policies/quiet-release.js";
+import { quietHoldFor } from "../human-quiet-windows.js";
 import { WatchdogJobsRepository } from "../../watchdog-jobs-repository.js";
 const SECRET_BOT = "SLACK_BOT_TOKEN";
 const SECRET_APP = "SLACK_APP_TOKEN";
 /** Compose an inbound reply with Mission Control's existing human-park resolver.
  * A replay after the durable resolve but before inbound seen-mark is absorbed by
  * the typed transition, so the waiting owner is resumed exactly once. */
-export function makeHumanReplyResolver(queueRepo, contract) {
+export function makeHumanReplyResolver(queueRepo, contract, home) {
     return async (input) => {
-        if (queueRepo.getById(input.qitemId)?.humanIntent === "update")
+        const source = queueRepo.getById(input.qitemId);
+        if (source?.humanIntent === "update")
             return "not-applicable";
         if (!contract)
             return "not-applicable";
+        const uncertainDecision = `${input.decision}\n\n---\nOpenRig timing context (Slack reply ${JSON.stringify([input.actorSession, input.messageTs ?? null])}): This reply resumed the question, but its ordering against the posted question could not be confirmed. Resuming is not approval; read the person's words in context.`;
+        // An acknowledgement retry must not resolve again. Match this reply's durable
+        // context, not an older episode's generic resolved marker.
+        if (slackMicros(input.messageTs) !== null && queueRepo.transitionLog.listForQitem(input.qitemId)
+            .some((transition) => transition.ownerNotificationKind === "human-decision-resolved" && transition.transitionNote === uncertainDecision)) {
+            return "resolved-uncertain";
+        }
+        let uncertain = false;
+        if (source?.state === "blocked" && isHumanSeatSession(source.blockedOn)) {
+            const episode = queueRepo.transitionLog.listForQitem(input.qitemId)
+                .filter((transition) => transition.ownerNotificationKind === "human-required").at(-1);
+            if (!episode)
+                return "not-applicable";
+            const key = `${input.qitemId}:${episode.transitionId}`;
+            const receipt = queueRepo.transitionLog.getOwnerNotificationReceipt(input.qitemId, key);
+            // A final receipt attests delivery even when reconciliation lost its timestamp.
+            // Without one, ONLY a unique exact current-episode primary proves anything.
+            const primary = !receipt && home ? pendingPrimaryReceipt(home, input.qitemId, key) : null;
+            if (!receipt && !primary)
+                return "not-applicable";
+            const posted = slackMicros(receipt?.messageTs ?? primary?.messageTs);
+            const replied = slackMicros(input.messageTs);
+            if (posted !== null && replied !== null && replied <= posted)
+                return "not-applicable";
+            uncertain = Boolean(receipt?.digest) || posted === null || replied === null;
+        }
         try {
-            await contract.act({ verb: "resolve", ...input });
-            return "resolved";
+            await contract.act({ verb: "resolve", ...input, decision: uncertain ? uncertainDecision : input.decision });
+            return uncertain ? "resolved-uncertain" : "resolved";
         }
         catch (error) {
             if (error.code !== "qitem_not_leg1_parked")
@@ -77,6 +108,28 @@ export function makeHumanReplyResolver(queueRepo, contract) {
         }
     };
 }
+/** Read positive multipart evidence without changing final receipt/ack ownership. */
+function pendingPrimaryReceipt(home, qitemId, notificationKey) {
+    const pending = new DispatchBuffer(home).pending().filter((decision) => {
+        const p = decision.payload;
+        return decision.op === OUTBOUND_OP && p?.qitemId === qitemId
+            && p.notificationKey === notificationKey && p.ownerNotificationKind === "human-required";
+    });
+    if (pending.length !== 1)
+        return null;
+    const prefix = `${pending[0].decisionId}::primary-receipt::`;
+    const records = [...new SeenStore(path.join(stateDir(home), "slack-attempted-decisions.jsonl")).load()]
+        .filter((id) => id.startsWith(prefix));
+    if (records.length !== 1)
+        return null;
+    try {
+        const receipt = JSON.parse(Buffer.from(records[0].slice(prefix.length), "base64url").toString("utf8"));
+        return slackMicros(receipt?.messageTs) !== null ? { messageTs: receipt.messageTs } : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * OPR.0.5.6.2 — the inbound file port: Slack `url_private` → authenticated
  * download → workspace-local media file → LOCAL path for the reply row.
@@ -144,19 +197,17 @@ function stateDir(home) {
     return path.join(home, "state");
 }
 /** The status fields for the retry pass's durable custody. Counts RECORDS across the
- *  inbound-event and click dead-letter files — the event file also carries reactions,
+ *  inbound-event, click and relay dead-letter files — the event file also carries reactions,
  *  and a message that left more than one record is counted once per record, so the
  *  retry pass owns exactly these records. When any file cannot be read the count is
  *  `null`, not 0: a number (or a zero) beside an unknown state still reads as "nothing
  *  stuck" to a consumer that only looks at the count, so the state and the reason tell
- *  the truth and the number says it does not know. Absent when inbound is not configured
- *  (no stores), keeping an inert connector silent. */
+ *  the truth and the number says it does not know. An inert connector reports the same
+ *  retained records without starting retries. */
 function deadLetterBacklogFields(dead, deadActions, deadForwards) {
-    if (!dead || !deadActions)
-        return {};
     let records = 0;
     let reason;
-    for (const store of [dead, deadActions, ...(deadForwards ? [deadForwards] : [])]) {
+    for (const store of [dead, deadActions, deadForwards]) {
         const result = store.readResult();
         if (result.ok)
             records += result.entries.length;
@@ -180,6 +231,11 @@ export function buildSlackGatewayWire(opts) {
     const app = resolveSecret(SECRET_APP, { envFile });
     const outboundReady = cfg.enabled && bot !== null && cfg.channel !== null;
     const inboundReady = cfg.enabled && app !== null;
+    const inboundRouting = { fallback: "local", destination: cfg.inboundDestination };
+    const dead = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-deadletter.jsonl"));
+    const deadActions = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-action-deadletter.jsonl"));
+    // Retained relays belong to their original host, even after forwarding configuration changes.
+    const deadForwards = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-forward-deadletter.jsonl"));
     if (!outboundReady && !inboundReady) {
         const missing = !cfg.enabled ? "connector disabled (rig slack enable)" : !bot ? "SLACK_BOT_TOKEN unresolved" : "channel unconfigured";
         log(`slack delivery not configured (${missing}) — wire is inert; dispatches would be refused honestly`);
@@ -189,7 +245,7 @@ export function buildSlackGatewayWire(opts) {
             deliver: async () => ({ ok: false, class: "slack-not-configured", detail: missing }),
             log,
         });
-        return { ...inert, status: () => ({ platform: "slack", configurationDigest: channelStateDigest(cfg), outboundReady: false, inboundReady: false, recovery: { state: "unavailable", reason: "inbound-not-configured" }, inbound: { state: "not-configured" } }) };
+        return { ...inert, status: () => ({ platform: "slack", configurationDigest: channelStateDigest(cfg), outboundReady: false, inboundReady: false, inboundRouting, recovery: { state: "unavailable", reason: "inbound-not-configured" }, inbound: { state: "not-configured" }, ...deadLetterBacklogFields(dead, deadActions, deadForwards) }) };
     }
     const registrySurface = opts.registry ?? { loadHumanRegistry, resolveSlackHandle };
     const ports = makeQueuePorts(opts.queueRepo, {
@@ -211,6 +267,7 @@ export function buildSlackGatewayWire(opts) {
         return decideDelivery({
             level: p.ownerNotificationLevel ?? null,
             escalation: p.humanIntent !== "update" && isEscalationClass(p.tags),
+            alerted: p.humanIntent !== "update" && (p.tags ?? []).includes(HUMAN_ALERT_TAG),
             human: {
                 entityId: human.entityId,
                 deliveryClass: human.prefs.deliveryClass,
@@ -220,6 +277,7 @@ export function buildSlackGatewayWire(opts) {
                 minimumLevelThatPosts: cfg.minimumLevelThatPosts,
                 minimumLevelThatInterrupts: cfg.minimumLevelThatInterrupts,
             },
+            quiet: quietHoldFor(opts.queueRepo.db, human.entityId, new Date()),
         });
     };
     const outboundSeen = new SeenStore(path.join(stateDir(opts.home), "slack-outbound-seen.jsonl"));
@@ -239,13 +297,17 @@ export function buildSlackGatewayWire(opts) {
     // sees it. Tell the seat that asked, once: the notice's id derives from the ask's, so a replay
     // returns the same row instead of a second one.
     // A retry that can't post the rest of an ask some of which may already be in Slack says so.
-    const notifySourceUndeliverable = (p, detail, partlyPosted = false) => {
+    const notifySourceUndeliverable = (p, detail, partlyPosted = false, invalidBlocks = false) => {
         const seat = p.sourceSession;
         if (!p.qitemId || !seat)
             return;
         const human = p.destinationSession ?? "the person";
+        // A prior episode's notice must not hide this explicit Slack rejection.
+        const noticeId = invalidBlocks
+            ? `${p.notificationKey ?? p.qitemId}-invalid-blocks-undeliverable`
+            : `${p.qitemId}-undeliverable`;
         opts.queueRepo.create({
-            qitemId: `${p.qitemId}-undeliverable`,
+            qitemId: noticeId,
             sourceSession: seat,
             destinationSession: seat,
             summary: `Not delivered to ${human}: ${p.summary ?? p.qitemId}`,
@@ -256,22 +318,29 @@ export function buildSlackGatewayWire(opts) {
                 "",
                 `Reason: ${detail}`,
                 "",
-                partlyPosted
-                    ? "Check the thread in Slack and send what's missing as a new ask. The original row stays open until you close it."
-                    : "Shorten it and send it as a new ask. The original row stays open until you close it.",
+                invalidBlocks
+                    ? "Slack rejected the message blocks. OpenRig will not retry this payload. Check its evidence links and message content, then send a corrected ask as a new queue item. The original row remains undelivered; close it when you have handled it."
+                    : partlyPosted
+                        ? "Check the thread in Slack and send what's missing as a new ask. The original row stays open until you close it."
+                        : "Shorten it and send it as a new ask. The original row stays open until you close it.",
             ].join("\n"),
             evidenceRef: `rig queue show ${p.qitemId}`,
-            tags: ["slack-undeliverable"],
+            tags: ["slack-undeliverable", recoveryTag(p.qitemId)],
         }).catch((e) => log(`undeliverable notice FAILED for ${p.qitemId}: ${e.message}`));
     };
     const recordTransportFailed = (p, failureClass, detail, partlyPosted) => {
         if (!p.qitemId)
             return;
-        if (failureClass === "human-message-unrenderable")
-            notifySourceUndeliverable(p, detail, partlyPosted);
+        if (failureClass === "human-message-unrenderable" || failureClass === "slack-invalid-blocks") {
+            notifySourceUndeliverable(p, detail, partlyPosted, failureClass === "slack-invalid-blocks");
+        }
         const key = p.notificationKey ?? p.qitemId;
-        const alreadyRecorded = opts.queueRepo.transitionLog.listForQitem(p.qitemId).some((transition) => transition.transitionNote?.startsWith("slack-owner-notification-transport-failed ")
-            && transition.transitionNote.split(/\s+/).includes(`notification_key=${key}`));
+        const previousFailure = opts.queueRepo.transitionLog.listForQitem(p.qitemId).filter((transition) => transition.transitionNote?.startsWith("slack-owner-notification-transport-failed ")
+            && transition.transitionNote.split(/\s+/).includes(`notification_key=${key}`)).at(-1);
+        // A corrected attempt can fail transiently after a permanent rejection, and a
+        // transient failure can be followed by a definite rejection. Preserve both changes.
+        const alreadyRecorded = previousFailure &&
+            previousFailure.transitionNote.includes("class=slack-invalid-blocks ") === (failureClass === "slack-invalid-blocks");
         if (alreadyRecorded)
             return;
         opts.queueRepo.update({
@@ -372,6 +441,8 @@ export function buildSlackGatewayWire(opts) {
     const runCtl = new AbortController();
     // Late-bound so deliver can release the driver's in-flight guard (built after the wire).
     let releaseRef = () => { };
+    // The wire's own dispatcher, bound once the wire exists: a delivery step that must mint a new durable decision.
+    let selfDispatch = () => ({ ok: false, error: "wire not built" });
     const deliver = outboundReady
         ? subsystemSlackDeliver({
             botToken: bot,
@@ -436,8 +507,17 @@ export function buildSlackGatewayWire(opts) {
                 // registered humans; the dial pair remains only for the null degrade.
                 if (p.deliveryDigestPost)
                     return undefined; // notify-class aggregate, never a mention
+                if (p.quietRelease)
+                    return undefined; // releasing a quiet hold: posted, never a mention
                 const fire = p.deliveryDeferralFire === true;
-                const decision = fire ? null : decideForPayload(p);
+                // At post time the decision was just made; if it can't be re-read now (quiet hours unreadable), no mention.
+                let decision;
+                try {
+                    decision = fire ? null : decideForPayload(p);
+                }
+                catch {
+                    return undefined;
+                }
                 const eligible = fire
                     ? true // the deferred interrupt mentions at fire time — that IS the deferral's promise
                     : decision
@@ -588,6 +668,81 @@ export function buildSlackGatewayWire(opts) {
         outboundSeen.mark(key, "dropped-row-not-active");
         releaseRef(key);
     };
+    // An earlier attempt of this exact decision may be in Slack with its response lost. A gate that would hold, trim, defer
+    // or ack it (instead of handing it to delivery) resolves that first, through the reconciler. Found goes to delivery
+    // unchanged, which records receipts for what was posted and never posts it again in another form. A post confirmed
+    // partly in Slack (its first part found, the post not complete) also goes to delivery: only its own remaining parts
+    // post, under its own part ids and in its own thread and channel, even during quiet hours. Never-attempted and absent
+    // attempts, and a scan that couldn't finish or be read, haven't started: they go on through the gate like any other post. Where the gate posts,
+    // delivery reconciles (keeping its at-least-once post for an unfinished scan); where it holds, the release posts it
+    // after quiet. A decision that goes straight to delivery skips this.
+    const resolveEarlierAttempt = async (decision) => {
+        const landing = "landing" in deliver ? await deliver.landing(decision) : "unattempted";
+        if (landing === "found" || landing === "partial")
+            return deliver(decision);
+        return null;
+    };
+    // A digest post was decided before it was posted. By the time it is delivered (a buffered post replayed after a
+    // restart, say), some members may already be owned elsewhere: posted (a receipt), or held for quiet hours (a hold
+    // note, so the window's release job posts it). And if the recipient's quiet hours began in between, its routine
+    // members are held now rather than posted into them; a member that has since become an escalation still posts.
+    // The original decision only ever carries its original payload: if what's left differs, it goes out as a new
+    // decision with its own id and receipts (enqueued before the original is acked), so a post under one id never has two
+    // contents, and receipts bind to exactly the members posted under it. An earlier attempt of the original that may
+    // have landed is resolved by the reconciler first. If the quiet state can't be read, nothing posts (see the catch).
+    const deliverDigestPost = async (decision, p) => {
+        const settled = await resolveEarlierAttempt(decision);
+        if (settled)
+            return settled;
+        const recipient = (p.destinationSession ?? "").split("@")[0] ?? "";
+        let quiet;
+        try {
+            quiet = recipient ? quietHoldFor(opts.queueRepo.db, recipient, new Date()) : null;
+        }
+        catch (error) {
+            // An attempted digest (it may be in Slack) is retained: acked, the next flush would mint the ask again from the
+            // row as it is now. A never-attempted one is acked: its members keep their digest notes, so the next flush
+            // selects them again. A store check only: no Slack read on a failure path.
+            if ("attempted" in deliver && deliver.attempted(decision)) {
+                log(`digest post ${decision.decisionId} retained: quiet hours couldn't be read: ${error.message}`);
+                return { ok: false, class: "quiet-unreadable", detail: error.message };
+            }
+            log(`digest post ${decision.decisionId} not posted: quiet hours couldn't be read: ${error.message}`);
+            return { ok: true };
+        }
+        const aggregate = p.memberReceipts;
+        const members = aggregate ?? (p.qitemId ? [{ qitemId: p.qitemId, notificationKey: p.notificationKey ?? p.qitemId }] : []);
+        const owned = (m) => opts.queueRepo.transitionLog.hasOwnerNotificationReceipt(m.qitemId, m.notificationKey)
+            || opts.queueRepo.listTransitions(m.qitemId).some((t) => (t.transitionNote ?? "").startsWith("delivery-decision: quiet-hold ")
+                && (t.transitionNote ?? "").split(/\s+/).includes(`notification_key=${m.notificationKey}`));
+        const jobsRepo = new WatchdogJobsRepository(opts.queueRepo.db);
+        const escalation = (m) => {
+            const row = opts.queueRepo.getById(m.qitemId);
+            return !!row && row.humanIntent !== "update" && isEscalationClass(row.tags);
+        };
+        const kept = members.filter((m) => {
+            if (owned(m))
+                return false;
+            if (!quiet)
+                return true;
+            if (escalation(m))
+                return true;
+            holdForQuiet({ queueRepo: opts.queueRepo, jobsRepo, qitemId: m.qitemId, entityId: recipient, hold: { ...quiet, notificationKey: m.notificationKey } });
+            return false;
+        });
+        if (kept.length === members.length)
+            return deliver(decision); // unchanged: the original, as it is
+        if (kept.length === 0 || !aggregate)
+            return { ok: true }; // nothing left to post under it
+        const keptIds = new Set(kept.map((m) => m.qitemId));
+        const body = String(p.body ?? "").split("\n").filter((line) => [...keptIds].some((id) => line.endsWith(`[${id}]`))).join("\n");
+        const summary = String(p.summary ?? "").replace(/— \d+ item\(s\)/, `— ${kept.length} item(s)`);
+        const keptId = `${decision.decisionId}:kept:${createHash("sha256").update(kept.map((m) => m.notificationKey).sort().join(",")).digest("hex").slice(0, 16)}`;
+        // Durable first: the new decision is in the buffer before the original is acked (returning ok). A crash between the
+        // two replays the original, which computes the same kept set and id; the dispatcher accepts the pending id once.
+        const res = selfDispatch(keptId, { ...p, memberReceipts: kept, body, summary });
+        return res.ok ? { ok: true } : { ok: false, class: "kept-dispatch-refused", detail: res.error };
+    };
     const engineDeliver = async (decision) => {
         const p = (decision.payload ?? {});
         // The decision-resolved notice is written at closure, so a closed row is its normal case.
@@ -606,7 +761,36 @@ export function buildSlackGatewayWire(opts) {
         // A digest post is an already-decided aggregate — never re-consulted
         // (member decisions were recorded at containment; receipts land in onPosted).
         if (p.deliveryDigestPost)
-            return deliver(decision);
+            return deliverDigestPost(decision, p);
+        // Releasing an ask held for quiet hours: it posts as itself, never re-consulted (that would digest C and D again). A
+        // receipt means it already did. A release can wait in the buffer (and be replayed after a restart), so it is
+        // re-checked here, at post time, against the recipient's quiet, the row and the posting threshold as they are now.
+        if (p.quietRelease) {
+            const key = p.notificationKey ?? p.qitemId;
+            if (p.qitemId && opts.queueRepo.transitionLog.hasOwnerNotificationReceipt(p.qitemId, key)) {
+                releaseRef(p.qitemId);
+                return { ok: true };
+            }
+            const settled = await resolveEarlierAttempt(decision);
+            if (settled)
+                return settled;
+            const verdict = !p.qitemId ? "post" : await confirmReleaseAtPost({
+                queueRepo: opts.queueRepo,
+                jobsRepo: new WatchdogJobsRepository(opts.queueRepo.db),
+                home: opts.home,
+                registry: { loadHumanRegistry: () => registrySurface.loadHumanRegistry(opts.home) },
+                entityId: (p.destinationSession ?? "").split("@")[0] ?? "",
+                qitemId: p.qitemId,
+                notificationKey: key,
+            });
+            if (verdict === "post")
+                return deliver(decision);
+            // Declined (the row says why) or couldn't be checked (nothing written): either way nothing posts now. Acking is
+            // safe because the window's release job owns redelivery until the ask has a receipt or a disposition; keeping it
+            // buffered would wait for a restart and block the job's own re-dispatch of the same decision id.
+            releaseRef(p.qitemId);
+            return { ok: true };
+        }
         if (p.deliveryDeferralFire) {
             const fireKey = p.notificationKey ?? p.qitemId;
             if (p.qitemId && opts.queueRepo.transitionLog.hasOwnerNotificationReceipt(p.qitemId, fireKey)) {
@@ -615,7 +799,40 @@ export function buildSlackGatewayWire(opts) {
             }
             return deliver(decision);
         }
-        const ruled = p.qitemId ? decideForPayload(p) : null;
+        // A post confirmed partly in Slack finishes without consulting quiet hours, so it is resolved before the decision
+        // (which reads them). Only a started multipart post is checked here, from the stores first, so an ordinary
+        // retry isn't scanned twice; any other attempted decision is resolved at the gate below.
+        const started = "unfinished" in deliver && deliver.unfinished(decision);
+        if (started) {
+            const settled = await resolveEarlierAttempt(decision);
+            if (settled)
+                return settled;
+        }
+        let ruled;
+        try {
+            ruled = p.qitemId ? decideForPayload(p) : null;
+        }
+        catch (error) {
+            // An attempted decision (it may be partly or wholly in Slack) is retained and nothing posts: acking it would drop
+            // the post's missing parts and let the sweep offer the ask again under a new id, posting it from the start. Its
+            // replay decides again once the quiet state reads. A store check only: no Slack read on a failure path.
+            if ("attempted" in deliver && deliver.attempted(decision)) {
+                log(`delivery decision for attempted ${decision.decisionId} couldn't be made; retained: ${error.message}`);
+                return { ok: false, class: "quiet-unreadable", detail: error.message };
+            }
+            // The decision couldn't be made (for example the person's quiet hours couldn't be read): post nothing and record
+            // nothing. Releasing the in-flight guard lets the outbound sweep offer this still-unseen ask again and decide afresh.
+            log(`delivery decision for ${p.qitemId} deferred: ${error.message}`);
+            // Released by notification key, the guard's own key: nothing marks this ask seen, so the next sweep must see it.
+            releaseRef(p.notificationKey ?? p.qitemId);
+            return { ok: true };
+        }
+        if (!started && ruled && (ruled.outcome === "log" || (ruled.outcome === "hold" && ruled.quietHold)
+            || ruled.outcome === "digest" || ruled.deferMinutes !== undefined)) {
+            const settled = await resolveEarlierAttempt(decision);
+            if (settled)
+                return settled;
+        }
         if (ruled) {
             recordTerminationOnce(p, ruled);
             const episodeKey = p.notificationKey ?? p.qitemId;
@@ -624,6 +841,19 @@ export function buildSlackGatewayWire(opts) {
                 releaseRef(p.qitemId);
                 return { ok: true };
             }
+            if (ruled.outcome === "hold" && ruled.quietHold) {
+                // Quiet hours: recorded on the row with its window, occurrence and revision; the release job posts it later.
+                holdForQuiet({
+                    queueRepo: opts.queueRepo,
+                    jobsRepo: new WatchdogJobsRepository(opts.queueRepo.db),
+                    qitemId: p.qitemId,
+                    entityId: (p.destinationSession ?? "").split("@")[0] ?? "unknown",
+                    hold: { ...ruled.quietHold, notificationKey: episodeKey },
+                });
+                outboundSeen.mark(episodeKey, "quiet-held");
+                releaseRef(p.qitemId);
+                return { ok: true };
+            }
             if (ruled.outcome === "digest") {
                 // R1 B-4: the MESSAGE-TIME decision is recorded on the row (with the
                 // live dials already applied by the consult above); the flush consumes
@@ -669,6 +899,7 @@ export function buildSlackGatewayWire(opts) {
         deliver: outboundReady ? engineDeliver : deliver,
         log,
     });
+    selfDispatch = (decisionId, payload) => wire.dispatcher.dispatch(OUTBOUND_OP, String(payload.destinationSession ?? ""), payload, { decisionId });
     // Services are CONSTRUCTED here but started only via startServices() (post-bind, index.ts):
     // composing a daemon must never dial Slack or start pollers — the createDaemon-in-tests
     // hermeticity rule, same as every monitor in the supervision tree.
@@ -704,16 +935,6 @@ export function buildSlackGatewayWire(opts) {
         });
         stops.push(() => driver.stop());
     }
-    // Hoisted out of the inbound block so status() can report the durable backlog.
-    // Both files are the retry pass's custody: the event dead-letter
-    // (`slack-inbound-deadletter.jsonl`) and the click dead-letter
-    // (`slack-inbound-action-deadletter.jsonl`), which retryActionDeadLetters owns.
-    // An inert wire omits the fields rather than inventing a count for a connector
-    // that is not running.
-    let dead;
-    let deadActions;
-    // The hub's relays that failed, kept with their host (forwarding.ts).
-    let deadForwards;
     // A machine of a shared app receives its channels' events from the hub (routes/gateway.ts).
     let acceptForwarded;
     let relayedReceived = 0; // envelopes a hub relayed here since this wire was built
@@ -727,7 +948,6 @@ export function buildSlackGatewayWire(opts) {
     let router;
     if (inboundReady || outboundReady) {
         const inboundSeen = new SeenStore(path.join(stateDir(opts.home), "slack-inbound-seen.jsonl"));
-        dead = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-deadletter.jsonl"));
         const registry = registrySurface;
         const built = (router = new InboundRouter({
             queue: ports,
@@ -764,7 +984,7 @@ export function buildSlackGatewayWire(opts) {
             // a failed hand-back is retried with the event dead-letters, and each click is confirmed
             // in the decision's thread (a bot post, so inbound never ingests it).
             recordHumanAnswer: (input) => opts.queueRepo.recordHumanAnswer(input),
-            actionDeadLetter: (deadActions = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-action-deadletter.jsonl"))),
+            actionDeadLetter: deadActions,
             ...(bot ? {
                 // A stopped run posts nothing, and its rate-limit wait ends with the run: after a restart the click's
                 // redelivery belongs to the new router, which must not race a stale retry from this one.
@@ -799,13 +1019,11 @@ export function buildSlackGatewayWire(opts) {
                     lookupBot: (botId) => lookupBotApp(bot, botId, opts.fetchImpl),
                 },
             } : {}),
-            ...(forwarding ? {
-                forward: {
-                    hostFor: (channel) => cfg.forwardChannels.find((f) => f.channel === channel)?.host ?? null,
-                    send: makeEnvelopeForwarder({ fetchImpl: opts.fetchImpl, loadRegistry: opts.loadHostRegistry }),
-                },
-                forwardDeadLetter: (deadForwards = new DeadLetterStore(path.join(stateDir(opts.home), "slack-inbound-forward-deadletter.jsonl"))),
-            } : {}),
+            forward: {
+                hostFor: (channel) => forwarding ? cfg.forwardChannels.find((f) => f.channel === channel)?.host ?? null : null,
+                send: makeEnvelopeForwarder({ fetchImpl: opts.fetchImpl, loadRegistry: opts.loadHostRegistry }),
+            },
+            forwardDeadLetter: deadForwards,
             log,
         }));
         if (cfg.botInbox && (!bot || botInboxProblems(cfg).length > 0)) {
@@ -886,14 +1104,11 @@ export function buildSlackGatewayWire(opts) {
             platform: "slack", configurationDigest: channelStateDigest(cfg),
             outboundReady,
             inboundReady,
+            inboundRouting,
             recovery: recovery?.status() ?? { state: "unavailable", reason: "inbound-not-configured" },
             inbound: inboundHandle?.status() ?? { state: inboundReady ? "not-started" : "not-configured", generation: 0, reconnects: 0 },
-            // The retry pass's durable custody, counted from both dead-letter files:
-            // inbound events plus click answers. Records, not distinct messages — a
-            // message that left more than one record is counted once per record, which
-            // is why the field is named for records. Present iff inbound is configured;
-            // an unreadable file reports state "unknown" with a reason instead of a
-            // false zero.
+            // Durable inbound custody across event, click and relay files, even when inert.
+            // Count records, not distinct messages; unreadable storage is null/unknown.
             ...deadLetterBacklogFields(dead, deadActions, deadForwards),
             // A machine with no connection of its own can take events a hub relays here; whether a hub does is
             // the hub's configuration, so this says only that it can, and how many have arrived.