@stratusagent/channel-slack 0.11.2 → 0.11.4

package/dist/index.js

@@ -2,8 +2,13 @@ import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { latestTurnReply, SENDER_TRUST_METADATA_KEY, } from '@stratusagent/core';
+import { filePathsOf, latestTurnReply, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, } from '@stratusagent/core';
 import { channelSessionKey, } from '@stratusagent/channels';
+/**
+ * The longest display name the model is shown. Slack caps profile names
+ * well under this; the bound is for a profile that is not a name.
+ */
+const MAX_DISPLAY_NAME_LENGTH = 80;
 const SLACK_MAX_MESSAGE_CHARS = 4000;
 const DEFAULT_EDIT_INTERVAL_MS = 1000;
 const DEDUPE_CAPACITY = 2000;
@@ -21,7 +26,7 @@ const THREAD_ADDRESSEE_CAPACITY = 2000;
  */
 const COLD_VERDICT_CAPACITY = 256;
 /**
- * How many changes of hands one thread remembers.
+ * How many claims on one thread it remembers.
  *
  * A message older than all of them asks the sessions instead, which answer
  * for the thread as it stands rather than as it stood — so a reply that old
@@ -29,13 +34,14 @@ const COLD_VERDICT_CAPACITY = 256;
  * bounding this, and something has to bound it: the alternative is a list
  * that grows with a conversation for the life of the daemon.
  *
- * Eight is chosen to sit far past the case it covers. This only has to
+ * A claim is a change of hands or a reply that landed (see
+ * `rememberAddressee`), so a busy thread writes one or two per message.
+ * Thirty-two sits far past the case the record covers: it only has to
  * span the lag between two sockets, which is messages inside one delivery
- * window; crossing it needs a single thread to change hands eight times —
- * eight mentions, alternating between agents — while one socket stays
- * behind for all of them.
+ * window, and crossing it needs that many replies in one thread while a
+ * socket stays behind for all of them.
  */
-const THREAD_HANDOVER_DEPTH = 8;
+const THREAD_HANDOVER_DEPTH = 32;
 /**
  * How many files an unrendered turn may queue for its outcome. Nothing
  * drains that queue until the outcome arrives, so a session whose outcome
@@ -45,6 +51,26 @@ const THREAD_HANDOVER_DEPTH = 8;
  */
 const MAX_UNRENDERED_FILES = 20;
 const PLACEHOLDER_TEXT = '…';
+/**
+ * How long an agent that judges stays attentive after it last answered a
+ * message that addressed it: this many messages, or this many minutes,
+ * whichever ends first. Judging costs
+ * a model call per message, and two people talking for an hour is a
+ * hundred of them for one "no" — so attention decays the way a person's
+ * does. Outside the window a message is overheard for free, and a mention
+ * re-arms it, which is what a mention has always meant.
+ */
+const ATTENTION_MESSAGES = 8;
+const ATTENTION_MS = 15 * 60 * 1000;
+/**
+ * A 5 MB image over a slow link is seconds, not minutes. Past this the
+ * downloads are abandoned and the turn runs with the attachments named as
+ * unreadable, rather than the thread waiting on them. One deadline for
+ * the whole message, not one per file: a message may carry ten, and ten
+ * stalls in a row would hold the thread — and `stop()` — ten times as
+ * long.
+ */
+const DEFAULT_FILE_DOWNLOAD_TIMEOUT_MS = 30_000;
 /** What a turn that produced no text puts in its message, wherever it is posted from. */
 const NO_REPLY_TEXT = '(no reply)';
 // Lazy (and CJS-interoperable) so tests with injected fakes never load the
@@ -58,6 +84,77 @@ const defaultWebClient = (botToken) => {
     const { WebClient } = requireModule('@slack/web-api');
     return new WebClient(botToken);
 };
+/**
+ * The default fetcher over a `fetch`. Exported as a factory so the bounded
+ * read can be tested against a fake `fetch` with a body that never ends;
+ * the adapter uses it over the global one.
+ *
+ * The body is read a chunk at a time and abandoned the moment it passes
+ * `maxBytes`: `arrayBuffer()` would buffer the whole response first, and
+ * the size the adapter checked before asking came from Slack's metadata,
+ * which an oversized response is under no obligation to match. A
+ * `content-length` that already says too much is refused before a byte is
+ * read.
+ */
+export const createSlackFileFetcher = (fetchImpl) => async (url, botToken, signal, maxBytes) => {
+    const response = await fetchImpl(url, { headers: { authorization: `Bearer ${botToken}` }, signal });
+    const contentType = response.headers.get('content-type');
+    const typed = contentType !== null ? { contentType } : {};
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        await response.body?.cancel();
+        return { status: response.status, ...typed, body: Buffer.alloc(0), truncated: true };
+    }
+    if (response.body === null) {
+        return { status: response.status, ...typed, body: Buffer.alloc(0) };
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let received = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            received += value.byteLength;
+            if (received > maxBytes) {
+                await reader.cancel();
+                return { status: response.status, ...typed, body: Buffer.alloc(0), truncated: true };
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return { status: response.status, ...typed, body: Buffer.concat(chunks) };
+};
+const defaultFetchFile = (url, botToken, signal, maxBytes) => createSlackFileFetcher(fetch)(url, botToken, signal, maxBytes);
+/**
+ * A clock reading as a Slack timestamp, for a file whose upload answered
+ * with no share ts. Slack timestamps are epoch seconds with six decimals,
+ * so the clock's reading compares with them as long as the two agree to
+ * within the gap between one message and the next.
+ */
+const slackTs = (ms) => (ms / 1000).toFixed(6);
+/**
+ * Where an upload sits in the thread: the ts of the message it became in
+ * `channel`, from the shares the upload answers with. Undefined when the
+ * answer carries none.
+ */
+const uploadPlace = (result, channel) => {
+    for (const file of result.files ?? []) {
+        for (const scope of [file.shares?.public, file.shares?.private]) {
+            for (const share of scope?.[channel] ?? []) {
+                if (share.ts !== undefined) {
+                    return share.ts;
+                }
+            }
+        }
+    }
+    return undefined;
+};
 /**
  * Renders one turn's reply into Slack with the placeholder-then-edit
  * pattern: post `…` immediately, fold streaming deltas and tool status
@@ -103,17 +200,45 @@ class ReplyRenderer {
      */
     generation = 0;
     finalized = false;
+    /** Whether any upload of this turn's landed — a file is something said, placeholder or not. */
+    uploaded = false;
+    /** Whether any edit of this turn's landed — a streamed line Slack took is something said, whatever the final edit's fate. */
+    edited = false;
+    /**
+     * Where in the thread this turn's words stand: the ts of the lowest
+     * message Slack took them in — the placeholder an edit landed in, or an
+     * overflow chunk posted — and, separately, where a file of its landed
+     * (the share ts the upload answers with, or the clock — see `queueUpload`).
+     * What the thread rule orders by: an untagged reply is for whoever's
+     * reply sits lowest in the thread, the one a reader sees last, which is
+     * not the turn that finished last — a placeholder posted at intake and
+     * filled in slowly sits above a reply posted while it was being written.
+     */
+    textAt;
+    uploadedAt;
+    /**
+     * A turn nobody asked for: the placeholder is not posted at intake but
+     * on the first TEXT the turn streams, and a turn that ends having said
+     * nothing leaves the thread untouched — no placeholder, no `(no reply)`,
+     * no edit. Text and not a tool line, though the spec sketched either: a
+     * placeholder posted for a tool the turn ran on the way to deciding it
+     * had nothing to add is a message the decision cannot take back.
+     */
+    lazy;
     web;
     channel;
     threadTs;
     editIntervalMs;
     warn;
-    constructor(web, channel, threadTs, editIntervalMs, warn) {
+    now;
+    constructor(web, channel, threadTs, editIntervalMs, warn, options = {}) {
         this.web = web;
         this.channel = channel;
         this.threadTs = threadTs;
         this.editIntervalMs = editIntervalMs;
         this.warn = warn;
+        this.lazy = options.lazy ?? false;
+        this.now = options.now ?? Date.now;
     }
     /**
      * The gateway has begun this renderer's turn. Whatever was streamed here
@@ -235,12 +360,27 @@ class ReplyRenderer {
             // failure instead of an unhandled stream error.
             .then(async () => {
             const data = await readFile(filePath);
-            await this.web.files.uploadV2({
+            // Where the file will sit is Slack's to say — the ts of the
+            // message it becomes, in the shares the upload answers with. When
+            // the answer carries none, the clock stands in, read BEFORE the
+            // call: the file is posted somewhere inside it, and a colleague's
+            // placeholder posted while the answer was on its way back sits
+            // below the file. Read after, the file would be placed below that
+            // placeholder and take a thread the colleague holds; read before,
+            // the error runs the other way, toward the colleague — the fault
+            // an @ fixes.
+            const before = slackTs(this.now());
+            const result = await this.web.files.uploadV2({
                 channel_id: this.channel,
                 file: data,
                 filename: path.basename(filePath),
                 ...(this.threadTs ? { thread_ts: this.threadTs } : {}),
             });
+            this.uploaded = true;
+            const placed = uploadPlace(result, this.channel) ?? before;
+            if (this.uploadedAt === undefined || placed > this.uploadedAt) {
+                this.uploadedAt = placed;
+            }
         })
             .catch((error) => this.warn(`files.uploadV2 failed for ${filePath}: ${error instanceof Error ? error.message : String(error)}`));
     }
@@ -261,11 +401,24 @@ class ReplyRenderer {
             if (this.finalized) {
                 return;
             }
+            // Nothing said yet: a lazy turn has no placeholder to edit, and a
+            // tool line alone does not earn one (see `lazy`). Nor does text
+            // streamed here before this turn began — a recovery's, routed to
+            // the head of the queue — which `beginTurn` drops.
+            if (this.lazy && !this.ref && (!this.turnStarted || this.buffer.trim().length === 0)) {
+                return;
+            }
             this.lastEditAt = Date.now();
-            this.queueEdit(messageText(this.currentText()));
+            void this.queueEdit(messageText(this.currentText()));
         }, delay);
         this.pendingEdit.unref?.();
     }
+    /**
+     * Queue one edit of the placeholder. Resolves to whether Slack took it —
+     * false when there was no placeholder to edit, the text belonged to a
+     * turn handed over meanwhile, or the update was refused — which is what
+     * lets `finalize` say whether the reply was ever published.
+     */
     queueEdit(text) {
         const generation = this.generation;
         // The handover as it stands when the edit is queued, not when it runs:
@@ -273,21 +426,48 @@ class ReplyRenderer {
         // edit that then waited for that handover would be a cycle nothing
         // could break.
         const handover = this.handover;
-        this.editChain = this.editChain
+        const edit = this.editChain
             .then(() => handover)
-            .then(() => {
+            .then(async () => {
+            if (this.lazy && !this.ref && this.turnStarted && generation === this.generation) {
+                // The first text of a turn nobody asked for: this is where its
+                // placeholder is posted, and the edit below fills it. A post
+                // that fails leaves the turn without one, and its reply is a
+                // message of its own when it comes (see `finalize`).
+                try {
+                    await this.open();
+                }
+                catch (error) {
+                    this.warn(`could not open a placeholder: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
             // Read after the handover, not before: the placeholder may have
             // changed hands while this edit waited its turn — and the text
             // may belong to the turn that was handed over.
             const ref = this.ref;
-            return ref && generation === this.generation
-                ? this.web.chat.update({ channel: ref.channel, ts: ref.ts, text })
-                : undefined;
+            if (!ref || generation !== this.generation) {
+                return false;
+            }
+            await this.web.chat.update({ channel: ref.channel, ts: ref.ts, text });
+            this.edited = true;
+            this.placeText(ref.ts);
+            return true;
         })
-            .then(() => undefined)
-            .catch((error) => this.warn(`chat.update failed: ${error instanceof Error ? error.message : String(error)}`));
+            .catch((error) => {
+            this.warn(`chat.update failed: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        });
+        this.editChain = edit.then(() => undefined);
+        return edit;
     }
-    /** Replace the placeholder with the final reply, splitting if oversized. */
+    /**
+     * Replace the placeholder with the final reply, splitting if oversized.
+     * Resolves to a `ReplyOutcome`. A reply Slack refused any part of was
+     * not said in the thread as written, and nothing downstream may treat it
+     * as if it had been: a colleague hearing the whole of a reply the thread
+     * saw half of is reasoning from text nobody read. But a file beside a
+     * refused sentence is still the last thing said, for the thread rule.
+     */
     async finalize(reply) {
         await this.handover;
         this.finalized = true;
@@ -295,31 +475,121 @@ class ReplyRenderer {
             clearTimeout(this.pendingEdit);
             this.pendingEdit = undefined;
         }
+        // Let the edits already queued land before deciding anything from
+        // `ref`: a lazy turn's first text may be opening its placeholder in
+        // that chain right now, and reading `ref` ahead of it would post the
+        // reply as a message of its own beside a placeholder that then fills
+        // with stale partial text.
+        await this.editChain;
+        if (this.lazy && reply.trim().length === 0 && (!this.ref || await this.retract())) {
+            // Silence, decided: nothing was posted and nothing is — or what was
+            // posted has been taken back. The uploads still land: a file the
+            // turn produced is not nothing to say, and a turn that posted one
+            // has spoken, for the thread rule.
+            await this.editChain;
+            await this.uploadChain;
+            return this.outcome(false, this.uploaded);
+        }
         const text = reply.trim().length > 0 ? reply : NO_REPLY_TEXT;
         const chunks = messageChunks(text);
         // No placeholder — a handover could not open a fresh one — and the
         // reply is a message of its own rather than nothing at all.
         const rest = this.ref ? chunks.slice(1) : chunks;
-        if (this.ref) {
-            this.queueEdit(chunks[0] ?? NO_REPLY_TEXT);
-        }
+        const edited = this.ref ? this.queueEdit(chunks[0] ?? NO_REPLY_TEXT) : Promise.resolve(false);
+        let landed = await edited;
+        let published = this.ref ? landed : true;
         await this.editChain;
         await this.uploadChain;
         for (const chunk of rest) {
             try {
-                await this.web.chat.postMessage({
+                const posted = await this.web.chat.postMessage({
                     channel: this.channel,
                     text: chunk,
                     ...(this.threadTs ? { thread_ts: this.threadTs } : {}),
                 });
+                landed = true;
+                this.placeText(posted.ts);
             }
             catch (error) {
+                published = false;
                 this.warn(`chat.postMessage failed: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
+        // A placeholder that opened for a turn nobody asked for and never
+        // took a word of it — every edit refused — is a `…` standing alone
+        // under the agent's name, the interruption a judged turn exists to
+        // avoid, so it is taken back like an abandoned attempt's. One Slack
+        // will not let go stands, and a message the thread can see is the
+        // last thing said whatever it says.
+        let stranded = false;
+        if (this.lazy && this.ref !== undefined && !landed && !this.edited) {
+            stranded = !(await this.retract());
+            if (stranded) {
+                this.placeText(this.ref?.ts);
+            }
+        }
+        return this.outcome(published, landed || this.edited || this.uploaded || stranded);
+    }
+    placeText(ts) {
+        if (ts !== undefined && (this.textAt === undefined || ts > this.textAt)) {
+            this.textAt = ts;
+        }
+    }
+    outcome(published, spoke) {
+        const spokeAt = [this.textAt, this.uploadedAt]
+            .filter((ts) => ts !== undefined)
+            .sort()
+            .at(-1);
+        return { published, spoke, ...(spoke && spokeAt !== undefined ? { spokeAt } : {}) };
+    }
+    /**
+     * Take back the placeholder a turn nobody asked for opened and then had
+     * nothing to put in: the line that opened it was an attempt the provider
+     * abandoned (`reset` — a fallback after a mid-stream failure), and the
+     * attempt that stood answered with nothing. Editing that placeholder to
+     * `(no reply)` would leave exactly the interruption a silent turn exists
+     * to avoid, and would count as speaking. Resolves to whether Slack let
+     * the message go: a delete refused leaves the abandoned line standing,
+     * and the turn finishes the ordinary way, since a message the thread
+     * can still see is the last thing said whatever it says.
+     */
+    async retract() {
+        const ref = this.ref;
+        if (!ref) {
+            return true;
+        }
+        try {
+            await this.web.chat.delete({ channel: ref.channel, ts: ref.ts });
+        }
+        catch (error) {
+            this.warn(`chat.delete failed: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        this.ref = undefined;
+        // The line the placeholder took is gone with it: nothing of this
+        // turn's stands in the thread unless a file does.
+        this.edited = false;
+        this.textAt = undefined;
+        return true;
     }
     async fail(message) {
-        await this.finalize(`Something went wrong: ${message}`);
+        // The same wait `finalize` takes, for the same reason: a lazy turn's
+        // first text may be opening its placeholder right now, and a failure
+        // read as "before saying anything" would leave that placeholder saying
+        // `(no reply)` where the failure belongs.
+        await this.editChain;
+        // "Before saying anything" is no placeholder AND nothing buffered: a
+        // first text whose zero-delay edit has not fired yet has still been
+        // said, and its failure is reported — as a message of its own, since
+        // there is no placeholder to edit — rather than swallowed with it.
+        if (this.lazy && !this.ref && this.buffer.trim().length === 0) {
+            // A turn nobody asked for that failed before saying anything: the
+            // failure is in the daemon log, and an error note would be the
+            // interruption the turn existed to avoid.
+            this.warn(`a turn nobody asked for failed before saying anything: ${message}`);
+            return this.finalize('');
+        }
+        return this.finalize(`Something went wrong: ${message}`);
     }
     /**
      * Claim the placeholder for a turn that finished ahead of this one — the
@@ -357,7 +627,7 @@ class ReplyRenderer {
         return {
             take: async (chunks, between) => {
                 if (spent) {
-                    return false;
+                    return 'untaken';
                 }
                 try {
                     await previous;
@@ -380,7 +650,7 @@ class ReplyRenderer {
         const [first, ...rest] = chunks;
         const given = this.ref;
         if (first === undefined || this.finalized || !given) {
-            return false;
+            return 'untaken';
         }
         await drained;
         try {
@@ -390,8 +660,9 @@ class ReplyRenderer {
             // Not handed over: the placeholder is still this turn's, and the
             // caller posts the reply as messages of its own.
             this.warn(`chat.update failed: ${error instanceof Error ? error.message : String(error)}`);
-            return false;
+            return 'untaken';
         }
+        let complete = true;
         // The placeholder is the earlier turn's now, and the reference goes
         // before the reopen, so a reopen that fails cannot leave this turn
         // writing over the reply just handed over. (What was streamed into
@@ -407,6 +678,7 @@ class ReplyRenderer {
                 });
             }
             catch (error) {
+                complete = false;
                 this.warn(`chat.postMessage failed: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
@@ -425,32 +697,13 @@ class ReplyRenderer {
             // message of its own when it comes (see `finalize`).
             this.warn(`could not reopen a placeholder: ${error instanceof Error ? error.message : String(error)}`);
         }
-        return true;
+        return complete ? 'complete' : 'partial';
     }
 }
-// The adapter-level convention for file-bearing tool results: an ok result
-// whose object output carries `file: string` or `files: string[]` refers to
-// local paths the channel should deliver as attachments.
-const collectFilePaths = (result) => {
-    const output = result.output;
-    if (typeof output !== 'object' || output === null || Array.isArray(output)) {
-        return [];
-    }
-    const paths = [];
-    const single = output.file;
-    if (typeof single === 'string' && single.length > 0) {
-        paths.push(single);
-    }
-    const many = output.files;
-    if (Array.isArray(many)) {
-        for (const entry of many) {
-            if (typeof entry === 'string' && entry.length > 0) {
-                paths.push(entry);
-            }
-        }
-    }
-    return paths;
-};
+// The file-bearing result convention is the kernel's (`filePathsOf`), so
+// the gateway counts a turn that produced a file as having spoken by the
+// same rule this adapter uploads it by.
+const collectFilePaths = (result) => filePathsOf(result);
 // A hard cut must never land between the halves of a UTF-16 surrogate
 // pair — an emoji on the boundary would reach Slack as two replacement
 // characters. Backs the index off the pair's high half when it would.
@@ -688,6 +941,57 @@ const convertHeadings = (text, code) => {
         return startsInside(closer, within) ? heading : `*${heading}*`;
     });
 };
+/**
+ * A stand-in for one code segment while the prose around it is rewritten.
+ *
+ * Emphasis was converted one prose fragment at a time until this existed,
+ * and a fragment is not a run: inline code cuts one in two, so the `**`
+ * opening a bold run and the `**` closing it land in different fragments
+ * whenever a snippet sits between them, and neither half ever finds its
+ * partner. ``**the `fs.read` tool**`` reached a reader as four literal
+ * asterisks around a snippet, and so did every link, italic and
+ * strikethrough written the same way. It is the defect #142 found in
+ * headings, in the rule right next to it, and it has the same answer:
+ * rewrite the whole text, with code held out of the rewrite rather than
+ * cut out of the text.
+ *
+ * A mask names its segment rather than merely standing in for one, because
+ * a rewrite is allowed to move it: the link rule writes its two captures
+ * back in the other order, so `[use `a`](https://host/`b`)` hands the URL's
+ * snippet to the label and the label's to the URL, and a snippet that
+ * arrives somewhere else is the same defect as one that is rewritten. Named,
+ * it comes back to the place holding its own name. No rewrite can damage
+ * the name itself: none of the delimiters they look for appear in it, and
+ * every rule copies what it matched through to its replacement.
+ *
+ * A mask also carries whether its segment holds whitespace, because three
+ * rules refuse to cross it — a destination is `[^()\s]+`, a label and an
+ * emphasis run stop at a newline — and a name alone has none to stop them.
+ * `[label](https://host/`a b`)` is not a destination and was never meant to
+ * convert; masked shapelessly it did, and came back rearranged into a link
+ * Slack cannot render. Only whitespace is carried, and only ever so a rule
+ * refuses: a `*` in a snippet must still not act like one. Both ends of a
+ * mask stay the mask character, so a run that has to hug its content still
+ * hugs it — a segment opens and closes with a backtick, so that is not a
+ * lie about its ends.
+ *
+ * The character is chosen against the text rather than fixed, because a
+ * reply that already contained it would have a snippet spliced in where
+ * the writer's own character stood — the one thing this conversion must
+ * never do. A reply holding all 6400 of the private-use characters has no
+ * mask to be given and is left in Markdown instead: prose that reads as it
+ * was written is a cosmetic loss, and a snippet spliced somewhere else is
+ * not.
+ */
+const maskFor = (text) => {
+    for (let point = 0xe000; point <= 0xf8ff; point += 1) {
+        const candidate = String.fromCharCode(point);
+        if (!text.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return undefined;
+};
 /**
  * Markdown as a model writes it, in the spelling Slack actually renders.
  *
@@ -703,28 +1007,49 @@ const convertHeadings = (text, code) => {
  * add ways to be wrong and fix nothing.
  */
 const toSlackMrkdwn = (text) => {
-    // Where each code span ends up in the converted text, which is not where
-    // it started: the prose before it changes length as it is rewritten.
-    const code = [];
+    const mask = maskFor(text);
+    if (mask === undefined) {
+        return text;
+    }
     const segments = proseAndCode(text);
-    let converted = '';
-    segments.forEach((segment, index) => {
+    const code = [];
+    let masked = '';
+    for (const [index, segment] of segments.entries()) {
         if (index % 2 === 1) {
-            // A code segment that ends the text is the unterminated fence: every
-            // closed run is followed by a prose slice, even an empty one. It has
-            // no end to be past, so nothing may be appended after it either —
-            // recording the end as it looks would say a marker placed at the
-            // text's end was safely outside.
-            const ends = index === segments.length - 1
-                ? Number.POSITIVE_INFINITY
-                : converted.length + segment.length;
-            code.push([converted.length, ends]);
-            converted += segment;
-            return;
+            const shape = /\n/.test(segment) ? '\n' : /\s/.test(segment) ? ' ' : '';
+            masked += `${mask}${code.length}${shape}${mask}`;
+            code.push(segment);
+            continue;
         }
-        converted += convertInline(segment);
-    });
-    return convertHeadings(converted, code);
+        masked += segment;
+    }
+    // A code segment that ends the text is the unterminated fence: every
+    // closed run is followed by a prose slice, even an empty one, so only an
+    // unclosed one leaves the segments ending on a code index. Named, not
+    // last: a rewrite may have moved it, and it is the segment that ran to
+    // the text's end when it was cut, wherever it now sits.
+    const unterminated = segments.length % 2 === 0 ? code.length - 1 : -1;
+    // Where each code segment ends up in the converted text, which is not
+    // where it started: the prose around it changes length as it is
+    // rewritten, and the masks are the only record of where it went. Split
+    // on the names, so the pieces alternate prose and the name of the
+    // segment that follows it.
+    const pieces = convertInline(masked).split(new RegExp(`${mask}(\\d+)[ \\n]?${mask}`));
+    const spans = [];
+    let converted = pieces[0] ?? '';
+    for (let piece = 1; piece < pieces.length; piece += 2) {
+        const named = Number(pieces[piece]);
+        const segment = code[named] ?? '';
+        // The unterminated fence has no end to be past, so nothing may be
+        // appended after it either — recording the end as it looks would say a
+        // marker placed at the text's end was safely outside.
+        const ends = named === unterminated
+            ? Number.POSITIVE_INFINITY
+            : converted.length + segment.length;
+        spans.push([converted.length, ends]);
+        converted += `${segment}${pieces[piece + 1] ?? ''}`;
+    }
+    return convertHeadings(converted, spans);
 };
 const splitForSlack = (text) => {
     if (text.length <= SLACK_MAX_MESSAGE_CHARS) {
@@ -775,23 +1100,17 @@ const APPROVAL_ACTIONS = {
  * agent does unattended, and an approver should see the scope they granted
  * in the record of granting it.
  *
- * It states the **floor**, because that is the only thing true in every
- * case. A call judged by a scope — a shell command, a browser site —
- * persists that scope in the agent's whitelist and normally keeps it
- * across restarts, but not when the daemon cannot write the file (a
- * hand-edit that will not parse) or was built without one, and by then
- * this message has already been sent. Nothing on the bus distinguishes
- * any of it: the policy returns a boolean, and `tool.approval-resolved`
- * carries the answer that was submitted, not how long the grant lasts.
- *
- * So it says what is always so and no more. Claiming only the session
- * lifetime, as this line first did, tells an approver a durable grant
- * revokes itself; claiming the restart, as it then did, promises one the
- * daemon may have failed to save. The daemon's log has the exact line.
+ * What it lasts rode in on the request as `always` (see `AlwaysMeans`),
+ * so the line names the grant that was made rather than hedging between
+ * lifetimes — which this message once had to, when nothing on the bus said
+ * whether an "always" was the session's or the file's. One thing the
+ * request still cannot promise is the disk write: the daemon does not
+ * write over a whitelist it could not read, and by then this message has
+ * been sent. The daemon's log has that line; `stratus grants <agent>` has
+ * the list.
  */
 const OUTCOME_TEXT = {
     'decided:once': 'Allowed once',
-    'decided:always': 'Allowed and remembered — for this session at least',
     'decided:deny': 'Denied',
     'timeout:deny': 'Expired without an answer — denied',
     // Covers both endings that reach here: the turn was aborted, and the
@@ -799,6 +1118,49 @@ const OUTCOME_TEXT = {
     'cancelled:deny': 'Cancelled before anyone answered — denied',
     'undeliverable:deny': 'Could not be put to an approver — denied',
 };
+/**
+ * What **Always allow** did, by the grant the request said it would make.
+ * A tool grant names the agent because that is its scope — not this
+ * thread, not the session — and says how to take it back, since a grant
+ * an approver cannot find later is a ratchet.
+ */
+const alwaysOutcome = (always, agentName, agentId) => {
+    switch (always) {
+        case 'scope':
+            return 'Allowed, and this command\'s scope now runs without asking — until revoked';
+        case 'origin':
+            return 'Allowed, and this site is now acted on without asking — until revoked';
+        case 'tool':
+            return `Allowed, and granted to ${escapeSlackText(agentName)} until revoked (stratus grants ${escapeSlackText(agentId)})`;
+        case 'session':
+            return 'Allowed for the rest of this session';
+        default:
+            // An `always` submitted through `POST /approvals` against a request
+            // this daemon did not label — an older daemon's event, say. The
+            // request did not say, so neither does this.
+            return 'Allowed and remembered — for this session at least';
+    }
+};
+/**
+ * What **Always allow** would do, said beside the button. The lifetime is
+ * the half of the question the button widens, and it differs by tool: a
+ * standing grant to the agent is a larger thing to hand out than a session,
+ * and an approver should know which they are clicking.
+ */
+const alwaysOffer = (always, agentName) => {
+    switch (always) {
+        case 'tool':
+            return `*Always allow* grants this tool to ${escapeSlackText(agentName)} until an operator revokes it.`;
+        case 'session':
+            return '*Always allow* stops this tool asking again for the rest of this session.';
+        case 'scope':
+            return '*Always allow* remembers this command\'s scope for this agent, until revoked.';
+        case 'origin':
+            return '*Always allow* remembers this site for this agent, until revoked.';
+        default:
+            return undefined;
+    }
+};
 /** Comfortably inside Slack's 3000-character section limit. */
 const APPROVAL_INPUT_LIMIT = 1400;
 /** One line in a notification; the blocks carry the readable version. */
@@ -824,10 +1186,11 @@ const MAX_LISTED_ATTACHMENTS = 5;
  * What a message's attachments are called, for a turn that cannot open
  * them. Without this the agent is handed "here's the log" and no log, and
  * answers as though it had read something — the note is what lets it say
- * the true thing instead.
+ * the true thing instead. Images the model was actually shown are not
+ * listed here: they travel on the dispatch, name included.
  */
 const attachmentNote = (files) => {
-    if (!files || files.length === 0) {
+    if (files.length === 0) {
         return '';
     }
     const names = files.slice(0, MAX_LISTED_ATTACHMENTS).map((file) => file.name ?? file.title ?? 'an unnamed file');
@@ -835,6 +1198,150 @@ const attachmentNote = (files) => {
     const listed = rest > 0 ? `${names.join(', ')}, and ${rest} more` : names.join(', ');
     return `\n[Attached: ${listed}. Attachment contents cannot be read here — say so rather than guessing at them.]`;
 };
+/** What Slack calls a file, in a warning about it. */
+const fileLabel = (file) => file.name ?? file.title ?? file.id ?? 'an unnamed file';
+/**
+ * A message's attachments, sorted into the images the model will be shown
+ * and everything else. An image is fetched only when Slack's own metadata
+ * says it is one the API accepts and small enough to send; that keeps a
+ * 40 MB PNG from being downloaded just to be dropped, and a PDF from being
+ * fetched at all. What comes back is checked as well: without `files:read`
+ * Slack serves a sign-in page with a 200, and sending that to the model as
+ * an image would fail the turn with an error naming nothing the person can
+ * fix — the warning here names the scope instead, and the file falls back
+ * to the by-name note like any other attachment the turn cannot open.
+ */
+const readImageAttachments = async (files, botToken, fetchFile, timeoutMs, warn) => {
+    // Decided from the last file back, the way the replay window is spent:
+    // when a message's images do not all fit, the ones kept are the ones it
+    // listed last, so intake and replay agree about which survive. Delivered
+    // in the message's own order, because that is how the person sees them.
+    const kept = new Map();
+    const dropped = new Set();
+    // The message's one deadline, shared by every download in it.
+    const deadline = AbortSignal.timeout(timeoutMs);
+    // Decoded bytes accepted so far. Checked against Slack's reported size
+    // before a download and the real length after it, because the message
+    // as a whole has a budget the per-image cap alone cannot keep.
+    let total = 0;
+    // Once an image that fits on its own does not fit what is left of the
+    // message's budget, nothing listed before it is taken either: the window
+    // is contiguous, as the replay window is, and a smaller older image must
+    // not slip in past a larger newer one that was left out.
+    let windowClosed = false;
+    // Why an image is being left out, or nothing when it fits. One place for
+    // both limits so the warning and the fallback cannot disagree.
+    const overLimit = (label, bytes) => {
+        if (bytes > IMAGE_ATTACHMENT_MAX_BYTES) {
+            return `slack: ${label} is ${bytes} bytes, over the ${IMAGE_ATTACHMENT_MAX_BYTES}-byte limit an image can be sent to the model at; the turn is told it cannot be read.`;
+        }
+        if (total + bytes > IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES) {
+            windowClosed = true;
+            return `slack: ${label} would take this message's images past the ${IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES} bytes one request can carry; the turn is told it cannot be read. Send it in a message of its own.`;
+        }
+        return undefined;
+    };
+    for (let position = files.length - 1; position >= 0; position -= 1) {
+        const file = files[position];
+        const url = file.url_private_download ?? file.url_private;
+        if (!isImageAttachmentMediaType(file.mimetype) || url === undefined) {
+            dropped.add(position);
+            continue;
+        }
+        if (windowClosed) {
+            warn(`slack: ${fileLabel(file)} was not taken: an image listed after it already filled what this message's images can carry; the turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        const tooBig = file.size === undefined ? undefined : overLimit(fileLabel(file), file.size);
+        if (tooBig !== undefined) {
+            warn(tooBig);
+            dropped.add(position);
+            continue;
+        }
+        // What this image may weigh: the per-image cap, or what is left of the
+        // message's budget if that is less. Handed to the fetcher so an
+        // oversized response is abandoned mid-body rather than buffered whole.
+        const maxBytes = Math.min(IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES - total);
+        if (deadline.aborted) {
+            warn(`slack: ${fileLabel(file)} was not downloaded: this message's downloads had already taken longer than ${timeoutMs}ms. The turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        let download;
+        try {
+            download = await fetchFile(url, botToken, deadline, maxBytes);
+        }
+        catch (error) {
+            const reason = error instanceof Error && error.name === 'TimeoutError'
+                ? `this message's downloads took longer than ${timeoutMs}ms`
+                : (error instanceof Error ? error.message : String(error));
+            warn(`slack: could not download ${fileLabel(file)}: ${reason}. The turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        // Refused on what Slack sends when it will not serve the file — a
+        // non-200, or a 200 whose body is a page — rather than on the label of
+        // what it does serve: a download URL may be typed as the image or as
+        // a plain octet stream, and either is the bytes Slack said it was.
+        const contentType = download.contentType?.split(';')[0]?.trim().toLowerCase() ?? '';
+        if (download.status !== 200 || contentType.startsWith('text/')) {
+            warn(`slack: ${fileLabel(file)} came back as ${contentType || 'no content type'} (HTTP ${download.status}) rather than an image. This is what a bot token without the files:read scope gets — add the scope under OAuth & Permissions and reinstall the app.`);
+            dropped.add(position);
+            continue;
+        }
+        if (download.truncated === true) {
+            // Cut off at what was left of the message's budget, rather than at
+            // the per-image cap: the same overflow the size check closes the
+            // window on, learned from the bytes instead of the metadata.
+            if (maxBytes < IMAGE_ATTACHMENT_MAX_BYTES) {
+                windowClosed = true;
+            }
+            warn(`slack: ${fileLabel(file)} is larger than the ${maxBytes} bytes this message could still take for an image; the download was abandoned and the turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        const stillTooBig = overLimit(fileLabel(file), download.body.length);
+        if (stillTooBig !== undefined) {
+            warn(stillTooBig);
+            dropped.add(position);
+            continue;
+        }
+        // Read from the bytes, not from Slack's metadata: an image the model
+        // API refuses fails the turn it arrives on and, once stored, every turn
+        // after — so what is stored has to be what the API takes.
+        const dimensions = imageDimensions(download.body, file.mimetype);
+        if (dimensions === undefined) {
+            warn(`slack: ${fileLabel(file)} is not a complete ${file.mimetype} — its header or trailer is missing; the turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        if (dimensions.width > IMAGE_ATTACHMENT_MAX_DIMENSION || dimensions.height > IMAGE_ATTACHMENT_MAX_DIMENSION) {
+            warn(`slack: ${fileLabel(file)} is ${dimensions.width}×${dimensions.height}, over the ${IMAGE_ATTACHMENT_MAX_DIMENSION}-pixel side the model can take; the turn is told it cannot be read.`);
+            dropped.add(position);
+            continue;
+        }
+        total += download.body.length;
+        const name = file.name ?? file.title;
+        kept.set(position, {
+            mediaType: file.mimetype,
+            data: download.body.toString('base64'),
+            ...(name !== undefined ? { name } : {}),
+        });
+    }
+    const images = [];
+    const unread = [];
+    files.forEach((file, position) => {
+        const image = kept.get(position);
+        if (image !== undefined) {
+            images.push(image);
+        }
+        else if (dropped.has(position)) {
+            unread.push(file);
+        }
+    });
+    return { images, unread };
+};
 /**
  * Whether `text` addresses a bot user by name. Slack writes a mention as
  * `<@U123>` markup whoever typed it, so this is the same question for an
@@ -877,8 +1384,9 @@ const renderInvocation = (input) => {
         truncated,
     };
 };
-const approvalBlocks = (agentName, toolName, risk, requestId, input, origin, oneShot) => {
+const approvalBlocks = (agentName, toolName, risk, requestId, input, origin, oneShot, always) => {
     const invocation = renderInvocation(input);
+    const offer = oneShot ? undefined : alwaysOffer(always, agentName);
     return [
         {
             type: 'section',
@@ -905,7 +1413,8 @@ const approvalBlocks = (agentName, toolName, risk, requestId, input, origin, one
                     elements: [{ type: 'mrkdwn', text: ':warning: Arguments shown are truncated — the full call is longer than this.' }],
                 }]
             : []),
-        // Why there is no second button, when there is no second button.
+        // Why there is no second button, when there is no second button — and
+        // what the second button does, when there is one.
         ...(oneShot
             ? [{
                     type: 'context',
@@ -914,7 +1423,9 @@ const approvalBlocks = (agentName, toolName, risk, requestId, input, origin, one
                             text: ':lock: An approval covers this call only — nothing about it is remembered.',
                         }],
                 }]
-            : []),
+            : offer !== undefined
+                ? [{ type: 'context', elements: [{ type: 'mrkdwn', text: offer }] }]
+                : []),
         {
             type: 'actions',
             // The request id rides on every button rather than in the message
@@ -962,6 +1473,9 @@ export const createSlackChannelAdapter = (options) => {
     const editIntervalMs = options.editIntervalMs ?? DEFAULT_EDIT_INTERVAL_MS;
     const createSocket = options.createSocketClient ?? defaultSocketClient;
     const createWeb = options.createWebClient ?? defaultWebClient;
+    const fetchFile = options.fetchFile ?? defaultFetchFile;
+    const fileDownloadTimeoutMs = options.fileDownloadTimeoutMs ?? DEFAULT_FILE_DOWNLOAD_TIMEOUT_MS;
+    const now = options.now ?? Date.now;
     const connections = [];
     // Every agent this adapter was asked to carry, connected or not — the
     // difference between "mine and broken" and "not mine".
@@ -1121,6 +1635,39 @@ export const createSlackChannelAdapter = (options) => {
             return userId;
         }
     };
+    /**
+     * A display name as the model may read it: one line, bounded. It is text
+     * its owner typed into their profile, and it lands in the speaker
+     * position of a user turn (`Name: text`) or as `@Name` inside one — where
+     * a newline, or a name long enough to be a paragraph, would let its owner
+     * speak in a place nobody vouched for. Escaped rather than dropped, the
+     * way memory entries are, so a strange name still reads as strange.
+     */
+    const boundedDisplayName = (name) => {
+        // Code points, not UTF-16 units: an emoji is one character of a name,
+        // and a cut inside a surrogate pair is a malformed speaker.
+        const characters = Array.from(escapeControlCharacters(name).trim());
+        return characters.length > MAX_DISPLAY_NAME_LENGTH
+            ? `${characters.slice(0, MAX_DISPLAY_NAME_LENGTH - 1).join('')}…`
+            : characters.join('');
+    };
+    /**
+     * Who is speaking, as the model reads it. A principal's profile is
+     * trusted the way their messages are, so it is their display name. With
+     * a principals list in force everyone else is their stable id, as a
+     * mention of them already is: named, not quoted. With no list at all
+     * there is nobody to prefer, so every author keeps their name — the turn
+     * is labelled `unknown` either way. "No list" is the key being absent:
+     * an explicit empty list is how an agent is excluded from a shared one,
+     * and it means nobody is preferred, not that nobody has been named.
+     */
+    const authorFor = async (connection, userId) => {
+        const principals = connection.config.principals;
+        if (principals !== undefined && !principals.includes(userId)) {
+            return userId;
+        }
+        return boundedDisplayName(await displayNameFor(connection, userId));
+    };
     // Mentions arrive as <@U123> markup; the model should read names.
     /**
      * `<@U…>` mentions become `@name` — for principals only. A display name
@@ -1139,12 +1686,218 @@ export const createSlackChannelAdapter = (options) => {
         let result = withoutBot;
         for (const id of new Set(ids)) {
             if (principals.has(id)) {
-                result = result.replaceAll(`<@${id}>`, `@${await displayNameFor(connection, id)}`);
+                result = result.replaceAll(`<@${id}>`, `@${boundedDisplayName(await displayNameFor(connection, id))}`);
             }
         }
         return result.trim();
     };
     const connectionFor = (agentId) => connections.find((candidate) => candidate.config.agentId === agentId);
+    /** An agent's configuration, whether or not its socket came up. */
+    const agentConfigFor = (agentId) => options.agents.find((candidate) => candidate.agentId === agentId);
+    /**
+     * Whether an agent takes a message from this sender at all — judged on
+     * its configuration, not on a live connection: an agent whose socket
+     * failed to start is still recognizable in a mention, and its door is
+     * still its own. An agent this adapter was never configured for is
+     * nobody's to refuse here, so it admits — the answer from before the
+     * door existed.
+     */
+    const admitsSender = (config, userId) => config === undefined
+        || config.admit !== 'principals'
+        || (config.principals ?? []).includes(userId);
+    /**
+     * How an agent listens, from its soul — read per message, so a roster
+     * reload takes effect on the next one. `thread` when the soul says
+     * nothing, which is every soul written before there was a choice.
+     */
+    const listensOf = (agentId) => gatewayRef?.agents().find((agent) => agent.id === agentId)?.listens ?? 'thread';
+    /**
+     * Whether an agent that judges is still paying attention to a thread:
+     * within `ATTENTION_MESSAGES` and `ATTENTION_MS` of when it last
+     * answered a message that addressed it, both read from the session
+     * rather than remembered here, so a restart forgets nothing. Anchored
+     * to an addressed answer and not to any reply: a reply the agent chose
+     * to give on a turn nobody asked for does not re-arm it, or a talkative
+     * judge would keep itself attentive for good and cost a call per message
+     * — the self-extension the spec declined. An agent never addressed in
+     * the thread is not attentive: it was mentioned and its first turn has
+     * not answered yet, or answered with nothing. Measured against the
+     * message's own timestamp, not the clock, so a delivery that ran late is
+     * judged as of when it was said. Bounded below as well as above: a
+     * message said before the answer the window starts from is outside it
+     * — Slack redelivers events a restarted daemon has no memory of, and a
+     * negative age would otherwise pass the minutes bound however old the
+     * message, on a turn the agent's answer already came after.
+     */
+    const attentive = (routing, messageTs, pending) => {
+        if (routing.lastAnsweredAt === undefined) {
+            return false;
+        }
+        const answeredAt = Date.parse(routing.lastAnsweredAt);
+        const saidAt = Number(messageTs) * 1000;
+        if (Number.isNaN(answeredAt) || Number.isNaN(saidAt) || saidAt < answeredAt || saidAt - answeredAt > ATTENTION_MS) {
+            return false;
+        }
+        return (routing.heardSinceAnswered ?? 0) + pending < ATTENTION_MESSAGES;
+    };
+    /**
+     * Messages this adapter has dispatched to a session that the session
+     * does not hold yet. The store counts what it holds, and a burst of
+     * messages typed inside one second would each read the same count and
+     * each be judged — the bound the window exists to give, blown by exactly
+     * the thread that needs it. The renderer queue already knows: a renderer
+     * is queued at dispatch and its turn starts (`turnStarted`) only once
+     * the runner has saved the message — the same moment the store's count
+     * takes it over — so the two never count one message twice.
+     */
+    const pendingFor = (sessionId) => (renderers.get(sessionId) ?? []).filter((renderer) => !renderer.turnStarted).length
+        + (pendingObserves.get(sessionId) ?? 0);
+    /**
+     * Overhears placed on the gateway's chain and not yet written, per
+     * session: the other kind of message the store does not hold yet. An
+     * observe queued behind a running turn is heard only when the turn ends,
+     * and a burst of messages to a colleague would otherwise count toward
+     * nothing until then. Counted from placement to settlement.
+     */
+    const pendingObserves = new Map();
+    const placeObserve = (sessionId, observed) => {
+        pendingObserves.set(sessionId, (pendingObserves.get(sessionId) ?? 0) + 1);
+        const release = () => {
+            const left = (pendingObserves.get(sessionId) ?? 1) - 1;
+            if (left > 0) {
+                pendingObserves.set(sessionId, left);
+            }
+            else {
+                pendingObserves.delete(sessionId);
+            }
+        };
+        void observed.then(release, release);
+        return observed;
+    };
+    /**
+     * Run `work` after everything already queued for this session's intake,
+     * and hold the next link until it settles. The link is claimed
+     * synchronously, so a message's place is fixed by when the adapter
+     * learned of it and not by how long its lookups take — see
+     * `handleInbound`, whose ordering this is.
+     */
+    const onIntakeChain = (sessionId, work) => {
+        const previous = intakeChains.get(sessionId) ?? Promise.resolve();
+        const link = previous.then(work);
+        const settled = link.then(() => undefined, () => undefined);
+        intakeChains.set(sessionId, settled);
+        void settled.then(() => {
+            if (intakeChains.get(sessionId) === settled) {
+                intakeChains.delete(sessionId);
+            }
+        });
+        return link;
+    };
+    /**
+     * What one agent REPLIED in a thread, heard by the thread's other agents.
+     *
+     * The other half of overhearing. What people say reaches an agent through
+     * its socket (`admit`), but a colleague's reply is a bot message the
+     * socket ignores on purpose, and its final text reaches Slack as a stream
+     * of edits rather than one event — so it is not an inbound path at all.
+     * The adapter that rendered the reply is the one thing that knows its
+     * final text, and it observes that into the session every other agent
+     * holds for the same thread, with no Slack event involved. Without this
+     * an agent that followed a thread knew the questions its colleague was
+     * asked and not the answers.
+     *
+     * Each hearer takes it on its own intake chain, claimed the moment the
+     * reply is final: a message typed while the reply was still streaming
+     * is already in that chain and is heard first, and one typed after the
+     * final edit cannot overtake it. The observe itself is placed there and
+     * not awaited inside the link — returned in a wrapper, since a promise
+     * returned from the link is one the chain adopts — for the reason
+     * `handleInbound` gives: a hearer with a long turn running must not hold
+     * its next message's place hostage to that turn.
+     *
+     * Only once it is SAID, in full. The reservation is taken when the reply
+     * is final, but the observe waits, inside the link, on `published` —
+     * whether Slack took every edit and post of it — and a reply Slack
+     * refused any part of is heard by nobody, since the thread did not see
+     * it as written and the hearer has no way to know which part. That holds
+     * the hearer's chain for the length of the final edit, which is the
+     * same network round trip a person's message holds it for.
+     *
+     * Two boundaries decide who hears it, and neither is "same workspace".
+     * Whether the hearer is in the THREAD is the gateway's answer on the
+     * session's chain, as for every overhear: an agent never invited here
+     * has no session under the key. Whether it is still in the CHANNEL is
+     * Slack's, asked per reply: a message a person types reaches an agent
+     * only through its own socket, so an app removed from a private channel
+     * simply stops hearing — but a reply is forwarded by this process, and
+     * would keep reaching an agent the operator took out of the room. That
+     * is the one path where membership has to be checked rather than
+     * assumed, and a lookup that fails leaves the agent not hearing, the
+     * direction a boundary should fail in.
+     *
+     * Sent under the speaker's own label rather than `user`: an agent's
+     * reply is at most its own word, and carries whatever its session has
+     * been exposed to — a restatement of a stranger's text is still the
+     * stranger's, which is exactly what `sessionWriteTrust` says.
+     *
+     * Only replies: a turn that said nothing posts `(no reply)`, which is
+     * nothing to hear, and a failed turn's error note is the failure's, not
+     * the agent's.
+     */
+    const overhearReply = async (speaker, channel, thread, reply, spoken, published) => {
+        const gateway = gatewayRef;
+        if (!gateway?.observe || reply.trim().length === 0) {
+            return;
+        }
+        const team = speaker.teamId;
+        const metadata = {
+            channel: 'slack',
+            team,
+            slackChannel: channel,
+            slackUser: speaker.botUserId,
+            slackThread: thread,
+            [SENDER_TRUST_METADATA_KEY]: sessionWriteTrust(spoken),
+        };
+        // In the reply's own workspace only, because a session key carries a
+        // team — the same reason `resolveFollowUpWinner` stays in-workspace.
+        const hearers = connections.filter((candidate) => candidate.teamId === team && candidate.config.agentId !== speaker.config.agentId);
+        await Promise.all(hearers.map(async (hearer) => {
+            const sessionId = channelSessionKey({
+                channel: 'slack',
+                agentId: hearer.config.agentId,
+                team,
+                conversation: channel,
+                thread,
+            });
+            try {
+                const { observed } = await onIntakeChain(sessionId, async () => {
+                    if (!(await published)) {
+                        return { observed: undefined };
+                    }
+                    let member;
+                    try {
+                        member = (await hearer.web.conversations.info({ channel })).channel?.is_member;
+                    }
+                    catch (error) {
+                        warn(`slack: could not tell whether ${hearer.config.agentId} is still in ${channel}, so it does not hear ${speaker.config.agentId}'s reply there: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    if (member !== true) {
+                        return { observed: undefined };
+                    }
+                    // Named the way a person's message names its speaker: whoever
+                    // spoke, by display name. A bot user's is the app's own, set by
+                    // whoever installed it.
+                    const author = await displayNameFor(hearer, speaker.botUserId);
+                    const observed = gateway.observe?.({ sessionId, agentId: hearer.config.agentId, message: `${author}: ${reply}`, metadata });
+                    return { observed: observed === undefined ? undefined : placeObserve(sessionId, observed) };
+                });
+                await observed;
+            }
+            catch (error) {
+                warn(`slack: ${hearer.config.agentId} could not overhear ${speaker.config.agentId}'s reply in ${channel}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }));
+    };
     /**
      * The addressable outbound seam — the channel contract's first real
      * `OutboundConnection` implementation. Validate-then-hand-over: every
@@ -1293,7 +2046,7 @@ export const createSlackChannelAdapter = (options) => {
                     + `${event.origin ? ` on ${event.origin}` : ''}`
                     + `${invocationSummary ? `: ${invocationSummary}` : ''}.`),
                 ...(thread ? { thread_ts: thread } : {}),
-                blocks: approvalBlocks(agentName, event.call.toolName, event.risk, event.requestId, event.call.input, event.origin, event.oneShot === true),
+                blocks: approvalBlocks(agentName, event.call.toolName, event.risk, event.requestId, event.call.input, event.origin, event.oneShot === true, event.always),
             });
             post = posted.ts
                 ? {
@@ -1305,6 +2058,8 @@ export const createSlackChannelAdapter = (options) => {
                     toolName: event.call.toolName,
                     risk: event.risk,
                     oneShot: event.oneShot === true,
+                    ...(event.always !== undefined ? { always: event.always } : {}),
+                    agentId: event.agentId,
                     approvers,
                 }
                 : undefined;
@@ -1409,8 +2164,17 @@ export const createSlackChannelAdapter = (options) => {
             ? post.risk === 'dangerous'
                 ? 'Allowed once — a dangerous tool is never remembered'
                 : 'Allowed once — nothing about this call could be remembered'
-            : OUTCOME_TEXT[`${event.reason}:${event.answer}`] ?? 'Resolved';
-        const by = event.actor ? ` by <@${event.actor}>` : '';
+            : event.reason === 'decided' && event.answer === 'always'
+                ? alwaysOutcome(post.always, post.agentName, post.agentId)
+                : OUTCOME_TEXT[`${event.reason}:${event.answer}`] ?? 'Resolved';
+        // A mention only for an actor this post knows as a Slack user — its
+        // approvers, which is the only set a click can come from. An approval
+        // decided through the control API arrives as `api:…` or `dashboard`,
+        // and `<@api:ops-bot>` is not a mention, it is a broken one; escaped
+        // plain text says who it was.
+        const by = event.actor
+            ? ` by ${post.approvers.has(event.actor) ? `<@${event.actor}>` : escapeSlackText(event.actor)}`
+            : '';
         const text = `*${escapeSlackText(post.agentName)}* — \`${escapeSlackText(post.toolName)}\` (${post.risk}): ${outcome}${by}.`;
         try {
             await post.connection.web.chat.update({
@@ -1445,9 +2209,13 @@ export const createSlackChannelAdapter = (options) => {
      * cost the rest of the answer.
      */
     const postAheadOf = async (behind, connection, channel, thread, chunks, between) => {
-        if (behind && await behind.take(chunks, between)) {
-            return;
+        const taken = behind ? await behind.take(chunks, between) : 'untaken';
+        if (taken !== 'untaken') {
+            return taken === 'complete';
         }
+        // Whether ALL of it landed, as `finalize` answers: a reply the thread
+        // saw part of is not one anybody else may be told the whole of.
+        let published = true;
         for (const chunk of chunks) {
             try {
                 await connection.web.chat.postMessage({
@@ -1457,12 +2225,14 @@ export const createSlackChannelAdapter = (options) => {
                 });
             }
             catch (error) {
+                published = false;
                 warn(`slack: could not post part of a turn's outcome: ${error instanceof Error ? error.message : String(error)}`);
             }
         }
         if (between) {
             await between();
         }
+        return published;
     };
     /**
      * The files an unrendered turn produced, taken off the session the moment
@@ -1519,6 +2289,26 @@ export const createSlackChannelAdapter = (options) => {
         }
         const channel = metadata.slackChannel;
         const thread = typeof metadata.slackThread === 'string' ? metadata.slackThread : undefined;
+        if (routing.unaddressed === true && routing.reply === undefined) {
+            // A turn nobody asked for that said nothing before it broke — the
+            // daemon died inside it, and the next start failed it with no
+            // renderer here to keep quiet for it. The same rule as the lazy
+            // renderer's: the failure is in the log, and the files it produced
+            // still land, since a file is not nothing to say.
+            //
+            // "Said nothing" as the session can tell it: no reply saved for the
+            // turn. A line the old process had streamed into a placeholder and
+            // never saved is invisible here — the session records what was
+            // said, not what Slack took (roadmap 31's open item) — so such a
+            // turn is failed without a note under that line. Taken over the
+            // alternative on purpose: a note for every judged turn a restart
+            // caught turns a silent turn, the common case, into the
+            // interruption it existed to avoid; a line left standing happens
+            // only to a turn that had already chosen to speak.
+            warn(`slack: a turn nobody asked for failed before saying anything: ${event.error}`);
+            await uploadUnrenderedFiles(connection, channel, thread, files);
+            return;
+        }
         await postAheadOf(behind, connection, channel, thread, messageChunks(`Something went wrong: ${event.error}`), () => uploadUnrenderedFiles(connection, channel, thread, files));
     };
     /**
@@ -1567,7 +2357,14 @@ export const createSlackChannelAdapter = (options) => {
             await uploads();
             return;
         }
-        await postAheadOf(behind, connection, channel, thread, posting, uploads);
+        // A reply the thread's other agents hear like any other, taking their
+        // place for it before the post, as `handleInbound` does.
+        const published = postAheadOf(behind, connection, channel, thread, posting, uploads);
+        const heard = routing.reply !== undefined && thread !== undefined
+            ? overhearReply(connection, channel, thread, routing.reply, routing, published)
+            : undefined;
+        await published;
+        await heard;
         log(`slack: posted the reply of a turn finished after a restart to ${channel}`);
     };
     const handleInteractive = async (connection, args) => {
@@ -1647,14 +2444,25 @@ export const createSlackChannelAdapter = (options) => {
      * Records that `agentId` holds the thread from the message at `ts`
      * onwards, wherever in the thread's history that message falls.
      *
-     * Only actual handovers are kept: a write naming the agent that already
-     * held the thread at that point adds nothing, so the list stays as short
-     * as the conversation's changes of hands rather than growing per message.
-     * The oldest handovers are dropped past `THREAD_HANDOVER_DEPTH`, and the
+     * Every claim is kept, not only changes of hands. A claim by the agent
+     * already holding the thread looks redundant until another agent's reply
+     * is placed between it and the one before — a judge's reply posted below
+     * the holder's older message and above its newer one — at which point it
+     * is what keeps the newer message the holder's; dropped, the judge's
+     * later insertion would take the thread from a reply that sits below it.
+     * Only the same claim twice — the same message reaching a second
+     * connection — is dropped.
+     * The oldest claims are dropped past `THREAD_HANDOVER_DEPTH`, and the
      * least recently written thread past `THREAD_ADDRESSEE_CAPACITY`; both
      * losses cost a lookup, never an answer, since the sessions still hold
      * the durable version.
      *
+     * `ts` is a message's place in the thread: the message that handed the
+     * thread over at intake, or — once a reply has landed — the reply's own
+     * (`ReplyOutcome.spokeAt`), which is what puts a judge's reply posted
+     * below a colleague's placeholder after it, and one streamed above it
+     * before, whichever turn finished first.
+     *
      * Slack timestamps compare as strings: `seconds.microseconds`, both
      * parts fixed width, so lexicographic order is chronological order.
      */
@@ -1665,9 +2473,7 @@ export const createSlackChannelAdapter = (options) => {
             at -= 1;
         }
         const before = handovers[at - 1];
-        if (before && before.agentId === agentId) {
-            // Already this agent's from earlier in the thread; the same message
-            // reaching a second connection lands here too.
+        if (before && before.agentId === agentId && before.ts === ts) {
             return;
         }
         handovers.splice(at, 0, { agentId, ts });
@@ -1724,10 +2530,17 @@ export const createSlackChannelAdapter = (options) => {
      * so is one whose `auth.test` itself failed, since its bot id was never
      * learned.
      */
-    const agentNamedIn = (text, team) => {
+    const agentNamedIn = (text, team, 
+    /**
+     * Whether a named agent would take this message at all. A message
+     * naming two agents hands the thread to one that admits the sender,
+     * not to the first one named: the agent that refuses will not answer,
+     * and a handover to it is a thread nobody holds.
+     */
+    admits = () => true) => {
         let offline;
         for (const [agentId, identity] of botIdentities) {
-            if (identity.teamId !== team || !mentions(text, identity.botUserId)) {
+            if (identity.teamId !== team || !mentions(text, identity.botUserId) || !admits(agentId)) {
                 continue;
             }
             if (connections.some((live) => live.config.agentId === agentId)) {
@@ -1896,10 +2709,14 @@ export const createSlackChannelAdapter = (options) => {
      * the dedupe and the handover record included, which are the two pieces a
      * later message reads.
      *
-     * `undefined` means the message is not this agent's. `settled: false`
-     * means only the sessions can still decide it, which is the one case that
-     * has to wait — and it is the cold case, where by definition no message
-     * of this thread has been seen in this process.
+     * `undefined` means the message is nothing to this agent — a DM to
+     * someone else, the room rather than a thread, its own words.
+     * `overhear: true` means it is somebody else's to answer and this
+     * agent's to hear, if it is in the thread at all, which only the sessions
+     * can say. `settled: false` means only the sessions can decide even that
+     * much, which is the one case that has to wait — and it is the cold
+     * case, where by definition no message of this thread has been seen in
+     * this process.
      */
     const admit = (connection, args) => {
         const event = args.event;
@@ -1912,6 +2729,9 @@ export const createSlackChannelAdapter = (options) => {
         if (event.user === connection.botUserId) {
             return undefined;
         }
+        // Bound once the guard above has run: the closures below cannot see
+        // that narrowing.
+        const sender = event.user;
         const isDm = event.channel_type === 'im';
         const team = args.body?.team_id ?? connection.teamId;
         // A top-level mention has no thread_ts; its own ts roots the reply
@@ -1932,9 +2752,76 @@ export const createSlackChannelAdapter = (options) => {
         // handover, Ava could take the next untagged reply while Bea's socket
         // was still behind, and answer a question that had just been handed
         // away. The message Ava must record is exactly the one Ava ignores.
-        const named = agentNamedIn(text, team);
-        if (threadKey && named) {
-            rememberAddressee(threadKey, named, event.ts);
+        // Who the message is for, judged on the named agents' own terms rather
+        // than this one's: agents may list different principals, and a sender
+        // Ava admits but Bea refuses must not be able to hand Bea the thread
+        // from Ava's socket — Bea's own socket refuses the same message, and
+        // the map is shared. A message naming Bea and Cy is Cy's, who will
+        // answer it and hold the thread. One naming only agents that refuse
+        // the sender is still theirs and not this agent's to answer — so the
+        // refusing agent stays `named`, and only the handover is withheld.
+        const handoverTo = agentNamedIn(text, team, (agentId) => admitsSender(agentConfigFor(agentId), sender));
+        const named = handoverTo ?? agentNamedIn(text, team);
+        // The key one Slack MESSAGE is known by, whichever delivery carried
+        // it; see the dedupe below for why it is not the event id.
+        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
+        // Recorded ahead of this agent's own refusal below, and on the named
+        // agent's admission rather than this one's: a sender Ava refuses and
+        // Bea admits has handed Bea the thread, and Ava's socket may be the
+        // one that hears it first. If Ava withheld the record, a fast untagged
+        // follow-up from someone Ava does admit would go to the old holder on
+        // Ava's socket and to Bea once Bea's socket caught up — two answers to
+        // one message. The refused message itself still takes no place in
+        // Ava's transcript; only the map learns who holds the thread.
+        if (threadKey && handoverTo) {
+            rememberAddressee(threadKey, handoverTo, event.ts);
+        }
+        // Who may speak at all, judged before anything below remembers this
+        // message. The adapter's own checks establish nothing about who is
+        // typing; under `admit: 'principals'` the operator's list is the door,
+        // not a label, and a sender not on it gets neither a turn nor a place
+        // in a transcript the agent reads — nor a say in who holds the thread
+        // beyond what the named agent's own admission above allowed.
+        // Logged rather than answered — a reply is a conversation with someone
+        // the operator chose not to have one with — and logged only for a
+        // message this agent would have taken up: a mention, or an untagged
+        // reply inside a thread this agent is known to hold. A channel
+        // subscribed for thread follow-through delivers every post and every
+        // reply in every thread, including the threads this agent was never
+        // part of, and a line per stranger per reply is a log with nothing
+        // left to read. Known from what this process has seen, as the
+        // admitted path below judges it; a thread nothing here remembers is
+        // one the sessions would have to be asked about, and a refused message
+        // does not get a place in that queue. Once per MESSAGE, on the same key
+        // the admitted path dedupes on: a mention arrives twice under both
+        // subscriptions, and a delivery Slack did not see acknowledged arrives
+        // again, and each copy would otherwise write its own line during
+        // exactly the traffic an operator reads the log to understand.
+        // Consuming the key here is safe because a refused message records
+        // nothing a later copy could be needed for.
+        if (!admitsSender(connection.config, sender)) {
+            const refusal = `slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`;
+            const held = threadKey !== undefined ? holderAt(threadKey, event.ts) : undefined;
+            if (addressed || held === connection.config.agentId) {
+                if (!alreadySeen(eventKey)) {
+                    log(refusal);
+                }
+            }
+            else if (held === undefined && event.thread_ts !== undefined && !alreadySeen(eventKey)) {
+                // Nothing in memory says whose thread this is — after a restart, or
+                // once the record was evicted — but the sessions may: the durable
+                // half of the question the admitted path asks, and the same
+                // verdict. Off the intake chain, because a refused message gets no
+                // place in that queue, and the line is an audit, not a turn; `track`
+                // holds it so `stop()` drains it like any other background work.
+                const thread = event.thread_ts;
+                track(followUpWinner({ team, conversation: event.channel, thread }, event.ts).then((winner) => {
+                    if (winner === connection.config.agentId) {
+                        log(refusal);
+                    }
+                }));
+            }
+            return undefined;
         }
         if (!addressed) {
             if (event.thread_ts === undefined) {
@@ -1942,13 +2829,6 @@ export const createSlackChannelAdapter = (options) => {
                 // or stands alone, is a follow-up to nothing.
                 return undefined;
             }
-            if (named) {
-                // Somebody else was asked. Tagging an agent hands it the question,
-                // and the agent that had it is no longer being asked — two answers
-                // to one message is what a thread with a roster in it must never
-                // produce.
-                return undefined;
-            }
         }
         // One Slack MESSAGE, not one delivery. An app subscribed to both
         // `app_mention` and `message.channels` is told about a mention twice —
@@ -1960,8 +2840,9 @@ export const createSlackChannelAdapter = (options) => {
         // After the handover record and not before it: a redelivery re-records
         // the same agent, which costs nothing, while deduping first would drop
         // the record whenever the other copy of a doubly-delivered mention is
-        // the one a connection sees second.
-        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
+        // the one a connection sees second. And before every stand-down below,
+        // because standing down is no longer nothing: an agent that hears a
+        // message it is not answering must hear it once.
         if (alreadySeen(eventKey)) {
             return undefined;
         }
@@ -1980,6 +2861,8 @@ export const createSlackChannelAdapter = (options) => {
             ...(thread ? { thread } : {}),
             ...(threadKey ? { threadKey } : {}),
             settled: true,
+            overhear: false,
+            judge: false,
         };
         if (addressed) {
             // A message that named this agent and others is recorded above under
@@ -1989,9 +2872,33 @@ export const createSlackChannelAdapter = (options) => {
             // reading of a message that asked several.
             return admission;
         }
-        // An untagged reply. The record is what this process has actually seen,
-        // in the order it saw it — right even inside the window before a
-        // handover reaches the store.
+        if (named) {
+            // Somebody else was asked. Tagging an agent hands it the question,
+            // and the agent that had it is no longer being asked — two answers
+            // to one message is what a thread with a roster in it must never
+            // produce. But the agent that had it is still in the room, and a
+            // person in that position hears the question asked of their
+            // colleague: it goes into this agent's session, unanswered, so the
+            // next thing it is asked is asked of someone who followed along.
+            return { ...admission, overhear: true };
+        }
+        // An untagged reply. How this agent listens decides what it is: an
+        // agent that answers only mentions hears it and nothing more, and one
+        // that judges hears it and, if still attentive, takes a turn nobody
+        // asked for on it — decided in the intake, since only the session can
+        // say. Neither takes part in the holder rule below: that rule answers
+        // "whose is an untagged reply", and for these two agents the soul has
+        // already answered.
+        const listens = listensOf(connection.config.agentId);
+        if (listens === 'mentions') {
+            return { ...admission, overhear: true };
+        }
+        if (listens === 'judge') {
+            return { ...admission, overhear: true, judge: true };
+        }
+        // The record is what this process has actually seen, in the order it
+        // saw it — right even inside the window before a handover reaches the
+        // store.
         const holder = threadKey === undefined ? undefined : holderAt(threadKey, event.ts);
         if (holder !== undefined && threadKey !== undefined) {
             if (holder !== connection.config.agentId) {
@@ -2004,7 +2911,10 @@ export const createSlackChannelAdapter = (options) => {
                 // membership the adapter does not track, and would have to be
                 // tracked in the durable path too, since a removed app is still a
                 // live connection with the newest session there.
-                return undefined;
+                //
+                // Standing down is not leaving: the reply is the holder's, and this
+                // agent hears it.
+                return { ...admission, overhear: true };
             }
             rememberAddressee(threadKey, connection.config.agentId, event.ts);
             return admission;
@@ -2047,42 +2957,127 @@ export const createSlackChannelAdapter = (options) => {
         // reverse order in durable history. The chain is claimed here,
         // synchronously, so a message's place in it is fixed by when Slack
         // delivered it and not by how long anything it does takes.
-        const previousIntake = intakeChains.get(sessionId) ?? Promise.resolve();
-        const intake = previousIntake.then(async () => {
+        const intake = onIntakeChain(sessionId, async () => {
             // The durable half of addressing runs INSIDE the chain, for the same
             // reason: it awaits, and a message that had to ask the sessions must
             // not lose its place to one that did not. A message that turns out
             // not to be this agent's leaves an empty link behind, which is all it
             // should cost.
+            let overhear = admitted.overhear;
+            // Judged, not ruled: a turn nobody asked for, while the agent is
+            // still attentive, and a free overhear past that. Read off the
+            // chain — a session the invitation is still creating reads as not
+            // there, and the message is heard rather than judged, which is the
+            // safe side. A host that cannot say leaves the agent hearing.
+            let judged = false;
+            if (admitted.judge && gateway.sessionRouting) {
+                // The pending count is taken BEFORE the store is read: a message
+                // that settles between the two would be counted by neither the
+                // other way round, and a window that runs one message short in a
+                // race is a bound kept; one that runs a message long is not.
+                const pending = pendingFor(sessionId);
+                let routing;
+                try {
+                    routing = await gateway.sessionRouting(sessionId);
+                }
+                catch (error) {
+                    warn(`slack: could not read whether ${connection.config.agentId} is attentive in ${event.channel}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                if (routing && attentive(routing, event.ts, pending)) {
+                    judged = true;
+                    overhear = false;
+                }
+            }
             if (!admitted.settled) {
                 // One verdict for this message, shared with whichever other agents
                 // are asking about it — see `followUpWinner`.
                 const winner = await followUpWinner({ team, conversation: event.channel, thread: event.thread_ts ?? '' }, event.ts);
                 if (winner !== connection.config.agentId) {
-                    return undefined;
+                    // Not this agent's to answer — and, if it is in the thread,
+                    // this agent's to hear, same as the two warm stand-downs.
+                    overhear = true;
                 }
-                // Answered from the store rather than from memory: hold it, so the
-                // rest of the thread is ordered by receipt like any other.
-                if (threadKey) {
+                else if (threadKey) {
+                    // Answered from the store rather than from memory: hold it, so
+                    // the rest of the thread is ordered by receipt like any other.
                     rememberAddressee(threadKey, connection.config.agentId, event.ts);
                 }
             }
             const cleaned = await humanizeMentions(connection, event.text ?? '');
-            if (cleaned.length === 0) {
+            // Fetched inside the chain, like the lookups below: it is network
+            // I/O, and a message whose screenshot is slow to arrive must not lose
+            // its place to the one typed after it. Only for a message this agent
+            // will answer: an overheard one is appended as text with no turn run
+            // on it, and its attachments reach the transcript by name, as every
+            // attachment did before images.
+            // Nor for one it will judge: the kernel refuses images on a turn
+            // nobody asked for, since they reach the model ahead of the frame
+            // that marks the message as somebody else's, and a judged message
+            // names its attachments the way an overheard one does.
+            const { images, unread } = overhear || judged
+                ? { images: [], unread: event.files ?? [] }
+                : await readImageAttachments(event.files ?? [], connection.config.botToken, fetchFile, fileDownloadTimeoutMs, warn);
+            // An image with nothing said is still a question ("what's this?"); a
+            // file the turn could not open with nothing said is not one, and gets
+            // no reply.
+            if (cleaned.length === 0 && images.length === 0) {
                 return undefined;
             }
-            const author = await displayNameFor(connection, userId);
+            const author = await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
-            // unambiguous.
-            const spoken = isDm ? cleaned : `${author}: ${cleaned}`;
-            const userMessage = `${spoken}${attachmentNote(event.files)}`;
-            const renderer = new ReplyRenderer(connection.web, event.channel, thread, editIntervalMs, warn);
-            try {
-                await renderer.open();
+            // unambiguous. A bare image in a channel still says who sent it.
+            const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
+            const userMessage = `${spoken}${attachmentNote(unread)}`;
+            // Who sent this, judged against the operator's list — per message,
+            // never remembered from the first one in the thread. A DM proves
+            // nothing about who is typing, so a DM from an unlisted member is
+            // `unknown` exactly as a channel mention would be. The same label
+            // whether the agent answers or only hears: the text is in its
+            // transcript either way.
+            const senderTrust = (connection.config.principals ?? []).includes(userId) ? 'user' : 'unknown';
+            const metadata = {
+                channel: 'slack',
+                team,
+                slackChannel: event.channel,
+                slackUser: userId,
+                // Carried so a mid-turn approval question is asked in the thread
+                // the turn belongs to rather than at the top of a busy channel.
+                ...(thread ? { slackThread: thread } : {}),
+                [SENDER_TRUST_METADATA_KEY]: senderTrust,
+            };
+            if (overhear) {
+                // Heard, not answered: no placeholder, no turn. Only into a
+                // conversation this agent is already in — a session under this
+                // thread's key exists exactly when it was invited here — and the
+                // gateway is the one to say whether it is, on the session's chain:
+                // a first mention whose dispatch is queued ahead of this message
+                // has created the session by the time the observe runs, where a
+                // membership read from here would find nothing and drop a
+                // message said moments after the invitation. A host that cannot
+                // take it leaves the agent hearing what it answers, as every
+                // agent did before.
+                if (!gateway.observe) {
+                    return undefined;
+                }
+                // Placed on the gateway's chain here, in receipt order, and not
+                // awaited here: a dispatch is placed the same way, and awaiting
+                // an overhear queued behind a long turn would hold the next
+                // message's place in this chain hostage to that turn.
+                return {
+                    observed: placeObserve(sessionId, gateway.observe({ sessionId, agentId: connection.config.agentId, message: userMessage, metadata })),
+                };
             }
-            catch (error) {
-                warn(`could not post to ${event.channel}: ${error instanceof Error ? error.message : String(error)}`);
-                return undefined;
+            // A turn nobody asked for opens its placeholder on its first text,
+            // if it ever has any — see `ReplyRenderer.lazy`.
+            const renderer = new ReplyRenderer(connection.web, event.channel, thread, editIntervalMs, warn, { lazy: judged, now });
+            if (!judged) {
+                try {
+                    await renderer.open();
+                }
+                catch (error) {
+                    warn(`could not post to ${event.channel}: ${error instanceof Error ? error.message : String(error)}`);
+                    return undefined;
+                }
             }
             // The push and the dispatch happen in the same microtask, so queue
             // order matches the gateway's single-flight turn order for this
@@ -2094,35 +3089,29 @@ export const createSlackChannelAdapter = (options) => {
                 sessionId,
                 agentId: connection.config.agentId,
                 userMessage,
+                ...(images.length > 0 ? { images } : {}),
+                ...(judged ? { addressed: false } : {}),
                 turnId: renderer.turnId,
-                metadata: {
-                    channel: 'slack',
-                    team,
-                    slackChannel: event.channel,
-                    slackUser: userId,
-                    // Carried so a mid-turn approval question is asked in the thread
-                    // the turn belongs to rather than at the top of a busy channel.
-                    ...(thread ? { slackThread: thread } : {}),
-                    // This turn's sender, judged against the operator's list — per
-                    // message, never remembered from the first one in the thread. A
-                    // DM proves nothing about who is typing, so a DM from an unlisted
-                    // member is `unknown` exactly as a channel mention would be.
-                    [SENDER_TRUST_METADATA_KEY]: (connection.config.principals ?? []).includes(userId) ? 'user' : 'unknown',
-                },
+                metadata,
             });
             return { renderer, turn };
         });
-        const settledIntake = intake.then(() => undefined, () => undefined);
-        intakeChains.set(sessionId, settledIntake);
-        void settledIntake.then(() => {
-            if (intakeChains.get(sessionId) === settledIntake) {
-                intakeChains.delete(sessionId);
-            }
-        });
         const started = await intake;
         if (!started) {
             return;
         }
+        if ('observed' in started) {
+            // Nothing to render; the one outcome worth a line is the host
+            // refusing it — a turn parked across a restart, most likely — since
+            // a message dropped on the floor is the thing this exists to end.
+            try {
+                await started.observed;
+            }
+            catch (error) {
+                warn(`slack: ${connection.config.agentId} could not overhear a message in ${event.channel}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            return;
+        }
         const { renderer, turn } = started;
         const removeFromQueue = () => {
             const current = renderers.get(sessionId);
@@ -2149,10 +3138,41 @@ export const createSlackChannelAdapter = (options) => {
         // the potentially slow final edit, uploads, and overflow posts.
         removeFromQueue();
         if (session) {
-            await renderer.finalize(lastAssistantReply(session));
+            // The reply is final here, so this is when the thread's other agents
+            // take their place for it — before the final edit and the overflow
+            // posts, which are network I/O a later message must not overtake.
+            // A DM has no thread, and nobody else in it.
+            const reply = latestTurnReply(session);
+            // A turn nobody asked for that said nothing posts nothing; every
+            // other turn says `(no reply)` where its answer would have gone.
+            const finalized = renderer.finalize(renderer.lazy ? reply ?? '' : lastAssistantReply(session));
+            const heard = thread !== undefined && reply !== undefined
+                ? overhearReply(connection, event.channel, thread, reply, session, finalized.then((outcome) => outcome.published))
+                : undefined;
+            const { spoke, spokeAt } = await finalized;
+            if (spoke && threadKey !== undefined) {
+                // The voice that just answered, recorded where its reply sits in
+                // the thread. For a judging agent this is the only record there
+                // is — it took no part in the holder rule at intake — and without
+                // it a thread-rule colleague that held the thread before would
+                // keep answering beside it. For any other turn the intake wrote
+                // one at the message answered, and this one says where the answer
+                // landed, which is what settles two turns running at once: a
+                // placeholder posted at intake sits above a reply a judge posted
+                // while it was being filled, whichever turn finished first, and
+                // the reader's next untagged message is for the lower of the two.
+                // Late, either way, for a message typed while the turn was still
+                // running, which the other may therefore still take.
+                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
+            }
+            await heard;
         }
         else {
-            await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            const { spoke, spokeAt } = await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            if (spoke && threadKey !== undefined) {
+                // A file it posted before breaking is still the last thing said.
+                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
+            }
         }
     };
     return {
@@ -2344,6 +3364,7 @@ export const createSlackChannelAdapter = (options) => {
             approvalPosts.clear();
             threadAddressee.clear();
             coldVerdicts.clear();
+            pendingObserves.clear();
             botIdentities.clear();
             rendering.clear();
             resolvedWhileRendering.clear();