@stratusagent/channel-slack 0.12.3 → 0.12.5

package/dist/index.js

@@ -3,7 +3,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, readdir, readFile, realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
+import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, RunAbortedError, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
 import { admitsSender, channelSessionKey, senderTrustFor, } from '@stratusagent/channels';
 import { codeRunsOf, toSlackMrkdwn } from "./mrkdwn.js";
 /**
@@ -44,6 +44,13 @@ const COLD_VERDICT_CAPACITY = 256;
  * socket stays behind for all of them.
  */
 const THREAD_HANDOVER_DEPTH = 32;
+/**
+ * How many agent mentions one thread admits in a row before a person has
+ * to speak there again (card 513): enough for a question, an answer and a
+ * follow-up each way, and a stop to two agents tagging each other forever.
+ * Counted per daemon, in memory; a restart starts it again.
+ */
+export const AGENT_MENTION_HOP_LIMIT = 4;
 /**
  * How many files an unrendered turn may queue for its outcome. Nothing
  * drains that queue until the outcome arrives, so a session whose outcome
@@ -323,6 +330,14 @@ class ReplyRenderer {
      * not be this one.
      */
     turnId = randomUUID();
+    /**
+     * What a Slack stop aborts (card 337): the signal this renderer's dispatch
+     * runs under, so a stop cancels this turn whether it is running or still
+     * queued behind another.
+     */
+    controller = new AbortController();
+    /** The Slack user who stopped this turn, once someone has. */
+    stoppedBy;
     buffer = '';
     /**
      * In `final` mode, what the model has said since its last tool call. A
@@ -1113,6 +1128,18 @@ class ReplyRenderer {
             this.settle();
         }
     }
+    /**
+     * Ends a turn an approver stopped from Slack: says who stopped it where
+     * the reply would have gone. A turn nobody asked for that had said
+     * nothing stays silent, as its failure would.
+     */
+    async stopped(by) {
+        await this.editChain;
+        if (this.lazy && !this.ref && this.buffer.trim().length === 0) {
+            return this.finalize('');
+        }
+        return this.finalize(`Stopped by <@${by}>.`);
+    }
     async fail(message) {
         // The same wait `finalize` takes, for the same reason: a lazy turn's
         // first text may be opening its placeholder right now, and a failure
@@ -1411,6 +1438,8 @@ const alwaysOutcome = (always, agentName, agentId) => {
             return 'Allowed, and this site is now acted on without asking — until revoked';
         case 'tool':
             return `Allowed, and granted to ${escapeSlackText(agentName)} until revoked (stratus grants ${escapeSlackText(agentId)})`;
+        case 'destination':
+            return `Allowed, and granted to ${escapeSlackText(agentName)} for this conversation until revoked (stratus grants ${escapeSlackText(agentId)})`;
         case 'session':
             return 'Allowed for the rest of this session';
         default:
@@ -1430,6 +1459,8 @@ const alwaysOffer = (always, agentName) => {
     switch (always) {
         case 'tool':
             return `*Always allow* grants this tool to ${escapeSlackText(agentName)} until an operator revokes it.`;
+        case 'destination':
+            return `*Always allow* lets ${escapeSlackText(agentName)} use this tool on this conversation without asking, until revoked.`;
         case 'session':
             return '*Always allow* stops this tool asking again for the rest of this session.';
         case 'scope':
@@ -1458,6 +1489,12 @@ const APPROVAL_SUMMARY_LIMIT = 160;
  * words, and marked only by how it is rendered.
  */
 const HUMAN_MESSAGE_SUBTYPES = new Set(['file_share', 'me_message', 'thread_broadcast']);
+/**
+ * Message subtypes that are another agent's bot speaking (card 513): a plain
+ * bot post, an upload with a comment, or a thread reply also sent to the
+ * channel. Edits, deletions and joins are never a mention to answer.
+ */
+const AGENT_SPEECH_SUBTYPES = new Set(['bot_message', 'file_share', 'thread_broadcast']);
 const isPersonSpeaking = (event) => event.subtype === undefined || HUMAN_MESSAGE_SUBTYPES.has(event.subtype);
 /** At most this many attachment names are listed; the rest are counted. */
 const MAX_LISTED_ATTACHMENTS = 5;
@@ -1921,6 +1958,20 @@ const textAttachmentBlocks = (texts) => texts.map(({ name, text }) => `\n[Attach
  * sees.
  */
 const mentions = (text, botUserId) => botUserId.length > 0 && text.includes(`<@${botUserId}>`);
+/**
+ * Whether a message asks this agent to stop (card 337): the word "stop"
+ * and nothing else but mentions and closing punctuation, in any case. A
+ * message that mentions someone and not this agent is for them. Exported
+ * for tests.
+ */
+export const isStopRequest = (text, botUserId) => {
+    const mentioned = [...text.matchAll(/<@([^>|]+)(?:\|[^>]*)?>/g)].map((match) => match[1]);
+    if (mentioned.length > 0 && !mentioned.includes(botUserId)) {
+        return false;
+    }
+    const words = text.replace(/<@[^>|]+(?:\|[^>]*)?>/g, ' ').trim().replace(/[.!]+$/, '').trim();
+    return words.toLowerCase() === 'stop';
+};
 /**
  * Slack's three markup characters. Tool input is written by a model, so it
  * reaches this message as untrusted text: unescaped, `<@U123>` becomes a
@@ -2124,6 +2175,19 @@ const credentialModal = (post, requestId) => ({
  */
 /** Uncached author names one `message.read` looks up; the rest keep their id. */
 const READ_NAME_LOOKUPS = 10;
+/**
+ * Orders two Slack message timestamps ("seconds.micros"). Compared as
+ * integers, not floats: a current ts has more digits than a double holds.
+ */
+const compareSlackTs = (left, right) => {
+    const [leftSeconds = '0', leftMicros = ''] = left.split('.');
+    const [rightSeconds = '0', rightMicros = ''] = right.split('.');
+    const seconds = Number(leftSeconds) - Number(rightSeconds);
+    if (seconds !== 0) {
+        return Math.sign(seconds);
+    }
+    return Math.sign(Number(leftMicros.padEnd(6, '0').slice(0, 6)) - Number(rightMicros.padEnd(6, '0').slice(0, 6)));
+};
 export const createSlackChannelAdapter = (options) => {
     const log = options.log ?? (() => { });
     const warn = options.warn ?? (() => { });
@@ -2161,6 +2225,15 @@ export const createSlackChannelAdapter = (options) => {
     // Per-session intake chains: the pre-dispatch pipeline (lookups,
     // placeholder, dispatch call) runs in Slack receipt order.
     const intakeChains = new Map();
+    /**
+     * Stop (card 337), for messages still in intake: how many each session
+     * has between claiming a place on its chain and reaching `renderers`, and
+     * the latest stop to land there. A message compares the stop it claimed
+     * its place under with the one in force when it is about to dispatch, so a
+     * stop also cancels a message whose lookups were still running.
+     */
+    const intakeInFlight = new Map();
+    const stopsBySession = new Map();
     const displayNames = new Map();
     // Socket Mode redelivers on missed acks; a slow turn must not run twice.
     const seenEvents = new Set();
@@ -2210,6 +2283,16 @@ export const createSlackChannelAdapter = (options) => {
      * corrects it.
      */
     const threadAddressee = new Map();
+    /**
+     * Threads whose owner this process can name (card 508): `true` for one
+     * whose first message it saw, so the first claim in `threadAddressee` is
+     * the owner, or the owner itself when the thread read named it after a
+     * restart. Absent for a thread that started before this process did:
+     * its first claim here is only the first one SEEN, and an untagged reply
+     * in it asks the sessions and the thread (see `ownerAt`). Bounded like
+     * the addressee map; a lost entry costs a lookup.
+     */
+    const threadOrigins = new Map();
     /**
      * One cold verdict per message — see `followUpWinner`. Bounded, because
      * an entry outlives its own resolution on purpose; an entry that has not
@@ -2382,8 +2465,12 @@ export const createSlackChannelAdapter = (options) => {
                 // as an unlisted person. This fleet's own agents are not: they are
                 // the conversation the mention joins — an authenticated peer whose
                 // socket failed to start included, since what it said is still its.
+                // Nor is a remote team agent this one answers (card 513): its
+                // mention is admitted, so what it said before the mention is too.
                 return admitsSender(connection.config, message.user ?? '')
-                    || (message.user !== undefined && [...botIdentities.values()].some((peer) => peer.teamId === connection.teamId && peer.botUserId === message.user));
+                    || (message.user !== undefined && [...botIdentities.values()].some((peer) => peer.teamId === connection.teamId && peer.botUserId === message.user))
+                    || (message.user !== undefined && connection.teamId !== undefined
+                        && answersAgentMention(connection.config.agentId, connection.teamId, message.user));
             }
             return message.user !== undefined
                 && isPersonSpeaking({ type: 'message', ts: message.ts, channel, ...(message.subtype ? { subtype: message.subtype } : {}) })
@@ -2919,6 +3006,73 @@ export const createSlackChannelAdapter = (options) => {
             }
         }));
     };
+    /**
+     * An agent's own post into a thread, heard in its own session for that
+     * thread (card 364). A scheduled report or a `message.send` reply is a
+     * bot message, which `admit` drops on purpose, and backfill reads a
+     * thread only when a session for it is first made, so without this an
+     * agent already in the thread never knew it had posted there: a reply
+     * under its report reached a session with the question and not the
+     * report. Through `observe`, so it starts no turn and lands only in a
+     * session that already exists; a thread the agent was never in is read
+     * by backfill when somebody first replies there.
+     *
+     * Labelled as the agent's own post, at the label the SENDING session's
+     * words carry (`speaker.trust`, `sessionWriteTrust` of that session):
+     * a report written by a firing that read a web page carries what that
+     * page said, so it is heard at `external`, and one written from `user`
+     * and `agent` context is heard at `agent`. Never higher, so hearing its
+     * own report cannot launder anything into the thread. A post nobody
+     * vouches for (no speaker) is not heard at all, rather than guessed at.
+     *
+     * Not when the sender IS that thread's session: that turn already holds
+     * the call and what it said. Claimed on the intake chain BEFORE the
+     * first chunk goes to Slack, so a reply typed under the report, even
+     * while a long one is still being sent, is heard after it. `posted`
+     * settles with what Slack accepted: all of it, the chunks before one it
+     * refused (they are in the thread, so they are heard), or nothing. Not
+     * awaited by `post`, only by the shutdown drain, so a long turn running
+     * in the thread never holds up the sender, and two threads posting into
+     * each other cannot wait on each other.
+     */
+    const hearOwnPost = (connection, channel, thread, posted, speaker) => {
+        const gateway = gatewayRef;
+        if (!gateway?.observe) {
+            return;
+        }
+        const agentId = connection.config.agentId;
+        const team = connection.teamId;
+        const sessionId = channelSessionKey({ channel: 'slack', agentId, team, conversation: channel, thread });
+        if (sessionId === speaker.sessionId) {
+            return;
+        }
+        const metadata = {
+            channel: 'slack',
+            team,
+            slackChannel: channel,
+            slackUser: connection.botUserId,
+            slackThread: thread,
+            [SENDER_TRUST_METADATA_KEY]: leastTrusted('agent', speaker.trust),
+        };
+        const heard = onIntakeChain(sessionId, async () => {
+            const text = await posted;
+            if (text === undefined) {
+                return { observed: undefined };
+            }
+            const author = await displayNameFor(connection, connection.botUserId);
+            const observed = gateway.observe?.({ sessionId, agentId, message: `${author} (your own post, sent from another session): ${text}`, metadata });
+            return { observed: observed === undefined ? undefined : placeObserve(sessionId, observed) };
+        });
+        // Tracked, so stop() drains it: a restart right after a report must not
+        // close the stores while the thread's session is still to hear it.
+        track(heard
+            .then(async ({ observed }) => {
+            await observed;
+        })
+            .catch((error) => {
+            warn(`slack: ${agentId} could not hear its own post in ${channel} thread ${thread}: ${error instanceof Error ? error.message : String(error)}`);
+        }));
+    };
     /**
      * The addressable outbound seam — the channel contract's first real
      * `OutboundConnection` implementation. Validate-then-hand-over: every
@@ -2964,16 +3118,31 @@ export const createSlackChannelAdapter = (options) => {
         // A reply under a message rather than a post beside it. Every chunk of
         // a long one goes to the same thread, so a split reply stays together.
         const thread = address.thread?.trim() || undefined;
+        const speaker = address.speaker;
         return {
             async post(text) {
                 const chunks = messageChunks(text.trim().length > 0 ? text : '(empty message)');
+                // Heard in the thread's session (card 364): its place is claimed
+                // now, before Slack shows anything, and filled once we know what
+                // Slack accepted.
+                let accepted = () => { };
+                if (thread && speaker && text.trim().length > 0) {
+                    hearOwnPost(connection, channelId, thread, new Promise((resolve) => { accepted = resolve; }), speaker);
+                }
                 let first;
-                for (const chunk of chunks) {
-                    const posted = await web.chat.postMessage({ channel: channelId, text: chunk, ...(thread ? { thread_ts: thread } : {}) });
-                    if (!first) {
-                        first = { channel: posted.channel ?? channelId, ts: posted.ts ?? '' };
+                let sent = 0;
+                try {
+                    for (const chunk of chunks) {
+                        const posted = await web.chat.postMessage({ channel: channelId, text: chunk, ...(thread ? { thread_ts: thread } : {}) });
+                        sent += 1;
+                        if (!first) {
+                            first = { channel: posted.channel ?? channelId, ts: posted.ts ?? '' };
+                        }
                     }
                 }
+                finally {
+                    accepted(sent === chunks.length ? text : sent > 0 ? chunks.slice(0, sent).join('\n') : undefined);
+                }
                 return first ?? { channel: channelId, ts: '' };
             },
             async edit(ref, text) {
@@ -3900,6 +4069,34 @@ export const createSlackChannelAdapter = (options) => {
     };
     /** One thread, whichever agent is talking in it. */
     const threadKeyFor = (parts) => `${parts.team}:${parts.conversation}:${parts.thread}`;
+    /**
+     * A thread's claims cut to `THREAD_HANDOVER_DEPTH`, oldest first out, but
+     * never the two `ownerAt` reads past the rest, so at most one over: the
+     * first claim, which is who the thread belongs to, and the latest claim
+     * that took the thread.
+     * Dropping that one would hand the thread back to its owner after enough
+     * mentions of a third agent, while the judge that took it still answers.
+     */
+    const trimHandovers = (handovers) => {
+        if (handovers.length <= THREAD_HANDOVER_DEPTH) {
+            return handovers;
+        }
+        const first = handovers[0];
+        let latestTake = -1;
+        for (let index = handovers.length - 1; index > 0; index -= 1) {
+            if (handovers[index]?.takes === true) {
+                latestTake = index;
+                break;
+            }
+        }
+        const tailFrom = handovers.length - (THREAD_HANDOVER_DEPTH - 1);
+        // The kept take sits on top of the full recent tail, one past the depth,
+        // so `holderAt` still sees every recent claim it saw before.
+        const tail = handovers.slice(tailFrom);
+        return latestTake > 0 && latestTake < tailFrom
+            ? [first, handovers[latestTake], ...tail]
+            : [first, ...tail];
+    };
     /**
      * Records that `agentId` holds the thread from the message at `ts`
      * onwards, wherever in the thread's history that message falls.
@@ -3912,7 +4109,8 @@ export const createSlackChannelAdapter = (options) => {
      * later insertion would take the thread from a reply that sits below it.
      * Only the same claim twice — the same message reaching a second
      * connection — is dropped.
-     * The oldest claims are dropped past `THREAD_HANDOVER_DEPTH`, and the
+     * The oldest claims are dropped past `THREAD_HANDOVER_DEPTH` (but not
+     * the first or the latest that took the thread: `trimHandovers`), and the
      * least recently written thread past `THREAD_ADDRESSEE_CAPACITY`; both
      * losses cost a lookup, never an answer, since the sessions still hold
      * the durable version.
@@ -3926,7 +4124,7 @@ export const createSlackChannelAdapter = (options) => {
      * Slack timestamps compare as strings: `seconds.microseconds`, both
      * parts fixed width, so lexicographic order is chronological order.
      */
-    const rememberAddressee = (key, agentId, ts) => {
+    const rememberAddressee = (key, agentId, ts, takes = false) => {
         const handovers = threadAddressee.get(key) ?? [];
         let at = handovers.length;
         while (at > 0 && handovers[at - 1].ts > ts) {
@@ -3934,17 +4132,24 @@ export const createSlackChannelAdapter = (options) => {
         }
         const before = handovers[at - 1];
         if (before && before.agentId === agentId && before.ts === ts) {
+            if (takes) {
+                before.takes = true;
+            }
             return;
         }
-        handovers.splice(at, 0, { agentId, ts });
+        handovers.splice(at, 0, takes ? { agentId, ts, takes } : { agentId, ts });
         // Re-inserted rather than mutated in place: a Map iterates in insertion
         // order, which is what makes the first key the one to evict.
         threadAddressee.delete(key);
-        threadAddressee.set(key, handovers.slice(-THREAD_HANDOVER_DEPTH));
+        threadAddressee.set(key, trimHandovers(handovers));
         if (threadAddressee.size > THREAD_ADDRESSEE_CAPACITY) {
             const oldest = threadAddressee.keys().next();
             if (!oldest.done) {
                 threadAddressee.delete(oldest.value);
+                // The owner goes with the record of who took the thread since: an
+                // owner kept alone would stand in for a judge's takeover it no
+                // longer knows of, where the thread read would see it.
+                threadOrigins.delete(oldest.value);
             }
         }
     };
@@ -3966,12 +4171,126 @@ export const createSlackChannelAdapter = (options) => {
         }
         return undefined;
     };
+    /**
+     * Who an untagged reply at `ts` belongs to (card 508): the agent the
+     * thread belongs to, not whoever spoke last. That is the first to hold
+     * it — the agent its first message named, a home channel's owner, or the
+     * bot (this daemon's or another's) that posted it — unless a judging
+     * agent has since chosen to speak, which takes it (`takes`). A mention
+     * of another agent gets that agent's answer to that message and nothing
+     * more: the thread stays where it was, and so does every reply after.
+     * In a thread that began before this process did, and that the thread
+     * read has not placed yet, the first claim this process SAW stands in
+     * for the owner: the best it has, and no worse than the last-speaker
+     * rule it replaces. Undefined when this process has seen no claim at
+     * all, which sends the question to the sessions and the thread.
+     */
+    const ownerAt = (key, ts) => {
+        const origin = threadOrigins.get(key);
+        const handovers = threadAddressee.get(key) ?? [];
+        for (let index = handovers.length - 1; index >= 0; index -= 1) {
+            const handover = handovers[index];
+            if (handover && handover.ts <= ts && (handover.takes === true || (index === 0 && typeof origin !== 'string'))) {
+                return handover.agentId;
+            }
+        }
+        return typeof origin === 'string' ? origin : undefined;
+    };
+    /**
+     * The agent the thread `key` belongs to, whoever holds it now: the owner
+     * the thread read settled, or else the first claim this process saw.
+     * Answering in its own thread takes the thread back from a judge that
+     * spoke since (card 508), so the owner is asked for here, not the holder.
+     */
+    const threadOwner = (key) => {
+        const origin = threadOrigins.get(key);
+        return typeof origin === 'string' ? origin : threadAddressee.get(key)?.[0]?.agentId;
+    };
+    /** Records that this process saw the thread `key` begin, or who owns it. */
+    const noteOrigin = (key, owner = true) => {
+        if (owner === true && threadOrigins.has(key)) {
+            return;
+        }
+        threadOrigins.delete(key);
+        threadOrigins.set(key, owner);
+        if (threadOrigins.size > THREAD_ADDRESSEE_CAPACITY) {
+            const oldest = threadOrigins.keys().next();
+            if (!oldest.done) {
+                threadOrigins.delete(oldest.value);
+            }
+        }
+    };
+    /**
+     * A message that starts a thread, seen by any connection: from here on
+     * this process sees the thread's first claim, so it knows the owner. One
+     * this daemon's own agent posted (a schedule's delivery, a message.send)
+     * is that agent's thread.
+     */
+    const noteThreadStart = (connection, args) => {
+        const event = args.event;
+        if (!event || (event.type !== 'message' && event.type !== 'app_mention') || event.channel_type === 'im') {
+            return;
+        }
+        if (event.thread_ts !== undefined && event.thread_ts !== event.ts) {
+            return;
+        }
+        if (event.subtype !== undefined && event.subtype !== 'bot_message' && !HUMAN_MESSAGE_SUBTYPES.has(event.subtype)) {
+            return;
+        }
+        const team = args.body?.team_id ?? connection.teamId;
+        const key = threadKeyFor({ team, conversation: event.channel, thread: event.ts });
+        if (threadOrigins.has(key)) {
+            return;
+        }
+        noteOrigin(key);
+        if (event.user !== undefined) {
+            for (const [agentId, identity] of botIdentities) {
+                if (identity.teamId === team && identity.botUserId === event.user) {
+                    rememberAddressee(key, agentId, event.ts);
+                }
+            }
+        }
+        // A team agent on another gateway that starts a thread owns it, even
+        // when its first message asks an agent here something: that agent
+        // answers the question, and the thread stays the asker's. Recorded
+        // here, ahead of the answer, since `noteForeignSpeaker` leaves out a
+        // bot's question to an agent here.
+        const bot = event.bot_id !== undefined || event.subtype === 'bot_message';
+        if (bot && event.user !== undefined && !isFleetBot(team, event.user) && !startsThreadAsIntegration(team, event.user, event.thread_ts, event.ts)) {
+            rememberAddressee(key, `${FOREIGN_SPEAKER_PREFIX}${event.user}`, event.ts);
+        }
+    };
     /**
      * Whether `user` is one of this adapter's own agents in `team`. Their
      * replies reach the holder record through `ReplyOutcome.spokeAt`, and
      * their sessions answer for them after a restart.
      */
     const isFleetBot = (team, user) => user !== undefined && [...botIdentities.values()].some((identity) => identity.teamId === team && identity.botUserId === user);
+    /**
+     * Whether a bot message is a team agent asking one of this daemon's
+     * agents something (card 513): a question, not another voice taking the
+     * thread. The agent asked answers it, and the thread stays with whoever
+     * held it. Used live and when a thread is read back after a restart.
+     */
+    const asksAgentHere = (team, asker, text) => asker !== undefined && [...botIdentities].some(([agentId, identity]) => identity.teamId === team && mentions(text ?? '', identity.botUserId) && answersAgentMention(agentId, team, asker));
+    /**
+     * Whether a bot message is another app starting a thread — an alert, a
+     * deploy note — rather than an agent (card 508). That starts the thread
+     * without owning it, so an agent named under it keeps the conversation it
+     * was given. A team agent (`agentMentions.team`) starting one owns it the
+     * way an agent here does, and any app replying inside a thread counts as
+     * a speaker there, since an agent on a gateway nobody listed looks like
+     * any other app.
+     */
+    const startsThreadAsIntegration = (team, user, threadTs, ts) => {
+        if (threadTs !== undefined && threadTs !== ts) {
+            return false;
+        }
+        return user === undefined || ![...botIdentities].some(([agentId, identity]) => {
+            const config = agentConfigFor(agentId);
+            return config !== undefined && teamAgentFor(config, identity.teamId, team, user) !== undefined;
+        });
+    };
     /**
      * Records a bot this adapter does not serve as the thread's holder from
      * the message it posted. An agent on another gateway answers in the same
@@ -4000,6 +4319,12 @@ export const createSlackChannelAdapter = (options) => {
         if (speaker === undefined || isFleetBot(team, event.user)) {
             return;
         }
+        if (asksAgentHere(team, event.user, event.text)) {
+            return;
+        }
+        if (startsThreadAsIntegration(team, event.user, event.thread_ts, event.ts)) {
+            return;
+        }
         const thread = event.thread_ts ?? event.ts;
         rememberAddressee(threadKeyFor({ team, conversation: event.channel, thread }), `${FOREIGN_SPEAKER_PREFIX}${speaker}`, event.ts);
     };
@@ -4032,16 +4357,30 @@ export const createSlackChannelAdapter = (options) => {
             const botUserId = botIdentities.get(candidate.agentId)?.botUserId;
             if (botUserId !== undefined) {
                 byBotUser.set(botUserId, candidate.agentId);
-                held.set(candidate.agentId, 0);
+                held.set(candidate.agentId, Number.POSITIVE_INFINITY);
                 continue;
             }
             const spoke = candidate.lastSpokeAt === undefined ? Number.NaN : Date.parse(candidate.lastSpokeAt) / 1000;
-            held.set(candidate.agentId, Number.isFinite(spoke) ? spoke : 0);
+            held.set(candidate.agentId, Number.isFinite(spoke) ? spoke : Number.POSITIVE_INFINITY);
+        }
+        // Where each last held it, for a stop, which is for whoever was asked
+        // last (card 337), not for the thread's owner.
+        const last = new Map();
+        for (const [agentId, at] of held) {
+            last.set(agentId, Number.isFinite(at) ? at : 0);
         }
         const place = (agentId, at) => {
-            held.set(agentId, Math.max(held.get(agentId) ?? 0, at));
+            held.set(agentId, Math.min(held.get(agentId) ?? Number.POSITIVE_INFINITY, at));
+            last.set(agentId, Math.max(last.get(agentId) ?? 0, at));
         };
-        let foreign = 0;
+        let foreign = Number.POSITIVE_INFINITY;
+        let lastForeign = 0;
+        // Each of these agents' own messages, and whether the message before it
+        // had asked it anything: one nobody asked for is a judge taking the
+        // thread, or its owner answering in it (card 508).
+        const posts = [];
+        let asked = new Set();
+        const askedIn = (text) => new Set([...byBotUser].filter(([botUserId]) => mentions(text ?? '', botUserId)).map(([, agentId]) => agentId));
         try {
             let cursor;
             let pages = 0;
@@ -4063,14 +4402,35 @@ export const createSlackChannelAdapter = (options) => {
                     const own = message.user === undefined ? undefined : byBotUser.get(message.user);
                     if (own !== undefined) {
                         place(own, at);
+                        posts.push({ agentId: own, at, asked: asked.has(own) });
+                        // An agent here naming a colleague that answers its mentions
+                        // asks it, as `admitAgentMention` has it live, so the answer is
+                        // not a judge speaking unasked.
+                        const sender = message.user;
+                        const named = sender === undefined
+                            ? []
+                            : [...askedIn(message.text)].filter((agentId) => agentId !== own && answersAgentMention(agentId, parts.team, sender));
+                        if (named.length > 0) {
+                            asked = new Set(named);
+                        }
                         continue;
                     }
                     const bot = message.bot_id !== undefined || message.subtype === 'bot_message';
                     if (bot) {
                         // A bot's mention hands nothing over live (admit ignores bots),
                         // so here it is only another app speaking, or a peer's words.
-                        if (!isFleetBot(parts.team, message.user)) {
-                            foreign = Math.max(foreign, at);
+                        // A team agent's question to an agent here is not it taking the
+                        // thread, unless it started the thread with it: then the thread
+                        // is its own, as it is live.
+                        const asks = asksAgentHere(parts.team, message.user, message.text);
+                        if (asks) {
+                            asked = askedIn(message.text);
+                        }
+                        if (!isFleetBot(parts.team, message.user) &&
+                            (!asks || message.ts === parts.thread) &&
+                            !startsThreadAsIntegration(parts.team, message.user, parts.thread, message.ts ?? '')) {
+                            foreign = Math.min(foreign, at);
+                            lastForeign = Math.max(lastForeign, at);
                         }
                         continue;
                     }
@@ -4080,10 +4440,19 @@ export const createSlackChannelAdapter = (options) => {
                     if (sender === undefined) {
                         continue;
                     }
+                    asked = askedIn(message.text);
                     const named = agentNamedIn(message.text ?? '', parts.team, (agentId) => admitsSender(agentConfigFor(agentId), sender));
                     if (named !== undefined && held.has(named) && botIdentities.get(named)?.botUserId !== undefined) {
                         place(named, at);
                     }
+                    // A root that names nobody in a home channel is its owner's, as
+                    // the live home-channel rule has it.
+                    const home = message.ts === parts.thread && named === undefined
+                        ? homeOwners.get(`${parts.team}:${parts.conversation}`)
+                        : undefined;
+                    if (home !== undefined && held.has(home) && admitsSender(agentConfigFor(home), sender)) {
+                        place(home, at);
+                    }
                 }
                 cursor = page.response_metadata?.next_cursor || undefined;
             } while (cursor && pages < EARLIER_THREAD_PAGES);
@@ -4095,12 +4464,7 @@ export const createSlackChannelAdapter = (options) => {
             warn(`slack: could not read thread ${parts.thread} in ${parts.conversation} to see who spoke last, so it is routed as before: ${error instanceof Error ? error.message : String(error)}`);
             return undefined;
         }
-        return { held, foreign };
-    };
-    /** Whether another app spoke in the thread after `agentId` last held it. */
-    const foreignSpokeSince = async (agentId, parts, ts, lastSpokeAt) => {
-        const read = await threadPositions([{ agentId, ...(lastSpokeAt !== undefined ? { lastSpokeAt } : {}) }], parts, ts);
-        return read !== undefined && read.foreign > (read.held.get(agentId) ?? 0);
+        return { held, last, foreign, lastForeign, posts };
     };
     /**
      * Which of this process's agents a message names, or undefined if it
@@ -4166,25 +4530,19 @@ export const createSlackChannelAdapter = (options) => {
      * restart forgets nothing.
      *
      * Whose turn it is, is the second. In a thread with several agents an
-     * unaddressed reply belongs to **whoever spoke last**, the way it does
-     * between people: answer the voice that just answered you, and tag
-     * someone by name to change that. `lastSpokeAt` orders them — when each
-     * agent last *replied*, not when its session last changed, because a turn
-     * saves on tool results and approval checkpoints without having said
-     * anything, and a recovery resuming after a restart lands in exactly this
-     * window.
+     * unaddressed reply belongs to the agent the thread belongs to (card
+     * 508): the first to hold it, read off the thread itself. Only when the
+     * thread can't be read do the sessions decide, and then by `lastSpokeAt`
+     * — when each agent last *replied*, not when its session last changed,
+     * because a turn saves on tool results and approval checkpoints without
+     * having said anything — since that is the only order they keep.
      *
      * Nobody is the answer only when the agents cannot be *ordered* — nothing
-     * in the thread has spoken (a host whose routing carries no `lastSpokeAt`
-     * at all reads this way, and so does a thread where every agent is still
-     * on its first turn), or the newest two tie — because guessing there
-     * would put two answers under one message. An agent that simply has not
-     * spoken is a different thing and is skipped rather than fatal: it cannot
-     * have spoken last, and letting it silence the agent that did would leave
-     * a reply nobody answers. The agent alone in its thread, which is nearly
-     * every thread, is answered without the question arising.
+     * in the thread has spoken, or two tie — because guessing there would put
+     * two answers under one message. The agent alone in its thread, which is
+     * nearly every thread, is answered without the question arising.
      */
-    const resolveFollowUpWinner = async (parts, ts) => {
+    const resolveFollowUpWinner = async (parts, ts, mode = 'reply') => {
         const gateway = gatewayRef;
         if (!gateway?.sessionRouting || !parts.thread) {
             return undefined;
@@ -4262,22 +4620,107 @@ export const createSlackChannelAdapter = (options) => {
             }
             for (const [agentId, identity] of botIdentities) {
                 if (identity.teamId === parts.team && identity.botUserId === parts.parentUser) {
-                    return await foreignSpokeSince(agentId, parts, ts, undefined) ? undefined : agentId;
+                    noteOrigin(threadKeyFor(parts), agentId);
+                    return agentId;
                 }
             }
             return undefined;
         }
-        if (engaged.length === 1) {
-            return await foreignSpokeSince(first.agentId, parts, ts, first.lastSpokeAt) ? undefined : first.agentId;
+        // The thread says who it belongs to: whichever of these agents held it
+        // first — its first message named it, or it posted there first — or
+        // another app that spoke before any of them did (card 508). When it
+        // can't be read, the sessions decide: the only agent in it, or, as a
+        // last resort, the one that spoke last, which is all they record.
+        // The agent that posted the root takes part even with no session here:
+        // a post made through message.send or a schedule leaves none, and a
+        // colleague named under it since must not look like the owner.
+        const candidates = [...engaged];
+        if (parts.parentUser !== undefined) {
+            for (const [agentId, identity] of botIdentities) {
+                if (identity.teamId === parts.team && identity.botUserId === parts.parentUser && !candidates.some((entry) => entry.agentId === agentId)) {
+                    candidates.push({ agentId });
+                }
+            }
+        }
+        const read = await threadPositions(candidates, parts, ts);
+        if (!read) {
+            return engaged.length === 1 ? first.agentId : lastSpeaker(engaged);
+        }
+        if (mode === 'stop') {
+            // A stop is for whoever was asked last (card 337), as `holderAt` has
+            // it live: the turn it means is that agent's, not the owner's.
+            let holder;
+            let tiedLast = false;
+            for (const entry of candidates) {
+                const at = read.last.get(entry.agentId) ?? 0;
+                if (at <= 0) {
+                    continue;
+                }
+                if (!holder || at > holder.at) {
+                    holder = { agentId: entry.agentId, at };
+                    tiedLast = false;
+                }
+                else if (at === holder.at) {
+                    tiedLast = true;
+                }
+            }
+            if (!holder) {
+                return read.lastForeign > 0 ? undefined : (engaged.length === 1 ? first.agentId : lastSpeaker(engaged));
+            }
+            return tiedLast || read.lastForeign > holder.at ? undefined : holder.agentId;
+        }
+        let owner;
+        let tiedAt = false;
+        for (const entry of candidates) {
+            const at = read.held.get(entry.agentId) ?? Number.POSITIVE_INFINITY;
+            if (!Number.isFinite(at) || at <= 0) {
+                continue;
+            }
+            if (!owner || at < owner.at) {
+                owner = { agentId: entry.agentId, at };
+                tiedAt = false;
+            }
+            else if (at === owner.at) {
+                tiedAt = true;
+            }
+        }
+        // A judging agent that spoke unasked took the thread, and the owner
+        // answering in it took it back, as live (card 508): the latest of those
+        // holds it. The live record of who took it is lost on a restart; the
+        // thread keeps it. Only a judge takes by speaking unasked, as only its
+        // turns are judged live; another agent's post there (a message.send)
+        // takes nothing.
+        const ownerId = owner && !tiedAt && !(read.foreign < owner.at) ? owner.agentId : undefined;
+        let taken;
+        for (const post of read.posts) {
+            const takes = post.agentId === ownerId || (!post.asked && listensOf(post.agentId) === 'judge');
+            if (takes && (!taken || post.at > taken.at)) {
+                taken = post;
+            }
+        }
+        if (taken && taken.agentId !== ownerId && (ownerId !== undefined || taken.at > read.foreign)) {
+            return taken.agentId;
+        }
+        if (!owner) {
+            return Number.isFinite(read.foreign) ? undefined : (engaged.length === 1 ? first.agentId : lastSpeaker(engaged));
+        }
+        if (ownerId === undefined) {
+            return undefined;
         }
+        noteOrigin(threadKeyFor(parts), ownerId);
+        return ownerId;
+    };
+    /**
+     * Of several agents in a thread, the one whose session says it spoke
+     * last — the sessions' only ordering, used when the thread itself can't
+     * be read. Undefined when nobody has spoken or the newest two tie, since
+     * guessing there would put two answers under one message.
+     */
+    const lastSpeaker = (engaged) => {
         let latest;
         let tied = false;
         for (const entry of engaged) {
             if (entry.lastSpokeAt === undefined) {
-                // In the thread, but has never said anything in it — mentioned and
-                // still on its first turn, or a turn that produced no text. It
-                // cannot be the one who spoke last, and it must not stop the agent
-                // that did from answering.
                 continue;
             }
             if (!latest || entry.lastSpokeAt > latest.lastSpokeAt) {
@@ -4288,34 +4731,7 @@ export const createSlackChannelAdapter = (options) => {
                 tied = true;
             }
         }
-        const bySession = tied ? undefined : latest?.agentId;
-        // Sessions date a reply by when it finished, the thread by where its
-        // placeholder went up, and an agent on another gateway may have spoken
-        // since: only the thread can say who holds it. When it can't be read,
-        // the sessions decide, as before.
-        const read = await threadPositions(engaged, parts, ts);
-        if (!read) {
-            return bySession;
-        }
-        let holder;
-        let tiedAt = false;
-        for (const entry of engaged) {
-            const at = read.held.get(entry.agentId) ?? 0;
-            if (at <= 0) {
-                continue;
-            }
-            if (!holder || at > holder.at) {
-                holder = { agentId: entry.agentId, at };
-                tiedAt = false;
-            }
-            else if (at === holder.at) {
-                tiedAt = true;
-            }
-        }
-        if (!holder) {
-            return read.foreign > 0 ? undefined : bySession;
-        }
-        return tiedAt || read.foreign > holder.at ? undefined : holder.agentId;
+        return tied ? undefined : latest?.agentId;
     };
     /**
      * `resolveFollowUpWinner`, resolved ONCE PER MESSAGE and shared by every
@@ -4335,13 +4751,15 @@ export const createSlackChannelAdapter = (options) => {
      * this after the winner has finished, and recomputing for that agent is
      * precisely the disagreement the memo exists to prevent.
      */
-    const followUpWinner = (parts, ts) => {
-        const key = `${threadKeyFor(parts)}:${ts}`;
+    const followUpWinner = (parts, ts, mode = 'reply') => {
+        // A stop asks a different question (whoever was asked last), so it
+        // gets its own verdict, the same for every agent that asks it.
+        const key = `${threadKeyFor(parts)}:${ts}${mode === 'stop' ? ':stop' : ''}`;
         const existing = coldVerdicts.get(key);
         if (existing) {
             return existing.verdict;
         }
-        const entry = { verdict: resolveFollowUpWinner(parts, ts), settled: false };
+        const entry = { verdict: resolveFollowUpWinner(parts, ts, mode), settled: false };
         coldVerdicts.set(key, entry);
         void entry.verdict.then(() => {
             entry.settled = true;
@@ -4388,11 +4806,179 @@ export const createSlackChannelAdapter = (options) => {
      * case, where by definition no message of this thread has been seen in
      * this process.
      */
+    /**
+     * Stop (card 337): cancels every turn this agent is running or has queued
+     * in this conversation, including messages still in intake, and says
+     * nothing was stopped when there was nothing to stop. Synchronous, and
+     * called off the intake chain before any dispatch, so a stop is never
+     * queued behind the turn it stops nor merged into the next one. The
+     * caller has checked that the sender is an approver: a stop throws away
+     * work someone else asked for.
+     *
+     * `fromIntake` is a stop that could only be placed on the intake chain,
+     * once the sessions named this agent (the cold case). Everything ahead of
+     * it on the chain has already been dispatched, and everything still in
+     * intake arrived after it, so it cancels the dispatched turns only.
+     */
+    const stopTurns = (connection, sessionId, userId, channel, fromIntake = false) => {
+        const running = renderers.get(sessionId) ?? [];
+        const inIntake = fromIntake ? 0 : intakeInFlight.get(sessionId) ?? 0;
+        if (running.length === 0 && inIntake === 0) {
+            return false;
+        }
+        for (const renderer of running) {
+            if (renderer.stoppedBy === undefined) {
+                renderer.stoppedBy = userId;
+                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${userId}`));
+            }
+        }
+        if (inIntake > 0) {
+            stopsBySession.set(sessionId, { count: (stopsBySession.get(sessionId)?.count ?? 0) + 1, by: userId });
+        }
+        log(`slack: ${userId} stopped ${running.length + inIntake} turn(s) of ${connection.config.agentId} in ${channel}`);
+        return true;
+    };
+    /**
+     * Agent mentions admitted per thread since a person last spoke there, by
+     * message ts (card 513). A copy of one message reaching a second socket,
+     * or redelivered, is the same hop. Bounded like the addressee map.
+     */
+    const agentHops = new Map();
+    /**
+     * Which team agent a bot user in `team` is, for the agent configured by
+     * `config` in workspace `agentTeam`, if any. A configured id counts only
+     * in that agent's own workspace: user ids are unique per workspace, so the
+     * same id elsewhere is some other bot.
+     */
+    const teamAgentFor = (config, agentTeam, team, botUser) => {
+        for (const [agentId, identity] of botIdentities) {
+            if (identity.teamId === team && identity.botUserId === botUser) {
+                return agentId;
+            }
+        }
+        if (agentTeam === undefined || agentTeam !== team) {
+            return undefined;
+        }
+        for (const [name, id] of Object.entries(config.agentMentions?.team ?? {})) {
+            if (id === botUser) {
+                return name;
+            }
+        }
+        return undefined;
+    };
+    /**
+     * Whether `agentId` answers a mention from `botUser` in `team`: it has
+     * agent mentions on, the bot is a team agent to it, and on its list if it
+     * keeps one. The hop limit is not asked here.
+     */
+    const answersAgentMention = (agentId, team, botUser) => {
+        const config = agentConfigFor(agentId);
+        const settings = config?.agentMentions;
+        if (!config || !settings) {
+            return false;
+        }
+        const name = teamAgentFor(config, botIdentities.get(agentId)?.teamId, team, botUser);
+        return name !== undefined && (settings.only === undefined || settings.only.includes(name));
+    };
+    /**
+     * A message another agent's bot posted, for an agent that answers team
+     * agents (`agentMentions`, card 513). Admitted only when it names this
+     * agent, comes from a team agent this one listens to, and the thread is
+     * under its hop limit; anything else from a bot is dropped, as every
+     * bot message was before. Never part of the holder rule: a bot naming an
+     * agent asks it one thing, and hands it nothing.
+     */
+    const admitAgentMention = (connection, args) => {
+        const event = args.event;
+        const settings = connection.config.agentMentions;
+        if (!settings || !event || event.user === undefined || event.user === connection.botUserId) {
+            return undefined;
+        }
+        if ((event.type !== 'app_mention' && event.type !== 'message') || event.channel_type === 'im') {
+            return undefined;
+        }
+        if (event.subtype !== undefined && !AGENT_SPEECH_SUBTYPES.has(event.subtype)) {
+            return undefined;
+        }
+        const text = event.text ?? '';
+        if (!mentions(text, connection.botUserId)) {
+            return undefined;
+        }
+        const team = args.body?.team_id ?? connection.teamId;
+        const name = teamAgentFor(connection.config, connection.teamId, team, event.user);
+        if (name === undefined) {
+            return undefined;
+        }
+        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
+        if (settings.only !== undefined && !settings.only.includes(name)) {
+            if (!alreadySeen(eventKey)) {
+                log(`slack: ${connection.config.agentId} ignored a mention from agent ${name}: not on its agent mention list`);
+            }
+            return undefined;
+        }
+        const thread = event.thread_ts ?? event.ts;
+        const threadKey = threadKeyFor({ team, conversation: event.channel, thread });
+        const hops = agentHops.get(threadKey) ?? [];
+        if (!hops.includes(event.ts)) {
+            if (hops.length >= AGENT_MENTION_HOP_LIMIT) {
+                if (!alreadySeen(eventKey)) {
+                    log(`slack: ${connection.config.agentId} ignored a mention from agent ${name}: the thread reached its hop limit of ${AGENT_MENTION_HOP_LIMIT} agent mentions; a person has to speak there first`);
+                }
+                return undefined;
+            }
+            agentHops.delete(threadKey);
+            agentHops.set(threadKey, [...hops, event.ts]);
+            if (agentHops.size > THREAD_ADDRESSEE_CAPACITY) {
+                const oldest = agentHops.keys().next();
+                if (!oldest.done) {
+                    agentHops.delete(oldest.value);
+                }
+            }
+        }
+        if (alreadySeen(eventKey)) {
+            return undefined;
+        }
+        return {
+            event,
+            isDm: false,
+            team,
+            eventKey,
+            userId: event.user,
+            sessionId: channelSessionKey({ channel: 'slack', agentId: connection.config.agentId, team, conversation: event.channel, thread }),
+            thread,
+            threadKey,
+            settled: true,
+            overhear: false,
+            judge: false,
+            fromAgent: name,
+        };
+    };
     const admit = (connection, args) => {
         const event = args.event;
         if (gatewayRef) {
+            noteThreadStart(connection, args);
             noteForeignSpeaker(connection, args);
         }
+        if (gatewayRef && event && (event.bot_id !== undefined || event.subtype === 'bot_message')) {
+            return admitAgentMention(connection, args);
+        }
+        if (event && event.user !== undefined && event.channel_type !== 'im' && isPersonSpeaking(event) && admitsSender(connection.config, event.user)) {
+            // A person this agent admits, speaking in a thread, ends a run of
+            // agent mentions there. Someone it refuses can't restart one. Only
+            // hops before the person's message reset: another agent's socket can
+            // deliver an older human message late, after newer hops.
+            const hopKey = threadKeyFor({ team: args.body?.team_id ?? connection.teamId, conversation: event.channel, thread: event.thread_ts ?? event.ts });
+            const hops = agentHops.get(hopKey);
+            if (hops) {
+                const newer = hops.filter((hop) => compareSlackTs(hop, event.ts) > 0);
+                if (newer.length > 0) {
+                    agentHops.set(hopKey, newer);
+                }
+                else {
+                    agentHops.delete(hopKey);
+                }
+            }
+        }
         if (!gatewayRef || !event || !event.user || event.bot_id || !isPersonSpeaking(event)) {
             return undefined;
         }
@@ -4496,8 +5082,34 @@ export const createSlackChannelAdapter = (options) => {
         // Consuming the key here is safe because a refused message records
         // nothing a later copy could be needed for.
         if (!admitsSender(connection.config, sender)) {
+            // An approver the operator did not list as a principal can still stop
+            // the agent (card 337): approving is its own grant. Only when the
+            // message names this agent (or is a DM to it), and nothing else they
+            // say gets through.
+            if (addressed &&
+                (connection.config.approvers ?? []).includes(sender) &&
+                isStopRequest(text, connection.botUserId) &&
+                !alreadySeen(eventKey)) {
+                const stopSession = channelSessionKey({
+                    channel: 'slack',
+                    agentId: connection.config.agentId,
+                    team,
+                    conversation: event.channel,
+                    ...(thread ? { thread } : {}),
+                });
+                if (stopTurns(connection, stopSession, sender, event.channel)) {
+                    return undefined;
+                }
+                log(`slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`);
+                return undefined;
+            }
             const refusal = `slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`;
-            const held = threadKey !== undefined ? holderAt(threadKey, event.ts) : undefined;
+            // Whose message this is, as for an admitted one: the thread's owner's
+            // (card 508), or for a stop, whoever was asked last (card 337).
+            const refusedStop = (connection.config.approvers ?? []).includes(sender) && isStopRequest(text, connection.botUserId);
+            const held = threadKey === undefined
+                ? undefined
+                : (refusedStop ? holderAt(threadKey, event.ts) : undefined) ?? ownerAt(threadKey, event.ts);
             if (addressed || held === connection.config.agentId) {
                 if (!alreadySeen(eventKey)) {
                     log(refusal);
@@ -4516,7 +5128,7 @@ export const createSlackChannelAdapter = (options) => {
                     conversation: event.channel,
                     thread,
                     ...(event.parent_user_id !== undefined ? { parentUser: event.parent_user_id } : {}),
-                }, event.ts).then((winner) => {
+                }, event.ts, refusedStop ? 'stop' : 'reply').then((winner) => {
                     if (winner === connection.config.agentId) {
                         log(refusal);
                     }
@@ -4592,16 +5204,37 @@ export const createSlackChannelAdapter = (options) => {
         // "whose is an untagged reply", and for these two agents the soul has
         // already answered.
         const listens = listensOf(connection.config.agentId);
-        if (listens === 'mentions') {
-            return { ...admission, overhear: true };
-        }
-        if (listens === 'judge') {
-            return { ...admission, overhear: true, judge: true };
+        if (listens === 'mentions' || listens === 'judge') {
+            // Except a stop (card 337): the holder rule decides whose it is, as
+            // for any agent, and it only acts if there is something to stop. A
+            // thread the record has forgotten is left to the sessions, as below,
+            // so a stop for a turn that outlived its record still reaches it.
+            const approverStop = threadKey !== undefined &&
+                (connection.config.approvers ?? []).includes(sender) &&
+                isStopRequest(text, connection.botUserId);
+            const stopHolder = approverStop ? holderAt(threadKey, event.ts) : undefined;
+            // A stop held by another agent is only heard: judging it would let an
+            // attentive agent take a turn on a stop that was never its own.
+            const stopForAnother = stopHolder !== undefined && stopHolder !== connection.config.agentId;
+            return {
+                ...admission,
+                overhear: true,
+                ...(listens === 'judge' && !stopForAnother ? { judge: true } : {}),
+                ...(stopHolder === connection.config.agentId ? { holderStop: true } : {}),
+                ...(approverStop && stopHolder === undefined ? { settled: false } : {}),
+            };
         }
         // The record is what this process has actually seen, in the order it
         // saw it — right even inside the window before a handover reaches the
-        // store.
-        const holder = threadKey === undefined ? undefined : holderAt(threadKey, event.ts);
+        // store. Whose an untagged reply is, is the thread's owner's (card
+        // 508), not the last speaker's — except a stop, which is for whoever
+        // was asked last, since that is the turn it means (card 337).
+        const stopRequest = threadKey !== undefined &&
+            (connection.config.approvers ?? []).includes(sender) &&
+            isStopRequest(text, connection.botUserId);
+        const holder = threadKey === undefined
+            ? undefined
+            : (stopRequest ? holderAt(threadKey, event.ts) : undefined) ?? ownerAt(threadKey, event.ts);
         if (holder !== undefined && threadKey !== undefined) {
             if (holder !== connection.config.agentId) {
                 // Standing down for the holder, whether or not the holder can still
@@ -4652,6 +5285,19 @@ export const createSlackChannelAdapter = (options) => {
             return;
         }
         const { event, isDm, team, userId, thread, sessionId, threadKey, eventKey } = admitted;
+        // Stop (card 337), see `stopTurns`. Only a message addressed to this
+        // agent: an untagged reply this agent merely overhears is the holder's
+        // (unless this agent is the holder and only `listens` made it an
+        // overhear, see `holderStop`), and one only the sessions can place is
+        // not this agent's to act on yet.
+        if ((!admitted.overhear || admitted.holderStop === true) &&
+            admitted.settled &&
+            admitted.fromAgent === undefined &&
+            (connection.config.approvers ?? []).includes(userId) &&
+            isStopRequest(event.text ?? '', connection.botUserId) &&
+            stopTurns(connection, sessionId, userId, event.channel)) {
+            return;
+        }
         // What the gateway knows this message by (see `dispatchKeyFor`).
         const dispatchKey = dispatchKeyFor(eventKey);
         // Everything up to (and including) the dispatch call is serialized per
@@ -4661,6 +5307,30 @@ export const createSlackChannelAdapter = (options) => {
         // reverse order in durable history. The chain is claimed here,
         // synchronously, so a message's place in it is fixed by when Slack
         // delivered it and not by how long anything it does takes.
+        const stopsAtClaim = stopsBySession.get(sessionId)?.count ?? 0;
+        // Only intake that can still become a turn is something a stop can
+        // cancel. A settled overhear that is not judged only ever reaches
+        // `gateway.observe`, so counting it would let a stop with nothing to
+        // stop be consumed instead of passing on as an ordinary message.
+        const mayRun = !admitted.overhear || admitted.judge || !admitted.settled;
+        if (mayRun) {
+            intakeInFlight.set(sessionId, (intakeInFlight.get(sessionId) ?? 0) + 1);
+        }
+        let leftIntake = !mayRun;
+        const leaveIntake = () => {
+            if (leftIntake) {
+                return;
+            }
+            leftIntake = true;
+            const left = (intakeInFlight.get(sessionId) ?? 1) - 1;
+            if (left > 0) {
+                intakeInFlight.set(sessionId, left);
+            }
+            else {
+                intakeInFlight.delete(sessionId);
+                stopsBySession.delete(sessionId);
+            }
+        };
         const intake = onIntakeChain(sessionId, async () => {
             // The durable half of addressing runs INSIDE the chain, for the same
             // reason: it awaits, and a message that had to ask the sessions must
@@ -4695,21 +5365,36 @@ export const createSlackChannelAdapter = (options) => {
             if (!admitted.settled) {
                 // One verdict for this message, shared with whichever other agents
                 // are asking about it — see `followUpWinner`.
+                const stop = (connection.config.approvers ?? []).includes(userId) &&
+                    isStopRequest(event.text ?? '', connection.botUserId);
                 const winner = await followUpWinner({
                     team,
                     conversation: event.channel,
                     thread: event.thread_ts ?? '',
                     ...(event.parent_user_id !== undefined ? { parentUser: event.parent_user_id } : {}),
-                }, event.ts);
+                }, event.ts, stop ? 'stop' : 'reply');
                 if (winner !== connection.config.agentId) {
                     // Not this agent's to answer — and, if it is in the thread,
-                    // this agent's to hear, same as the two warm stand-downs.
+                    // this agent's to hear, same as the two warm stand-downs. Only a
+                    // stop sends a judging agent here, and a stop the sessions place
+                    // with another agent is heard, never judged, as it is warm.
+                    judged = false;
                     overhear = true;
                 }
-                else if (threadKey) {
-                    // Answered from the store rather than from memory: hold it, so
-                    // the rest of the thread is ordered by receipt like any other.
-                    rememberAddressee(threadKey, connection.config.agentId, event.ts);
+                else {
+                    if (threadKey) {
+                        // Answered from the store rather than from memory: hold it, so
+                        // the rest of the thread is ordered by receipt like any other.
+                        rememberAddressee(threadKey, connection.config.agentId, event.ts);
+                    }
+                    // Stop (card 337) for a message only the sessions could place:
+                    // now that they say it is this agent's, it is a stop like the
+                    // warm one above, not a message to queue behind the turn it stops.
+                    if ((connection.config.approvers ?? []).includes(userId) &&
+                        isStopRequest(event.text ?? '', connection.botUserId) &&
+                        stopTurns(connection, sessionId, userId, event.channel, true)) {
+                        return undefined;
+                    }
                 }
             }
             const cleaned = await humanizeMentions(connection, event.text ?? '');
@@ -4737,7 +5422,7 @@ export const createSlackChannelAdapter = (options) => {
             const { texts, saved, unread } = overhear || judged
                 ? { texts: [], saved: [], unread: notImages }
                 : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons, options.attachmentStore
-                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, senderTrustFor(connection.config, userId), options.now ?? Date.now)
+                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, admitted.fromAgent !== undefined ? 'unknown' : senderTrustFor(connection.config, userId), options.now ?? Date.now)
                     : undefined);
             // An image or a document with nothing said is still a question
             // ("what's this?"); a file the turn could not open with nothing said
@@ -4745,7 +5430,14 @@ export const createSlackChannelAdapter = (options) => {
             if (cleaned.length === 0 && images.length === 0 && texts.length === 0 && saved.length === 0) {
                 return undefined;
             }
-            const author = await authorFor(connection, userId);
+            // A team agent goes by the name the operator gave it, not a profile
+            // its own app chose.
+            // A team agent's daemon hears only what tags its bot (card 513), so
+            // the model gets that tag and decides whether its answer needs it
+            // (Dylan, 2026-10-15: the model tags back, the adapter never does).
+            const author = admitted.fromAgent !== undefined
+                ? `${admitted.fromAgent} (an agent; it sees your answer only if you tag <@${userId}>)`
+                : await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
             // unambiguous. A bare image in a channel still says who sent it.
             const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
@@ -4756,7 +5448,10 @@ export const createSlackChannelAdapter = (options) => {
             // `unknown` exactly as a channel mention would be. The same label
             // whether the agent answers or only hears: the text is in its
             // transcript either way.
-            const senderTrust = senderTrustFor(connection.config, userId);
+            // A team agent is below a principal whatever the list says: its
+            // words carry whatever its own session was exposed to, which nothing
+            // here can see (card 513).
+            const senderTrust = admitted.fromAgent !== undefined ? 'unknown' : senderTrustFor(connection.config, userId);
             // Who can read this, so the agent writes for them, and a thread says
             // it is one. A DM names the other person only when they are one of
             // the operator's principals: this lands in the system prompt, and
@@ -4889,6 +5584,14 @@ export const createSlackChannelAdapter = (options) => {
             const queue = renderers.get(sessionId) ?? [];
             queue.push(renderer);
             renderers.set(sessionId, queue);
+            // Stopped while its lookups ran: dispatched under an aborted signal,
+            // so it ends the way a queued turn a stop reached does.
+            const stopped = stopsBySession.get(sessionId);
+            leaveIntake();
+            if (stopped !== undefined && stopped.count !== stopsAtClaim && renderer.stoppedBy === undefined) {
+                renderer.stoppedBy = stopped.by;
+                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${stopped.by}`));
+            }
             // In a DM each message is its own status key, and Slack stops showing
             // the running turn's once a newer message sits below it — so a
             // message queued there that stayed dark read as the agent having
@@ -4906,6 +5609,7 @@ export const createSlackChannelAdapter = (options) => {
                 ...(earlier.length > 0 ? { earlier } : {}),
                 turnId: renderer.turnId,
                 metadata,
+                signal: renderer.controller.signal,
                 // A redelivery this process no longer remembers (it restarted, or
                 // the dedupe evicted it) is still the message it was: the gateway
                 // runs no second turn for it, and says so through `onRepeat`.
@@ -4922,6 +5626,8 @@ export const createSlackChannelAdapter = (options) => {
             });
             return { renderer, turn, repeat: () => repeat, absorbed: () => absorbed };
         });
+        // Whatever way the intake ended, it is no longer in flight.
+        void intake.then(leaveIntake, leaveIntake);
         const started = await intake;
         if (!started) {
             return;
@@ -5058,7 +5764,12 @@ export const createSlackChannelAdapter = (options) => {
                 // the reader's next untagged message is for the lower of the two.
                 // Late, either way, for a message typed while the turn was still
                 // running, which the other may therefore still take.
-                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
+                // Under the owner rule (card 508) only two replies move the thread:
+                // a judging agent that chose to speak, and the owner answering in
+                // its own thread, which takes it back from a judge that spoke above.
+                // An answer to a mention is that message's answer and no more.
+                const takes = renderer.lazy || threadOwner(threadKey) === connection.config.agentId;
+                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts, takes);
             }
             // The reply just posted took the thread's status down with it, and a
             // turn queued behind this one is still working.
@@ -5071,12 +5782,16 @@ export const createSlackChannelAdapter = (options) => {
             // not a failure of the agent. Matched by name, as this package does
             // not import the gateway. A turn nobody asked for stays silent.
             const pausedReply = failure instanceof Error && failure.name === 'IntakePausedError';
-            const { spoke, spokeAt } = pausedReply
-                ? await renderer.finalize(renderer.lazy ? '' : failure.message)
-                : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            const { spoke, spokeAt } = renderer.stoppedBy !== undefined
+                ? await renderer.stopped(renderer.stoppedBy)
+                : pausedReply
+                    ? await renderer.finalize(renderer.lazy ? '' : failure.message)
+                    : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
             if (spoke && threadKey !== undefined) {
-                // A file it posted before breaking is still the last thing said.
-                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
+                // A file it posted before breaking has still spoken, by the same
+                // rule as a reply that landed.
+                const takes = renderer.lazy || threadOwner(threadKey) === connection.config.agentId;
+                rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts, takes);
             }
             renderers.get(sessionId)?.[0]?.refreshLoading();
         }
@@ -5085,6 +5800,9 @@ export const createSlackChannelAdapter = (options) => {
         name: 'slack',
         resolveOutbound,
         readConversation,
+        // A channel id is unique only within its workspace, so a standing
+        // grant on one is bound to the team the agent's app authenticated in.
+        accountFor: (agentId) => botIdentities.get(agentId)?.teamId || undefined,
         requestCredential,
         async start(gateway) {
             gatewayRef = gateway;