@stratusagent/channel-slack 0.12.6 → 0.13.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { lstat, mkdir, open, readdir, readFile, realpath } from 'node:fs/promises';
+import { lstat, mkdir, open, readdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, RunAbortedError, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
@@ -55,6 +55,17 @@ const THREAD_SENDER_CAPACITY = 64;
  * socket stays behind for all of them.
  */
 const THREAD_HANDOVER_DEPTH = 32;
+/**
+ * How far past this host's clock at `start()` claims count as seen live
+ * (card 562). Slack stamps messages by its own clock, so a host clock
+ * behind Slack's would date a message sent just before the restart as
+ * after it, and a read stopping there would look complete. Reads for
+ * messages in this first stretch are treated as stopping short, which
+ * costs a thread read or two, never a wrong placement.
+ */
+const LIVE_FROM_MARGIN_MS = 60_000;
+/** `liveFrom` while `start()` runs: later than any message. */
+const NOT_LIVE_YET = '9999999999.999999';
 /**
  * How many agent mentions one thread admits in a row before a person has
  * to speak there again (card 513): enough for a question, an answer and a
@@ -114,6 +125,33 @@ const EARLIER_CHANNEL_LIMIT = 20;
 const EARLIER_CHANNEL_READ = 100;
 /** The most pages read to find them: 1,000 messages. */
 const EARLIER_CHANNEL_PAGES = 10;
+/** What a person who wrote during a restart is told, when it was kept. */
+export const RESTARTING_REPLY_TEXT = "I'm restarting right now. I'll answer this as soon as I'm back.";
+/** The same, for a daemon that is stopping rather than restarting. */
+export const STOPPING_REPLY_TEXT = "I'm shutting down right now. I'll answer this when I'm started again.";
+/**
+ * How old a kept message may be and still be answered at start: a daemon
+ * stopped for a week does not wake up to answer last week's questions.
+ */
+const PENDING_INTAKE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * How long the start-up replay waits on Slack to read one kept message
+ * back. Past it, that message (and any kept after it in its conversation)
+ * is left for the next start rather than answered late; see `replayHolds`.
+ */
+const REPLAY_READ_MAX_MS = 10_000;
+/** The most messages kept at once; past it, a new one is refused, not kept. */
+const PENDING_INTAKE_MAX = 200;
+const isPendingIntake = (value) => {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const entry = value;
+    const optionalString = (field) => field === undefined || typeof field === 'string';
+    return typeof entry.agentId === 'string' && typeof entry.team === 'string' && typeof entry.channel === 'string'
+        && typeof entry.ts === 'string' && typeof entry.user === 'string' && typeof entry.keptAt === 'number'
+        && optionalString(entry.threadTs) && optionalString(entry.channelType);
+};
 // Lazy (and CJS-interoperable) so tests with injected fakes never load the
 // real SDK stack.
 const requireModule = createRequire(import.meta.url);
@@ -1046,19 +1084,19 @@ class ReplyRenderer {
             // that would take the next turn's status down with it.
             await this.statusChain;
         }
-        return this.outcome(published, landed || this.edited || this.uploaded || stranded);
+        return this.outcome(published, landed || this.edited || this.uploaded || stranded, !published);
     }
     placeText(ts) {
         if (ts !== undefined && (this.textAt === undefined || ts > this.textAt)) {
             this.textAt = ts;
         }
     }
-    outcome(published, spoke) {
+    outcome(published, spoke, refused = false) {
         const spokeAt = [this.textAt, this.uploadedAt]
             .filter((ts) => ts !== undefined)
             .sort()
             .at(-1);
-        return { published, spoke, ...(spoke && spokeAt !== undefined ? { spokeAt } : {}) };
+        return { published, spoke, ...(spoke && spokeAt !== undefined ? { spokeAt } : {}), ...(refused ? { refused: true } : {}) };
     }
     /**
      * Take back the placeholder a turn nobody asked for opened and then had
@@ -2188,6 +2226,13 @@ const compareSlackTs = (left, right) => {
     }
     return Math.sign(Number(leftMicros.padEnd(6, '0').slice(0, 6)) - Number(rightMicros.padEnd(6, '0').slice(0, 6)));
 };
+/** What a Slack stop aborts a turn with, followed by the stopper's user id. */
+const SLACK_STOP_REASON = 'Stopped from Slack by ';
+/**
+ * Who stopped a turn, read back from the error it failed with: the gateway
+ * fails an aborted turn with the abort's reason verbatim.
+ */
+const slackStopper = (error) => error?.startsWith(SLACK_STOP_REASON) ? error.slice(SLACK_STOP_REASON.length) || undefined : undefined;
 export const createSlackChannelAdapter = (options) => {
     const log = options.log ?? (() => { });
     const warn = options.warn ?? (() => { });
@@ -2283,6 +2328,26 @@ export const createSlackChannelAdapter = (options) => {
      * corrects it.
      */
     const threadAddressee = new Map();
+    /**
+     * Per thread whose record has been cut in the middle (`trimHandovers`),
+     * the first claim kept after the cut. Who held the thread between its
+     * first claim and that one is no longer known here (card 559): a message
+     * from then is left to the sessions and a thread read, rather than
+     * placed by the first claim, or the latest take, that outlived the cut.
+     * Goes with the thread's record.
+     */
+    const threadTrimmedUntil = new Map();
+    /**
+     * Per thread the record was warmed from a thread read (#369), the last
+     * message a read covered. A read stops at the message it places, so one
+     * for a message from before this process started (delivered late, or a
+     * replay after a restart) leaves out every take between that message and
+     * the start (card 562). `liveFrom` is when every socket was up, plus a
+     * margin for clock skew: claims since were seen live. Goes with the
+     * thread's record.
+     */
+    const threadReadUntil = new Map();
+    let liveFrom;
     /**
      * Threads whose owner this process can name (card 508): `true` for one
      * whose first message it saw, so the first claim in `threadAddressee` is
@@ -2422,6 +2487,332 @@ export const createSlackChannelAdapter = (options) => {
         inflight.add(settled);
         void settled.finally(() => inflight.delete(settled));
     };
+    /**
+     * The kept messages (see `pendingIntakePath`), read and written one change
+     * at a time so two refusals landing together cannot drop each other.
+     */
+    const pendingIntakePath = options.pendingIntakePath;
+    let pendingChain = Promise.resolve();
+    const readPending = async (file) => {
+        let raw;
+        try {
+            raw = await readFile(file, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return [];
+            }
+            throw error;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed)) {
+                return parsed.filter(isPendingIntake);
+            }
+        }
+        catch {
+            // Named below, and replaced by the next write.
+        }
+        warn(`slack: ${file} is not a list of kept messages; ignoring it`);
+        return [];
+    };
+    const changePending = (change) => {
+        const file = pendingIntakePath;
+        if (file === undefined) {
+            return Promise.reject(new Error('no pendingIntakePath'));
+        }
+        const run = pendingChain.then(async () => {
+            const before = await readPending(file);
+            const { entries, result } = change(before);
+            if (entries.length === 0) {
+                await rm(file, { force: true });
+            }
+            else {
+                // Whole or not at all: a crash mid-write must not leave half a list
+                // that the next start reads as no list.
+                const temporary = `${file}.${process.pid}.tmp`;
+                await writeFile(temporary, `${JSON.stringify(entries, null, 2)}\n`, { mode: 0o600 });
+                await rename(temporary, file);
+            }
+            return result;
+        });
+        pendingChain = run.catch(() => undefined);
+        return run;
+    };
+    const pendingKey = (entry) => `${entry.agentId}:${entry.team}:${entry.channel}:${entry.ts}`;
+    /**
+     * Kept messages being replayed, by `pendingKey`. A replayed message comes
+     * off the list only once its answer is confirmed (`answered`): an answer
+     * or failure Slack took, a turn that chose to say nothing, or the
+     * start-up recovery's own report of it reaching the thread. Every other
+     * way a handler can end leaves it kept, so a path that forgets to say
+     * how it went keeps the message rather than losing it. A message kept
+     * again by a restart during the replay (`rekept`) stays kept too. The
+     * next start hands it over again, and the gateway repeats the finished
+     * turn, so the answer is posted from the session rather than run again.
+     * `dispatched` and `refused` only choose the warning.
+     */
+    const replaying = new Map();
+    /** Notes a reply outcome against the kept message it answers, if that one is being replayed. */
+    const noteReplayOutcome = (connection, channel, ts, outcome) => {
+        const replay = replaying.get(pendingKey({ agentId: connection.config.agentId, team: connection.teamId, channel, ts }));
+        if (replay !== undefined) {
+            if (outcome.refused === true) {
+                replay.refused = true;
+            }
+            else {
+                replay.answered = true;
+            }
+        }
+        return outcome;
+    };
+    /** Confirms that a replayed message was answered by a report posted ahead of its own renderer. */
+    const noteReplayAnsweredAhead = (connection, channel, ts) => {
+        const replay = replaying.get(pendingKey({ agentId: connection.config.agentId, team: connection.teamId, channel, ts }));
+        if (replay !== undefined) {
+            replay.answered = true;
+        }
+    };
+    /**
+     * Live intake for a conversation (agent and channel) that has kept
+     * messages waits here until each of them has taken its place on its
+     * session's chain or been left for the next start, so a kept message is
+     * never answered after one sent later in the same conversation. Other
+     * conversations are not held. There is no timeout on the hold itself:
+     * the bound is on each read (`REPLAY_READ_MAX_MS`), and a read that
+     * outlasts it gives up its message for this run, which releases the hold.
+     */
+    const replayHolds = new Map();
+    const holdKey = (agentId, channel) => `${agentId}:${channel}`;
+    /**
+     * Whether `connection` is the one to replay `entry` through: the same
+     * agent in the workspace it was kept from. Channel and user ids belong to
+     * a workspace, so an agent whose credentials moved to another one leaves
+     * the entry kept (and its day-old expiry) rather than reading or answering
+     * whatever has that id there.
+     */
+    const keptFor = (connection, entry) => connection.config.agentId === entry.agentId && connection.teamId === entry.team;
+    const holdConversation = (key) => {
+        if (replayHolds.has(key)) {
+            return;
+        }
+        let release = () => { };
+        const held = new Promise((resolve) => {
+            release = () => {
+                replayHolds.delete(key);
+                resolve();
+            };
+        });
+        replayHolds.set(key, { held, release });
+    };
+    const releaseConversation = (key) => replayHolds.get(key)?.release();
+    /** Aborted by `stop()`, which ends a replay still reading kept messages back. */
+    let replayStopping;
+    const releaseAllConversations = () => {
+        for (const { release } of [...replayHolds.values()]) {
+            release();
+        }
+    };
+    /** Keeps a refused message for the next start; resolves with whether it was kept. */
+    const keepForNextStart = async (entry) => {
+        if (pendingIntakePath === undefined) {
+            return false;
+        }
+        try {
+            // Every kept message was told it will be answered, so a full list
+            // never evicts one of them: it makes room only from messages too old
+            // to be answered at start anyway, and otherwise refuses this one, which
+            // then gets the plain refusal and no promise.
+            const { full, expired } = await changePending((entries) => {
+                const key = pendingKey(entry);
+                let others = entries.filter((existing) => pendingKey(existing) !== key);
+                let expired = [];
+                if (others.length >= PENDING_INTAKE_MAX) {
+                    const cutoff = now() - PENDING_INTAKE_MAX_AGE_MS;
+                    expired = others.filter((existing) => existing.keptAt < cutoff);
+                    others = others.filter((existing) => existing.keptAt >= cutoff);
+                }
+                if (others.length >= PENDING_INTAKE_MAX) {
+                    return { entries, result: { full: true, expired: [] } };
+                }
+                return { entries: [...others, entry], result: { full: false, expired } };
+            });
+            for (const dropped of expired) {
+                log(`slack: ${dropped.agentId} dropped ${dropped.ts} in ${dropped.channel} kept from a restart: older than a day`);
+            }
+            if (full) {
+                warn(`slack: could not keep ${entry.ts} in ${entry.channel} for after the restart: ${PENDING_INTAKE_MAX} messages are already kept`);
+                return false;
+            }
+            const replay = replaying.get(pendingKey(entry));
+            if (replay !== undefined) {
+                replay.rekept = true;
+            }
+            return true;
+        }
+        catch (error) {
+            warn(`slack: could not keep ${entry.ts} in ${entry.channel} for after the restart: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    };
+    /** The kept message itself, as Slack has it now; `undefined` when it is gone. */
+    const fetchKept = async (connection, entry) => {
+        const { history, replies } = connection.web.conversations;
+        const inThread = entry.threadTs !== undefined && entry.threadTs !== entry.ts;
+        const range = { channel: entry.channel, oldest: entry.ts, latest: entry.ts, inclusive: true };
+        const page = inThread
+            ? await replies?.call(connection.web.conversations, { ...range, ts: entry.threadTs, limit: 2 })
+            : await history?.call(connection.web.conversations, { ...range, limit: 1 });
+        if (page === undefined) {
+            throw new Error('this Slack client cannot read conversations');
+        }
+        return page.messages?.find((message) => message.ts === entry.ts);
+    };
+    /** One kept message read back with a bound; `timedOut` when Slack took longer than that. */
+    const fetchKeptWithin = async (connection, entry) => {
+        let timer;
+        const late = new Promise((resolve) => {
+            timer = setTimeout(() => resolve({ timedOut: true }), REPLAY_READ_MAX_MS);
+        });
+        try {
+            return await Promise.race([
+                fetchKept(connection, entry).then((message) => (message !== undefined ? { message } : {})),
+                late,
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    /**
+     * What the last daemon kept, handled as if it had just arrived: through
+     * admission, the thread rules, and a dispatch keyed as the original
+     * delivery would have been, so a message the gateway already ran is a
+     * repeat there and not a second turn. That makes handing one over twice
+     * safe and losing one not, so each comes off the list only once its
+     * handler has reached the gateway and settled: a crash, or a failure
+     * before the dispatch (the reply could not be started), leaves it for the
+     * next start, and one kept again by a restart during the replay stays
+     * kept. A message deleted since is dropped.
+     *
+     * Each conversation is replayed in ts order while its live intake is held
+     * (`replayHolds`), and released once its kept messages are handed over.
+     * A read that fails or outlasts `REPLAY_READ_MAX_MS` leaves that message,
+     * and the ones kept after it in the conversation, for the next start:
+     * handing a later one over first, or the slow one over after live
+     * messages were let in, would answer them out of order.
+     */
+    const replayKept = async (kept, onEvent, stopping) => {
+        if (pendingIntakePath === undefined || kept.length === 0) {
+            return;
+        }
+        const cutoff = now() - PENDING_INTAKE_MAX_AGE_MS;
+        const expired = kept.filter((entry) => entry.keptAt < cutoff);
+        for (const entry of expired) {
+            log(`slack: ${entry.agentId} dropped ${entry.ts} in ${entry.channel} kept from a restart: older than a day`);
+        }
+        // Not waited on before the reads: the list's writes are serialized, so
+        // this one lands ahead of any the replay makes, and the reads start
+        // inside start() (a stop right after it still sees each conversation's
+        // first one through).
+        const old = new Set(expired.map(pendingKey));
+        const droppingExpired = expired.length > 0
+            ? changePending((entries) => ({ entries: entries.filter((entry) => !old.has(pendingKey(entry))), result: undefined }))
+                .catch((error) => warn(`slack: could not drop the day-old messages kept from a restart; the next start drops them: ${error instanceof Error ? error.message : String(error)}`))
+            : Promise.resolve();
+        const conversations = new Map();
+        for (const entry of kept.filter((candidate) => candidate.keptAt >= cutoff)) {
+            const elsewhere = connections.find((connection) => connection.config.agentId === entry.agentId && !keptFor(connection, entry));
+            if (elsewhere !== undefined) {
+                warn(`slack: ${entry.agentId} kept ${entry.ts} in ${entry.channel} from workspace ${entry.team}, but is now connected to ${elsewhere.teamId}; keeping it for a start in that workspace`);
+                continue;
+            }
+            const key = holdKey(entry.agentId, entry.channel);
+            conversations.set(key, [...(conversations.get(key) ?? []), entry]);
+        }
+        const handovers = [];
+        const replayConversation = async (key, entries) => {
+            try {
+                entries.sort((a, b) => compareSlackTs(a.ts, b.ts));
+                const agentId = entries[0].agentId;
+                const connection = connections.find((candidate) => keptFor(candidate, entries[0]));
+                const handle = onEvent.get(agentId);
+                if (connection === undefined || handle === undefined) {
+                    return;
+                }
+                for (const [index, entry] of entries.entries()) {
+                    // A stop ends the replay at the next message: what it has not read
+                    // yet stays kept for the next start, so the stop waits on at most
+                    // the one bounded read in progress per conversation, not a chain
+                    // of them.
+                    if (stopping.aborted) {
+                        log(`slack: ${agentId} stopping; leaving ${entries.length - index} kept message(s) in ${entry.channel} for the next start`);
+                        return;
+                    }
+                    let read;
+                    try {
+                        read = await fetchKeptWithin(connection, entry);
+                    }
+                    catch (error) {
+                        warn(`slack: could not read ${entry.ts} in ${entry.channel} kept from the last restart; keeping it and ${entries.length - index - 1} after it for the next start: ${error instanceof Error ? error.message : String(error)}`);
+                        return;
+                    }
+                    if (read.timedOut === true) {
+                        warn(`slack: reading ${entry.ts} in ${entry.channel} kept from the last restart took over ${REPLAY_READ_MAX_MS / 1000}s; keeping it and ${entries.length - index - 1} after it for the next start`);
+                        return;
+                    }
+                    const message = read.message;
+                    if (message === undefined) {
+                        const gone = pendingKey(entry);
+                        await changePending((current) => ({ entries: current.filter((kept) => pendingKey(kept) !== gone), result: undefined }));
+                        log(`slack: ${entry.agentId} dropped ${entry.ts} in ${entry.channel} kept from a restart: no longer in Slack`);
+                        continue;
+                    }
+                    log(`slack: ${entry.agentId} replaying ${entry.ts} in ${entry.channel}, sent during the last restart`);
+                    const event = {
+                        ...message,
+                        type: 'message',
+                        channel: entry.channel,
+                        ts: entry.ts,
+                        ...(entry.threadTs !== undefined ? { thread_ts: entry.threadTs } : {}),
+                        ...(entry.channelType !== undefined ? { channel_type: entry.channelType } : {}),
+                    };
+                    const replayKey = pendingKey(entry);
+                    const replay = { dispatched: false, rekept: false, refused: false, answered: false };
+                    replaying.set(replayKey, replay);
+                    // Not waited on: the handler claims its place on its session's
+                    // chain synchronously, as a live delivery does, so the next kept
+                    // message (and, after the last, the held live ones) queue behind it.
+                    const handled = handle({ ack: async () => { }, body: { team_id: entry.team }, event });
+                    handovers.push(handled.catch(() => undefined).then(async () => {
+                        replaying.delete(replayKey);
+                        if (replay.rekept) {
+                            return;
+                        }
+                        if (!replay.dispatched) {
+                            warn(`slack: ${entry.agentId} could not hand ${entry.ts} in ${entry.channel} kept from a restart to the gateway; keeping it for the next start`);
+                            return;
+                        }
+                        if (replay.refused) {
+                            warn(`slack: ${entry.agentId} could not post the answer to ${entry.ts} in ${entry.channel} kept from a restart; keeping it for the next start`);
+                            return;
+                        }
+                        if (!replay.answered) {
+                            warn(`slack: ${entry.agentId} has no confirmed answer to ${entry.ts} in ${entry.channel} kept from a restart; keeping it for the next start`);
+                            return;
+                        }
+                        await changePending((current) => ({ entries: current.filter((kept) => pendingKey(kept) !== replayKey), result: undefined }));
+                    }));
+                }
+            }
+            finally {
+                releaseConversation(key);
+            }
+        };
+        await Promise.all([...conversations].map(([key, entries]) => replayConversation(key, entries)));
+        await Promise.all(handovers);
+        await droppingExpired;
+    };
     const alreadySeen = (key) => {
         if (seenEvents.has(key)) {
             return true;
@@ -3660,6 +4051,11 @@ export const createSlackChannelAdapter = (options) => {
         return landed;
     };
     const reportUnrenderedFailure = async (event, behind, files) => {
+        // A turn no renderer here was showing (card 501) that a Slack stop
+        // aborted fails with the stop's own reason, so who stopped it is read
+        // from the failure itself rather than from a note an outcome may never
+        // come to clear.
+        const stoppedBy = slackStopper(event.error);
         const gateway = gatewayRef;
         if (!gateway?.sessionRouting) {
             return NOTHING_REPORTED;
@@ -3687,7 +4083,10 @@ export const createSlackChannelAdapter = (options) => {
         }
         const channel = metadata.slackChannel;
         const thread = typeof metadata.slackThread === 'string' ? metadata.slackThread : undefined;
-        if (routing.unaddressed === true && routing.reply === undefined) {
+        if (stoppedBy === undefined && routing.unaddressed === true && routing.reply === undefined) {
+            // A stop is someone asking, so a stopped turn always says who
+            // stopped it, judged or not.
+            //
             // A turn nobody asked for that said nothing before it broke — the
             // daemon died inside it, and the next start failed it with no
             // renderer here to keep quiet for it. The same rule as the lazy
@@ -3708,7 +4107,7 @@ export const createSlackChannelAdapter = (options) => {
             return { said: true, landed: await uploadUnrenderedFiles(connection, channel, thread, files) };
         }
         let landed = [];
-        const said = await postAheadOf(behind, connection, channel, thread, messageChunks(`Something went wrong: ${event.error}`), async () => {
+        const said = await postAheadOf(behind, connection, channel, thread, messageChunks(stoppedBy === undefined ? `Something went wrong: ${event.error}` : `Stopped by <@${stoppedBy}>.`), async () => {
             landed = await uploadUnrenderedFiles(connection, channel, thread, files);
         });
         return { said, landed };
@@ -4137,7 +4536,7 @@ export const createSlackChannelAdapter = (options) => {
      * Dropping that one would hand the thread back to its owner after enough
      * mentions of a third agent, while the judge that took it still answers.
      */
-    const trimHandovers = (handovers) => {
+    const trimHandovers = (key, handovers) => {
         if (handovers.length <= THREAD_HANDOVER_DEPTH) {
             return handovers;
         }
@@ -4153,6 +4552,13 @@ export const createSlackChannelAdapter = (options) => {
         // The kept take sits on top of the full recent tail, one past the depth,
         // so `holderAt` still sees every recent claim it saw before.
         const tail = handovers.slice(tailFrom);
+        // The cut only ever moves later: a claim inserted into the gap since
+        // is dropped again, and the gap it fell in stays unknown.
+        const until = tail[0].ts;
+        const before = threadTrimmedUntil.get(key);
+        if (before === undefined || before < until) {
+            threadTrimmedUntil.set(key, until);
+        }
         return latestTake > 0 && latestTake < tailFrom
             ? [first, handovers[latestTake], ...tail]
             : [first, ...tail];
@@ -4205,11 +4611,13 @@ export const createSlackChannelAdapter = (options) => {
         // Re-inserted rather than mutated in place: a Map iterates in insertion
         // order, which is what makes the first key the one to evict.
         threadAddressee.delete(key);
-        threadAddressee.set(key, trimHandovers(handovers));
+        threadAddressee.set(key, trimHandovers(key, handovers));
         if (threadAddressee.size > THREAD_ADDRESSEE_CAPACITY) {
             const oldest = threadAddressee.keys().next();
             if (!oldest.done) {
                 threadAddressee.delete(oldest.value);
+                threadTrimmedUntil.delete(oldest.value);
+                threadReadUntil.delete(oldest.value);
                 // The owner goes with the record of who took the thread since: an
                 // owner kept alone would stand in for a judge's takeover it no
                 // longer knows of, where the thread read would see it.
@@ -4231,9 +4639,48 @@ export const createSlackChannelAdapter = (options) => {
      * fresh read of the thread, never sent to the owner on a guess.
      */
     const stopHolderAt = (key, ts) => holderAt(key, ts);
+    /** Whether the record of thread `key` lost who held it at `ts` to a cut. */
+    const inTrimmedGap = (key, handovers, ts) => {
+        const until = threadTrimmedUntil.get(key);
+        const first = handovers[0];
+        return until !== undefined && first !== undefined && first.ts < ts && ts < until;
+    };
+    /**
+     * Records that a thread read of `key` covered every message before `ts`.
+     * Bounded on its own, since a read that found nobody's post leaves an
+     * owner and no record (Codex 4321103567). A thread whose mark is evicted
+     * loses its record and owner with it, so it is read afresh instead of
+     * placed from claims the read may have stopped short of.
+     */
+    const noteReadUntil = (key, ts) => {
+        const until = threadReadUntil.get(key);
+        threadReadUntil.delete(key);
+        threadReadUntil.set(key, until !== undefined && compareSlackTs(ts, until) < 0 ? until : ts);
+        if (threadReadUntil.size > THREAD_ADDRESSEE_CAPACITY) {
+            const oldest = threadReadUntil.keys().next();
+            if (!oldest.done) {
+                threadReadUntil.delete(oldest.value);
+                threadAddressee.delete(oldest.value);
+                threadTrimmedUntil.delete(oldest.value);
+                threadOrigins.delete(oldest.value);
+            }
+        }
+    };
+    /**
+     * Where the record of thread `key` stops knowing every take, for a
+     * message at `ts` after what a thread read covered (card 562): a claim
+     * older than the returned point may have been taken from since, unseen.
+     * Undefined when the record is complete as far as `ts`.
+     */
+    const unreadBefore = (key, ts) => {
+        const until = threadReadUntil.get(key);
+        return until !== undefined && liveFrom !== undefined && compareSlackTs(until, liveFrom) < 0 && compareSlackTs(ts, until) > 0
+            ? liveFrom
+            : undefined;
+    };
     const holderAt = (key, ts) => {
         const handovers = threadAddressee.get(key);
-        if (!handovers) {
+        if (!handovers || inTrimmedGap(key, handovers, ts)) {
             return undefined;
         }
         // The newest entry at or before `ts` answers, and only if this process
@@ -4241,10 +4688,11 @@ export const createSlackChannelAdapter = (options) => {
         // asked since may be a mention it cannot see, so it leaves the question
         // to a fresh read. And it is newer than every live entry before it, so
         // skipping it for one of those would answer with a claim it superseded.
+        const unread = unreadBefore(key, ts);
         for (let index = handovers.length - 1; index >= 0; index -= 1) {
             const handover = handovers[index];
             if (handover && handover.ts <= ts) {
-                return handover.cold === true ? undefined : handover.agentId;
+                return handover.cold === true || (unread !== undefined && compareSlackTs(handover.ts, unread) < 0) ? undefined : handover.agentId;
             }
         }
         return undefined;
@@ -4266,13 +4714,19 @@ export const createSlackChannelAdapter = (options) => {
     const ownerAt = (key, ts) => {
         const origin = threadOrigins.get(key);
         const handovers = threadAddressee.get(key) ?? [];
+        if (inTrimmedGap(key, handovers, ts)) {
+            return undefined;
+        }
+        // A take from before the stretch the read left out may have been
+        // superseded there: the question goes to a fresh read (card 562).
+        const unread = unreadBefore(key, ts);
         for (let index = handovers.length - 1; index >= 0; index -= 1) {
             const handover = handovers[index];
             if (handover && handover.ts <= ts && (handover.takes === true || (index === 0 && typeof origin !== 'string'))) {
-                return handover.agentId;
+                return unread !== undefined && compareSlackTs(handover.ts, unread) < 0 ? undefined : handover.agentId;
             }
         }
-        return typeof origin === 'string' ? origin : undefined;
+        return typeof origin === 'string' && unread === undefined ? origin : undefined;
     };
     /**
      * The agent the thread `key` belongs to, whoever holds it now: the owner
@@ -4798,6 +5252,7 @@ export const createSlackChannelAdapter = (options) => {
             for (const post of takeovers) {
                 rememberAddressee(key, post.agentId, post.ts, true, true);
             }
+            noteReadUntil(key, ts);
         };
         if (taken && taken.agentId !== ownerId && (ownerId !== undefined || taken.at > read.foreign)) {
             warm();
@@ -4925,19 +5380,30 @@ export const createSlackChannelAdapter = (options) => {
     const stopTurns = (connection, sessionId, userId, channel, fromIntake = false) => {
         const running = renderers.get(sessionId) ?? [];
         const inIntake = fromIntake ? 0 : intakeInFlight.get(sessionId) ?? 0;
-        if (running.length === 0 && inIntake === 0) {
-            return false;
-        }
+        const reason = `${SLACK_STOP_REASON}${userId}`;
         for (const renderer of running) {
             if (renderer.stoppedBy === undefined) {
                 renderer.stoppedBy = userId;
-                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${userId}`));
-            }
+                renderer.controller.abort(new RunAbortedError(reason));
+            }
+        }
+        // Also a turn no renderer of this process started (card 501): one the
+        // gateway recovered after a restart, or another caller's on this
+        // session. The gateway counts every turn still on the session, one
+        // already stopping included, so a repeated stop while a stopped turn
+        // winds down is still a stop, and once it has ended, however it ended,
+        // a stop with nothing running is an ordinary message. The renderers'
+        // started turns are among those counted.
+        const onSession = gatewayRef?.abortTurns?.(sessionId, reason) ?? 0;
+        if (running.length === 0 && inIntake === 0 && onSession === 0) {
+            return false;
         }
         if (inIntake > 0) {
             stopsBySession.set(sessionId, { count: (stopsBySession.get(sessionId)?.count ?? 0) + 1, by: userId });
         }
-        log(`slack: ${userId} stopped ${running.length + inIntake} turn(s) of ${connection.config.agentId} in ${channel}`);
+        // A renderer's started turn is also one the gateway counts, so this is
+        // the larger of the two, not their sum.
+        log(`slack: ${userId} stopped ${Math.max(running.length, onSession) + inIntake} turn(s) of ${connection.config.agentId} in ${channel}`);
         return true;
     };
     /**
@@ -5698,7 +6164,7 @@ export const createSlackChannelAdapter = (options) => {
             leaveIntake();
             if (stopped !== undefined && stopped.count !== stopsAtClaim && renderer.stoppedBy === undefined) {
                 renderer.stoppedBy = stopped.by;
-                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${stopped.by}`));
+                renderer.controller.abort(new RunAbortedError(`${SLACK_STOP_REASON}${stopped.by}`));
             }
             // In a DM each message is its own status key, and Slack stops showing
             // the running turn's once a newer message sits below it — so a
@@ -5708,6 +6174,10 @@ export const createSlackChannelAdapter = (options) => {
             renderer.showLoading(queue.length === 1 || queue[0]?.statusThread !== renderer.statusThread);
             let repeat;
             let absorbed = false;
+            const replay = replaying.get(pendingKey({ agentId: connection.config.agentId, team: connection.teamId, channel: event.channel, ts: event.ts }));
+            if (replay !== undefined) {
+                replay.dispatched = true;
+            }
             const turn = gateway.dispatch({
                 sessionId,
                 agentId: connection.config.agentId,
@@ -5727,10 +6197,16 @@ export const createSlackChannelAdapter = (options) => {
                 },
                 // Sent while a turn is running, this message is answered by the
                 // next turn together with everything else that queued (card 423);
-                // the first of them renders that answer.
-                onAbsorbed: () => {
-                    absorbed = true;
-                },
+                // the first of them renders that answer. Not a replayed message:
+                // it leaves the kept list only on its own confirmed answer, and an
+                // answer another message's renderer posts is not one it can see.
+                ...(replay === undefined
+                    ? {
+                        onAbsorbed: () => {
+                            absorbed = true;
+                        },
+                    }
+                    : {}),
             });
             return { renderer, turn, repeat: () => repeat, absorbed: () => absorbed };
         });
@@ -5783,6 +6259,15 @@ export const createSlackChannelAdapter = (options) => {
         // Likewise a message absorbed into a merged turn: the turn's leading
         // message's renderer answers for all of them.
         if (repeat() === 'live' || absorbed()) {
+            // A replayed message whose turn the start-up recovery owns is
+            // answered by that recovery's report, and only if it reached the
+            // thread; anything else leaves it kept.
+            const ahead = repeat() === 'live' && renderer.outcomeReportedAhead !== undefined
+                ? await renderer.outcomeReportedAhead
+                : undefined;
+            if (ahead?.said === true) {
+                noteReplayAnsweredAhead(connection, event.channel, event.ts);
+            }
             await renderer.withdraw();
             renderers.get(sessionId)?.[0]?.refreshLoading();
             return;
@@ -5820,6 +6305,7 @@ export const createSlackChannelAdapter = (options) => {
             }));
         }
         if (reportedAhead?.said === true) {
+            noteReplayAnsweredAhead(connection, event.channel, event.ts);
             await renderer.withdraw();
             renderers.get(sessionId)?.[0]?.refreshLoading();
             return;
@@ -5852,6 +6338,7 @@ export const createSlackChannelAdapter = (options) => {
             // interim messages already in the thread are heard either way.
             let replyLanded = false;
             const settled = finalized.then((outcome) => {
+                noteReplayOutcome(connection, event.channel, event.ts, outcome);
                 replyLanded = outcome.published;
                 return true;
             }, () => true);
@@ -5890,11 +6377,48 @@ export const createSlackChannelAdapter = (options) => {
             // not a failure of the agent. Matched by name, as this package does
             // not import the gateway. A turn nobody asked for stays silent.
             const pausedReply = failure instanceof Error && failure.name === 'IntakePausedError';
-            const { spoke, spokeAt } = renderer.stoppedBy !== undefined
+            // A daemon on its way down that still heard this (the gateway keeps
+            // channels connected through its drain): the message is kept for the
+            // next start, which handles it as if it had just arrived. Said only
+            // to a message that asked: a judged reply in the agent's thread (a
+            // turn nobody asked for) is kept so the next daemon can still judge
+            // it, but nobody asked, so a notice under it would be noise. An
+            // overheard message never gets here; it was never going to be a turn.
+            // Matched by name, like the pause.
+            const stoppingRefusal = failure instanceof Error && failure.name === 'GatewayStoppingError' && renderer.stoppedBy === undefined;
+            let deferredText;
+            if (stoppingRefusal) {
+                const restarting = failure.restarting !== false;
+                const kept = await keepForNextStart({
+                    agentId: connection.config.agentId,
+                    team,
+                    channel: event.channel,
+                    ts: event.ts,
+                    ...(event.thread_ts !== undefined ? { threadTs: event.thread_ts } : {}),
+                    user: userId,
+                    ...(event.channel_type !== undefined ? { channelType: event.channel_type } : {}),
+                    keptAt: now(),
+                });
+                if (kept) {
+                    log(`slack: ${connection.config.agentId} kept ${event.ts} in ${event.channel} to answer after the ${restarting ? 'restart' : 'stop'}`);
+                    deferredText = restarting ? RESTARTING_REPLY_TEXT : STOPPING_REPLY_TEXT;
+                }
+                else {
+                    deferredText = failure.message;
+                }
+            }
+            // A refusal (paused, or a daemon on its way down) ran no turn, so its
+            // notice is never what answers a replayed message: that one stays
+            // kept, whether or not keeping it again just worked.
+            const refused = pausedReply || stoppingRefusal;
+            const outcome = renderer.stoppedBy !== undefined
                 ? await renderer.stopped(renderer.stoppedBy)
-                : pausedReply
-                    ? await renderer.finalize(renderer.lazy ? '' : failure.message)
+                : refused
+                    ? await renderer.finalize(renderer.lazy ? '' : deferredText ?? failure.message)
                     : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            const { spoke, spokeAt } = refused && renderer.stoppedBy === undefined
+                ? outcome
+                : noteReplayOutcome(connection, event.channel, event.ts, outcome);
             if (spoke && threadKey !== undefined) {
                 // A file it posted before breaking has still spoken, by the same
                 // rule as a reply that landed.
@@ -5915,6 +6439,10 @@ export const createSlackChannelAdapter = (options) => {
         requestCredential,
         async start(gateway) {
             gatewayRef = gateway;
+            // Nothing counts as seen live until every socket is up (Codex
+            // 4321128637): a message sent while the sockets are still coming up
+            // reaches none of them, so a read stopping before it stops short.
+            liveFrom = NOT_LIVE_YET;
             unsubscribe = gateway.bus.subscribe((event) => {
                 // Approval traffic is not part of a reply: it gets its own message
                 // with its own lifetime, and routing it through the running turn's
@@ -6066,21 +6594,55 @@ export const createSlackChannelAdapter = (options) => {
                 }
             }
             settleHomeOwners();
+            const listeners = new Map();
+            // Read before any socket delivers, so each conversation with kept
+            // messages is held from the first live event on.
+            let kept = [];
+            if (pendingIntakePath !== undefined) {
+                try {
+                    kept = await readPending(pendingIntakePath);
+                }
+                catch (error) {
+                    warn(`slack: could not read the messages kept from the last restart: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                const cutoff = now() - PENDING_INTAKE_MAX_AGE_MS;
+                for (const entry of kept) {
+                    if (entry.keptAt >= cutoff && authenticated.some((connection) => keptFor(connection, entry))) {
+                        holdConversation(holdKey(entry.agentId, entry.channel));
+                    }
+                }
+            }
             for (const connection of authenticated) {
                 const { config, socket } = connection;
                 try {
                     // Returns the work it started: the SDK ignores it, and a test's fake
                     // socket waits on it rather than guessing how long it takes.
-                    const onEvent = (args) => {
-                        const handled = handleInbound(connection, args).catch((error) => {
+                    const handle = (inbound) => {
+                        const handled = inbound.catch((error) => {
                             warn(`slack event handling failed: ${error instanceof Error ? error.message : String(error)}`);
                         });
                         inflight.add(handled);
                         void handled.finally(() => inflight.delete(handled));
                         return handled;
                     };
+                    // The replay's own deliveries never wait on the hold they release.
+                    const onReplay = (args) => handle(handleInbound(connection, args));
+                    const onEvent = (args) => {
+                        const channel = args.event?.channel;
+                        const hold = typeof channel === 'string' ? replayHolds.get(holdKey(config.agentId, channel))?.held : undefined;
+                        if (hold === undefined) {
+                            return onReplay(args);
+                        }
+                        // Acked now, as any delivery is, so Slack does not redeliver a
+                        // message that is only waiting its turn; admitted after the hold.
+                        void Promise.resolve(args.ack()).catch((error) => {
+                            warn(`slack: could not ack an envelope: ${error instanceof Error ? error.message : String(error)}`);
+                        });
+                        return handle(hold.then(() => handleInbound(connection, { ...args, ack: async () => { } })));
+                    };
                     socket.on('app_mention', onEvent);
                     socket.on('message', onEvent);
+                    listeners.set(config.agentId, onReplay);
                     socket.on('interactive', (args) => {
                         const handled = handleInteractive(connection, args).catch((error) => {
                             warn(`slack interaction handling failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -6098,8 +6660,19 @@ export const createSlackChannelAdapter = (options) => {
                     warn(`slack: could not connect ${config.agentId}: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
+            const liveMs = now() + LIVE_FROM_MARGIN_MS;
+            liveFrom = `${Math.floor(liveMs / 1000)}.${String((liveMs % 1000) * 1000).padStart(6, '0')}`;
+            // Once every app is connected, so a kept message is handled with the
+            // whole roster's identities known, as a live one would be. Only for the
+            // apps that did connect: the rest stay kept for a start where they do.
+            // A kept message is from before the restart, so its thread read stops
+            // short of the start, as `liveFrom` already says (card 562).
+            replayStopping = new AbortController();
+            track(replayKept(kept, new Map([...listeners].filter(([agentId]) => connections.some((connection) => connection.config.agentId === agentId))), replayStopping.signal).finally(releaseAllConversations));
         },
         async stop() {
+            replayStopping?.abort();
+            releaseAllConversations();
             // Stop intake first, so no new INBOUND event can slip into
             // `inflight` while the drain below runs.
             await Promise.allSettled(connections.map((connection) => connection.socket.disconnect()));
@@ -6127,6 +6700,8 @@ export const createSlackChannelAdapter = (options) => {
             connections.length = 0;
             approvalPosts.clear();
             threadAddressee.clear();
+            threadTrimmedUntil.clear();
+            threadReadUntil.clear();
             senderAddressees.clear();
             coldVerdicts.clear();
             botIdentities.clear();