crewly 1.20.202 → 1.20.204

package/dist/backend/backend/src/services/slack/slack-team-channel.service.js

@@ -27,7 +27,7 @@
 import { notePerson } from '../people/people-directory.service.js';
 import { dedicatedDecisionFor } from '../people/dedicated-agent.js';
 import { getTicketIntakeService } from '../v3/ticket-intake.service.js';
-import { intakeWithin, slackIntakeMessage, ticketOfOutcome, markAndLinkTicket } from '../v3/ticket-channel-hooks.js';
+import { intakeWithin, slackIntakeMessage, ticketOfOutcome, markAndLinkTicket, linkLateTicket } from '../v3/ticket-channel-hooks.js';
 import { CREWLY_CONSTANTS, RUNTIME_FALLBACK_CONSTANTS } from '../../constants.js';
 import { isInterim } from './slack-typing-placeholder.service.js';
 import { isOwnerAuthored, deliveredSessions } from './slack-auto-working.service.js';
@@ -38,6 +38,8 @@ import * as path from 'path';
 import { promises as fs } from 'fs';
 import { describeSlackError } from './slack.service.js';
 import { isSilentByDefault, } from '../chat-v2/chat-v2.dispatcher.service.js';
+import { ROOM_RESPONDER_CONSTANTS } from '../../constants.js';
+import { buildRoomAgentDirectory, findPriorRoomAnswer, threadOwnerFromSlack, } from './room-responder.js';
 import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
 import { atomicWriteJson, safeReadJson } from '../../utils/file-io.utils.js';
 import { LoggerService } from '../core/logger.service.js';
@@ -96,6 +98,27 @@ export function roomOwnerInstance(room) {
         return room.home.instanceId;
     return awake.sort()[0];
 }
+/**
+ * The one machine that watches a shared-room message nobody on it answers:
+ * the room owner (#1019), else Cloud's fallback machine, else — nobody awake
+ * and no fallback named — the lowest instance id among the machines in the
+ * room that Cloud reports live (`live`, when Cloud sends it; a member it
+ * marks `live: false` never counts). Every machine computes the same answer
+ * from the same snapshot. Because the last resort may still name a machine
+ * that is gone, every other machine that received the message keeps a
+ * note-only watch (see `NOTE_ONLY_WATCH_MS`).
+ *
+ * @param room - Cloud's room presence
+ * @returns Instance id, or null for an empty roster
+ */
+export function roomWatcherInstance(room) {
+    const owner = roomOwnerInstance(room) ?? room.fallback?.instanceId;
+    if (owner)
+        return owner;
+    const live = (m) => m.live;
+    const pool = room.members.some((m) => live(m) === true) ? room.members.filter((m) => live(m) === true) : room.members.filter((m) => live(m) !== false);
+    return [...new Set(pool.map((m) => m.instanceId))].sort()[0] ?? null;
+}
 /**
  * Whether a mapping is an ad-hoc channel (no Crewly team behind it).
  *
@@ -1282,255 +1305,569 @@ export class SlackTeamChannelService {
             if (oldest !== undefined)
                 this.seenInbound.delete(oldest);
         }
-        // Ad-hoc channels grow their huddle as new agents get @'d there.
-        if (isAdhocMapping(mapping) && resolved.mentions.length > 0) {
-            const next = [...new Set([...(mapping.members ?? []), ...resolved.mentions])];
-            if (next.length !== (mapping.members ?? []).length) {
-                mapping.members = next;
-                this.deps.chat.setHuddleMembers(mapping.chatChannelId, next);
-                await this.save();
-                this.deps.onRoomsChanged?.();
+        // Route guard (crewly#1015 §7): from here on an owner's message is
+        // recorded but not yet delivered. "旧模板是什么" (10-02, #C0C46TTBNNP)
+        // was recorded and then nothing — no "routed", no "reached nobody", no
+        // watchdog entry: one of the awaits below never settled, and every
+        // safeguard sits after them. Each await before dispatch is bounded
+        // (ROUTE_STEP_TIMEOUT_MS); a routing that throws, or has not reached
+        // dispatch within ROUTE_STALL_MS, is rescued by the unanswered-message
+        // fallback. Dispatch itself is never timed (sequential cold starts can
+        // take minutes), and a routing that reaches dispatch after a rescue ran
+        // stops there — no double delivery.
+        const routeGuard = !remoteAgent && isOwnerAuthored(message, this.deps.getOwnerUserId?.())
+            ? this.armRouteGuard(message, mapping, persisted, threadId ?? persisted.id)
+            : null;
+        try {
+            // Ad-hoc channels grow their huddle as new agents get @'d there.
+            if (isAdhocMapping(mapping) && resolved.mentions.length > 0) {
+                const next = [...new Set([...(mapping.members ?? []), ...resolved.mentions])];
+                if (next.length !== (mapping.members ?? []).length) {
+                    mapping.members = next;
+                    this.deps.chat.setHuddleMembers(mapping.chatChannelId, next);
+                    await this.save();
+                    this.deps.onRoomsChanged?.();
+                }
             }
-        }
-        // Who will receive this, and who owes a reply — decided by the same rules
-        // delivery uses, but *before* delivery, which can take a minute or two
-        // when an agent has to be cold-started. The owner should not look at an
-        // unacknowledged message for that long.
-        const dispatcherForPlan = this.deps.getDispatcher();
-        const presence = await this.roomStateFor(message, mapping, team ?? null);
-        const dispatchOptions = {
-            threadId: threadId ?? persisted.id,
-            replyVia: 'reply-channel',
-            // A local agent's own message (fanned out to the colleagues it @'d)
-            // must not come back to its author.
-            ...(remoteAgent ? { excludeSessions: [remoteAgent] } : {}),
-            ...(presence ? { room: presence.state, ...(presence.line ? { roomPresence: presence.line } : {}) } : {}),
-        };
-        if (declinedOnly) {
-            // Every agent it addressed is dedicated to someone else and declined.
-            return { mapping, message: persisted, mentions: [], dispatch: null };
-        }
-        if (addressedElsewhereOnly) {
-            // Kept for context (the next question in the thread may be ours), but
-            // no eyes, no placeholder, and nobody here is told.
-            this.logger.info('Slack team message addressed to an agent on another machine — recorded, not dispatched', {
-                teamId: mapping.teamId,
-                slackChannel: `#${mapping.slackChannelName}`,
-                mentionedElsewhere,
-            });
-            return { mapping, message: persisted, mentions: [], dispatch: null };
-        }
-        if (addressedPeopleOnly) {
-            // Context for the agents' next turn in this thread, nothing more. No
-            // suggestion hint either: the names were people, not typos.
-            if (inherited) {
-                this.logger.info('Slack team message continues a person-to-person exchange — recorded, not dispatched', {
-                    teamId: mapping.teamId,
-                    slackChannel: `#${mapping.slackChannelName}`,
-                    addressedTo: inherited.people,
-                    reason: inherited.reason,
-                    threaded: !!threadId,
-                });
+            // Who will receive this, and who owes a reply — decided by the same rules
+            // delivery uses, but *before* delivery, which can take a minute or two
+            // when an agent has to be cold-started. The owner should not look at an
+            // unacknowledged message for that long.
+            const dispatcherForPlan = this.deps.getDispatcher();
+            const presence = await this.bounded(this.roomStateFor(message, mapping, team ?? null), null, 'room presence', message);
+            const dispatchOptions = {
+                threadId: threadId ?? persisted.id,
+                replyVia: 'reply-channel',
+                // A local agent's own message (fanned out to the colleagues it @'d)
+                // must not come back to its author.
+                ...(remoteAgent ? { excludeSessions: [remoteAgent] } : {}),
+                ...(presence ? { room: presence.state, ...(presence.line ? { roomPresence: presence.line } : {}) } : {}),
+            };
+            if (declinedOnly) {
+                // Every agent it addressed is dedicated to someone else and declined.
+                return { mapping, message: persisted, mentions: [], dispatch: null };
             }
-            else {
-                this.logger.info('Slack team message addressed to people, not agents — recorded, not dispatched', {
+            if (addressedElsewhereOnly) {
+                // Kept for context (the next question in the thread may be ours), but
+                // no eyes, no placeholder, and nobody here is told.
+                this.logger.info('Slack team message addressed to an agent on another machine — recorded, not dispatched', {
                     teamId: mapping.teamId,
                     slackChannel: `#${mapping.slackChannelName}`,
-                    mentionedUsers: peopleMentions.userIds,
-                    mentionedNames: peopleMentions.names,
-                    threaded: !!threadId,
+                    mentionedElsewhere,
                 });
+                return { mapping, message: persisted, mentions: [], dispatch: null };
             }
-            return { mapping, message: persisted, mentions: [], dispatch: null };
-        }
-        const planned = dispatcherForPlan?.planHuddleTargets
-            ? await dispatcherForPlan.planHuddleTargets(channel, persisted, dispatchOptions).catch(() => null)
-            : null;
-        // Prompt backstop: who the message (or the exchange it may continue)
-        // was meant for, when people are in the picture. A direct request inside
-        // the exchange gets a neutral note, and none at all in an assistant or
-        // support room, where requests are what the team is there for.
-        const peopleAddressing = namedPeople.length > 0
-            ? { kind: 'named-in-message', people: await this.personLabels(namedPeople, message.channelId) }
-            : exchange.recent.length > 0 && !(exchange.request && isAssistantRoom(team ?? null, mapping.slackChannelName))
-                ? {
-                    kind: exchange.request ? 'recent-exchange-request' : 'recent-exchange',
-                    people: await this.personLabels(exchange.recent, message.channelId),
+            if (addressedPeopleOnly) {
+                // Context for the agents' next turn in this thread, nothing more. No
+                // suggestion hint either: the names were people, not typos.
+                if (inherited) {
+                    this.logger.info('Slack team message continues a person-to-person exchange — recorded, not dispatched', {
+                        teamId: mapping.teamId,
+                        slackChannel: `#${mapping.slackChannelName}`,
+                        addressedTo: inherited.people,
+                        reason: inherited.reason,
+                        threaded: !!threadId,
+                    });
+                }
+                else {
+                    this.logger.info('Slack team message addressed to people, not agents — recorded, not dispatched', {
+                        teamId: mapping.teamId,
+                        slackChannel: `#${mapping.slackChannelName}`,
+                        mentionedUsers: peopleMentions.userIds,
+                        mentionedNames: peopleMentions.names,
+                        threaded: !!threadId,
+                    });
                 }
+                return { mapping, message: persisted, mentions: [], dispatch: null };
+            }
+            // One responder per message a person wrote; everyone else listens
+            // (specs/2026-10-03-one-responder-per-message.md). Agent-authored posts
+            // keep the older fan-out. A step that does not finish still yields a
+            // responder: without a pin the dispatcher's rules pick one.
+            const oneResponder = remoteAgent
+                ? null
+                : await this.bounded(this.oneResponderFor(message, mapping, members, team ?? null, resolved.mentions, handoffTo, threadId, persisted.id), {}, 'responder', message);
+            const routedOptions = oneResponder ? { ...dispatchOptions, oneResponder } : dispatchOptions;
+            const planned = dispatcherForPlan?.planHuddleTargets
+                ? await this.bounded(dispatcherForPlan.planHuddleTargets(channel, persisted, routedOptions).catch(() => null), null, 'dispatch plan', message)
                 : null;
-        // A recipient told to stay silent by default gets no placeholder and no
-        // auto "working on it": both promise a reply the prompt does not ask for.
-        const addressedHere = new Set(persisted.mentions ?? []);
-        const silentByDefault = (session) => isSilentByDefault(peopleAddressing, planned?.get(session) ?? 'optional', addressedHere.has(session));
-        // Ticket loop (specs/ticket-loop.md §2): the owner's message goes through
-        // the single intake. Started now, awaited just before dispatch, so the
-        // receipt and the agent's `[TICKET:…]` marker do not hold up the eyes /
-        // placeholders below.
-        const ticketPromise = this.intakeTicket(message, mapping, resolved.mentions, planned, handoffTo, remoteAgent);
-        await this.acknowledgeSeen(message, mapping, resolved.mentions, planned);
-        // Agents that must reply get a placeholder straight away — "waking up…"
-        // for an idle agent (a cold start is 1–2 minutes), "is working on it…"
-        // once it holds the message. Agents that were only told, and may or may
-        // not decide to answer, get none: a placeholder is a promise of a reply,
-        // and they announce their own with `reply-channel --working` if they
-        // take it on. With a plan this covers the case the old heuristic missed —
-        // a bare follow-up in a thread, which the last speaker must answer.
-        let owing;
-        if (planned) {
-            // An agent that is asleep and still gets the message is being woken
-            // for it — the room's leader when nobody was awake — so it owns the
-            // message and the owner should see that at once, not after the one or
-            // two minutes a cold start takes (#pro-crewly-marketing, 2026-09-23).
-            // Awake agents that were only told announce themselves with --working.
-            // The orchestrator is left out: its bot is usually not in the room.
-            const isAwake = this.deps.isAgentAwake;
-            owing = [...planned]
-                .filter(([session, mode]) => mode === 'required' ||
-                (isAwake !== undefined && !isAwake(session) && session !== CREWLY_CONSTANTS.SESSIONS.ORCHESTRATOR_NAME))
-                .map(([session]) => session);
-        }
-        else {
-            owing = resolved.mentions;
-            if (owing.length === 0 && !message.threadTs && team) {
-                // Same rule as the dispatcher's huddleLeaderFor: the team lead, else the first member.
-                const leader = teamChannelLeader(team, members);
-                if (leader)
-                    owing = [leader.sessionName];
+            // Prompt backstop: who the message (or the exchange it may continue)
+            // was meant for, when people are in the picture. A direct request inside
+            // the exchange gets a neutral note, and none at all in an assistant or
+            // support room, where requests are what the team is there for.
+            const peopleAddressing = namedPeople.length > 0
+                ? { kind: 'named-in-message', people: await this.personLabels(namedPeople, message.channelId) }
+                : exchange.recent.length > 0 && !(exchange.request && isAssistantRoom(team ?? null, mapping.slackChannelName))
+                    ? {
+                        kind: exchange.request ? 'recent-exchange-request' : 'recent-exchange',
+                        people: await this.personLabels(exchange.recent, message.channelId),
+                    }
+                    : null;
+            // A recipient told to stay silent by default gets no placeholder and no
+            // auto "working on it": both promise a reply the prompt does not ask for.
+            const addressedHere = new Set(persisted.mentions ?? []);
+            const silentByDefault = (session) => isSilentByDefault(peopleAddressing, planned?.get(session) ?? 'optional', addressedHere.has(session));
+            // Ticket loop (specs/ticket-loop.md §2): the owner's message goes through
+            // the single intake. Started now, awaited just before dispatch, so the
+            // receipt and the agent's `[TICKET:…]` marker do not hold up the eyes /
+            // placeholders below.
+            const ticketPromise = this.intakeTicket(message, mapping, resolved.mentions, planned, handoffTo, remoteAgent, persisted);
+            await this.bounded(this.acknowledgeSeen(message, mapping, resolved.mentions, planned), undefined, 'seen reaction', message);
+            // Agents that must reply get a placeholder straight away — "waking up…"
+            // for an idle agent (a cold start is 1–2 minutes), "is working on it…"
+            // once it holds the message. Agents that were only told, and may or may
+            // not decide to answer, get none: a placeholder is a promise of a reply,
+            // and they announce their own with `reply-channel --working` if they
+            // take it on. With a plan this covers the case the old heuristic missed —
+            // a bare follow-up in a thread, which the last speaker must answer.
+            let owing;
+            if (planned) {
+                // An agent that is asleep and still gets the message is being woken
+                // for it — the room's leader when nobody was awake — so it owns the
+                // message and the owner should see that at once, not after the one or
+                // two minutes a cold start takes (#pro-crewly-marketing, 2026-09-23).
+                // Awake agents that were only told announce themselves with --working.
+                // The orchestrator is left out: its bot is usually not in the room.
+                const isAwake = this.deps.isAgentAwake;
+                owing = [...planned]
+                    .filter(([session, mode]) => mode === 'required' ||
+                    (isAwake !== undefined && !isAwake(session) && session !== CREWLY_CONSTANTS.SESSIONS.ORCHESTRATOR_NAME))
+                    .map(([session]) => session);
             }
-        }
-        owing = owing.filter((session) => !silentByDefault(session));
-        const typingTargets = [];
-        if (this.deps.typing) {
-            for (const session of owing) {
-                const member = members.find((m) => m.sessionName === session);
-                const installed = this.deps.identities?.getInstalled(session);
-                // Own bot when installed; otherwise the master bot wearing the agent's
-                // name/icon — the person should see *something* during a cold start.
-                const identity = installed
-                    ? { botToken: installed.botToken, displayName: member?.name ?? session }
-                    : { displayName: member?.name ?? session, ...slackIdentityFor(member, session) };
-                const key = { agentSession: session, slackChannelId: message.channelId, threadTs: slackThreadTs };
-                const awake = this.deps.isAgentAwake ? this.deps.isAgentAwake(session) : true;
-                await this.deps.typing.begin(key, identity, awake ? 'typing' : 'waking', message.ts);
-                typingTargets.push({ session, key });
+            else {
+                owing = resolved.mentions;
+                if (owing.length === 0 && !message.threadTs && team) {
+                    // Same rule as the dispatcher's huddleLeaderFor: the team lead, else the first member.
+                    const leader = teamChannelLeader(team, members);
+                    if (leader)
+                        owing = [leader.sessionName];
+                }
             }
-        }
-        // Recipients who were only told get no placeholder above; the first of
-        // them that starts working on an owner's message gets one posted for it
-        // by the harness (2026-09-30: Owen, 3.5 min of nothing in #pro-ce).
-        const autoWatchCandidates = [
-            ...new Set([...(planned ? [...planned.keys()] : []), ...members.map((m) => m.sessionName)]),
-        ].filter((session) => !silentByDefault(session));
-        const autoWatch = this.deps.autoWorking && this.deps.typing && autoWatchCandidates.length > 0 && isOwnerAuthored(message, this.deps.getOwnerUserId?.())
-            ? this.deps.autoWorking.watch({
-                slackChannelId: message.channelId,
-                threadTs: slackThreadTs,
-                sourceTs: message.ts,
-                candidates: autoWatchCandidates,
-                identityFor: (session) => {
+            owing = owing.filter((session) => !silentByDefault(session));
+            const typingTargets = [];
+            if (this.deps.typing) {
+                for (const session of owing) {
+                    // Rescued meanwhile: the hand-off posts its own placeholder.
+                    if (routeGuard?.rescued())
+                        break;
                     const member = members.find((m) => m.sessionName === session);
                     const installed = this.deps.identities?.getInstalled(session);
-                    const displayName = member?.name ?? session;
-                    return installed
-                        ? { botToken: installed.botToken, displayName }
-                        : { displayName, ...slackIdentityFor(member, session) };
-                },
-            })
-            : null;
-        const dispatcher = this.deps.getDispatcher();
-        let dispatch = null;
-        if (dispatcher) {
-            let roster = await getSlackDirectoryService()?.rosterLine(message.channelId).catch(() => '');
-            // The directory needs the master bot to list a channel's members; in a
-            // private ad-hoc channel it is not a member, so fall back to the local
-            // huddle roster (with roles) — enough to answer "who leads this?".
-            if (!roster && isAdhocMapping(mapping)) {
-                roster = members
-                    .filter((m) => (mapping.members ?? []).includes(m.sessionName))
-                    .map((m) => `${m.name} (${teams.find((t) => (t.members ?? []).some((x) => x.id === m.id))?.name ?? '?'}, ${String(m.role)}, this machine)`)
-                    .join(' · ');
+                    // Own bot when installed; otherwise the master bot wearing the agent's
+                    // name/icon — the person should see *something* during a cold start.
+                    const identity = installed
+                        ? { botToken: installed.botToken, displayName: member?.name ?? session }
+                        : { displayName: member?.name ?? session, ...slackIdentityFor(member, session) };
+                    const key = { agentSession: session, slackChannelId: message.channelId, threadTs: slackThreadTs };
+                    const awake = this.deps.isAgentAwake ? this.deps.isAgentAwake(session) : true;
+                    routeGuard?.notePlaceholder(key);
+                    await this.bounded(this.deps.typing.begin(key, identity, awake ? 'typing' : 'waking', message.ts), null, 'placeholder', message);
+                    typingTargets.push({ session, key });
+                }
+            }
+            // Recipients who were only told get no placeholder above; the first of
+            // them that starts working on an owner's message gets one posted for it
+            // by the harness (2026-09-30: Owen, 3.5 min of nothing in #pro-ce).
+            const autoWatchCandidates = [
+                ...new Set([...(planned ? [...planned.keys()] : []), ...members.map((m) => m.sessionName)]),
+            ].filter((session) => !silentByDefault(session));
+            const autoWatch = this.deps.autoWorking && this.deps.typing && autoWatchCandidates.length > 0 && isOwnerAuthored(message, this.deps.getOwnerUserId?.())
+                ? this.deps.autoWorking.watch({
+                    slackChannelId: message.channelId,
+                    threadTs: slackThreadTs,
+                    sourceTs: message.ts,
+                    candidates: autoWatchCandidates,
+                    identityFor: (session) => {
+                        const member = members.find((m) => m.sessionName === session);
+                        const installed = this.deps.identities?.getInstalled(session);
+                        const displayName = member?.name ?? session;
+                        return installed
+                            ? { botToken: installed.botToken, displayName }
+                            : { displayName, ...slackIdentityFor(member, session) };
+                    },
+                })
+                : null;
+            const dispatcher = this.deps.getDispatcher();
+            let dispatch = null;
+            if (dispatcher) {
+                let roster = await this.bounded(getSlackDirectoryService()?.rosterLine(message.channelId).catch(() => '') ?? Promise.resolve(''), '', 'room roster', message);
+                // The directory needs the master bot to list a channel's members; in a
+                // private ad-hoc channel it is not a member, so fall back to the local
+                // huddle roster (with roles) — enough to answer "who leads this?".
+                if (!roster && isAdhocMapping(mapping)) {
+                    roster = members
+                        .filter((m) => (mapping.members ?? []).includes(m.sessionName))
+                        .map((m) => `${m.name} (${teams.find((t) => (t.members ?? []).some((x) => x.id === m.id))?.name ?? '?'}, ${String(m.role)}, this machine)`)
+                        .join(' · ');
+                }
+                const ticket = await this.bounded(ticketPromise, null, 'ticket intake', message);
+                // The thread as Slack has it — posts by agents on other machines
+                // included — rendered per recipient so its own lines are marked.
+                const slackContext = await this.bounded(Promise.resolve(message.threadContext), undefined, 'thread context', message);
+                // A rescue already ran (routing stalled before this point): it has
+                // handed the message over, so this late routing must not deliver it
+                // again, nor arm another unanswered watch.
+                if (routeGuard && !routeGuard.dispatchStarting()) {
+                    this.logger.warn('Owner room message reached dispatch after it was rescued — not dispatching it again', {
+                        slackChannel: `#${mapping.slackChannelName}`,
+                        ts: message.ts,
+                    });
+                    return { mapping, message: persisted, mentions: resolved.mentions, dispatch: null };
+                }
+                dispatch = await dispatcher.dispatchMessage(channel, markAndLinkTicket(persisted, ticket), {
+                    ...routedOptions,
+                    ...(roster ? { channelRoster: roster } : {}),
+                    ...(peopleAddressing ? { peopleAddressing } : {}),
+                    ...(slackContext
+                        ? {
+                            slackContextFor: (session) => renderSlackThreadContext(slackContext, {
+                                botUserId: this.deps.identities?.get(session)?.botUserId,
+                                name: members.find((m) => m.sessionName === session)?.name,
+                            }),
+                        }
+                        : {}),
+                });
             }
-            const ticket = await ticketPromise;
-            // The thread as Slack has it — posts by agents on other machines
-            // included — rendered per recipient so its own lines are marked.
-            const slackContext = await message.threadContext;
-            dispatch = await dispatcher.dispatchMessage(channel, markAndLinkTicket(persisted, ticket), {
-                ...dispatchOptions,
-                ...(roster ? { channelRoster: roster } : {}),
-                ...(peopleAddressing ? { peopleAddressing } : {}),
-                ...(slackContext
+            else {
+                this.logger.warn('No chat dispatcher wired — message persisted but not delivered', {
+                    huddle: mapping.chatChannelId,
+                });
+            }
+            if (resolved.unknown.length > 0) {
+                await this.postUnknownMentionHint(message, resolved.unknown, candidates);
+            }
+            autoWatch?.delivered(deliveredSessions(dispatch));
+            // Dispatch is done: each placeholder now reflects whether its agent
+            // actually holds the message.
+            if (this.deps.typing && typingTargets.length > 0) {
+                const outcomes = new Map((dispatch?.huddleOutcomes ?? []).map((o) => [o.sessionName, o.dispatched]));
+                for (const { session, key } of typingTargets) {
+                    const delivered = outcomes.get(session) ?? dispatch?.dispatched ?? false;
+                    if (delivered)
+                        await this.deps.typing.setPhase(key, 'typing');
+                    else
+                        await this.deps.typing.fail(key);
+                }
+            }
+            this.logger.info('Slack team message routed', {
+                teamId: mapping.teamId,
+                slackChannel: `#${mapping.slackChannelName}`,
+                mentions: resolved.mentions,
+                ...(mentionedElsewhere.length > 0 ? { mentionedElsewhere } : {}),
+                unknown: resolved.unknown.map((u) => u.token),
+                strategy: dispatch?.strategy ?? 'none',
+                threaded: !!threadId,
+                ...(oneResponder
                     ? {
-                        slackContextFor: (session) => renderSlackThreadContext(slackContext, {
-                            botUserId: this.deps.identities?.get(session)?.botUserId,
-                            name: members.find((m) => m.sessionName === session)?.name,
-                        }),
+                        responder: oneResponder.pinned
+                            ? { session: oneResponder.pinned.session, name: oneResponder.pinned.name ?? null, reason: oneResponder.pinned.reason }
+                            : (dispatch?.huddleOutcomes ?? []).map((o) => o.sessionName),
+                        contextOnly: dispatch?.contextOnly ?? [],
                     }
                     : {}),
             });
+            const recipients = deliveredSessions(dispatch);
+            const heldBy = (dispatch?.huddleOutcomes ?? []).filter((o) => o.dispatched && o.queued).map((o) => o.sessionName);
+            if (oneResponder)
+                this.recordChosenResponders(persisted, dispatch, oneResponder);
+            if (dispatch?.dispatched) {
+                // Someone here holds it — including a follow-up in a thread we were
+                // still waiting on.
+                this.settleUnanswered(`${message.channelId}:${slackThreadTs}`);
+                // The owner machine of a shared room (others deferred to it) runs the
+                // one 90 s fallback: if nobody here answers, its lead is woken.
+                const allOptional = (dispatch.huddleOutcomes ?? []).every((o) => o.responseMode !== 'required');
+                // With one responder the other awake agents no longer hear it, so an
+                // optional responder that stays silent needs the fallback in any room.
+                const optionalResponder = !!oneResponder && (dispatch.huddleOutcomes ?? []).length > 0 && allOptional;
+                if (((presence?.ownsSharedMessage && allOptional) || optionalResponder) && !handoffTo && isOwnerAuthored(message, this.deps.getOwnerUserId?.())) {
+                    this.watchUnanswered(message, mapping, persisted, dispatchOptions.threadId, recipients, heldBy);
+                }
+            }
+            else if (!remoteAgent) {
+                // Never a silent no-op: say why nobody got it.
+                this.logger.warn('Slack room message reached nobody on this machine', {
+                    teamId: mapping.teamId,
+                    slackChannel: `#${mapping.slackChannelName}`,
+                    ts: message.ts,
+                    planned: planned ? [...planned.keys()] : null,
+                    failed: (dispatch?.huddleOutcomes ?? []).filter((o) => !o.dispatched).map((o) => o.sessionName),
+                    awakeHere: presence?.state.awakeHere ?? null,
+                    awakeElsewhere: presence?.state.awakeElsewhere ?? null,
+                    wakeWhenAllAsleep: presence?.state.wakeWhenAllAsleep ?? null,
+                    handoffTo,
+                    recipients,
+                });
+                // A message deferred to another machine is watched there, by its
+                // owner, only — two machines running the fallback would answer twice.
+                // One the decision path consumed, or whose responder runs on another
+                // machine, is that path's / machine's to answer.
+                // A responder on another machine is watched from the room's owner
+                // machine (watchHere): never an owner message without a watcher.
+                const pinned = oneResponder?.pinned;
+                const watchHere = pinned?.watchHere === true;
+                const noteOnly = watchHere && pinned?.watchNoteOnly === true;
+                const answeredElsewhere = !!pinned && !pinned.session && !watchHere;
+                const watchable = watchHere || (!answeredElsewhere && !presence?.deferredElsewhere && !presence?.fallbackElsewhere);
+                if (!handoffTo && watchable && isOwnerAuthored(message, this.deps.getOwnerUserId?.())) {
+                    this.watchUnanswered(message, mapping, persisted, dispatchOptions.threadId, recipients, heldBy, noteOnly);
+                }
+            }
+            return { mapping, message: persisted, mentions: resolved.mentions, dispatch };
         }
-        else {
-            this.logger.warn('No chat dispatcher wired — message persisted but not delivered', {
-                huddle: mapping.chatChannelId,
-            });
+        catch (err) {
+            routeGuard?.fail(err);
+            throw err;
         }
-        if (resolved.unknown.length > 0) {
-            await this.postUnknownMentionHint(message, resolved.unknown, candidates);
-        }
-        autoWatch?.delivered(deliveredSessions(dispatch));
-        // Dispatch is done: each placeholder now reflects whether its agent
-        // actually holds the message.
-        if (this.deps.typing && typingTargets.length > 0) {
-            const outcomes = new Map((dispatch?.huddleOutcomes ?? []).map((o) => [o.sessionName, o.dispatched]));
-            for (const { session, key } of typingTargets) {
-                const delivered = outcomes.get(session) ?? dispatch?.dispatched ?? false;
-                if (delivered)
-                    await this.deps.typing.setPhase(key, 'typing');
-                else
-                    await this.deps.typing.fail(key);
-            }
+        finally {
+            routeGuard?.disarm();
         }
-        this.logger.info('Slack team message routed', {
-            teamId: mapping.teamId,
-            slackChannel: `#${mapping.slackChannelName}`,
-            mentions: resolved.mentions,
-            ...(mentionedElsewhere.length > 0 ? { mentionedElsewhere } : {}),
-            unknown: resolved.unknown.map((u) => u.token),
-            strategy: dispatch?.strategy ?? 'none',
-            threaded: !!threadId,
-        });
-        const recipients = deliveredSessions(dispatch);
-        if (dispatch?.dispatched) {
-            // Someone here holds it — including a follow-up in a thread we were
-            // still waiting on.
-            this.settleUnanswered(`${message.channelId}:${slackThreadTs}`);
-            // The owner machine of a shared room (others deferred to it) runs the
-            // one 90 s fallback: if nobody here answers, its lead is woken.
-            const allOptional = (dispatch.huddleOutcomes ?? []).every((o) => o.responseMode !== 'required');
-            if (presence?.ownsSharedMessage && allOptional && !handoffTo && isOwnerAuthored(message, this.deps.getOwnerUserId?.())) {
-                this.watchUnanswered(message, mapping, persisted, dispatchOptions.threadId, recipients);
+    }
+    /**
+     * Who answers a person's room message, from data only this layer has
+     * (specs/2026-10-03-one-responder-per-message.md §1): the decision path's
+     * outcome (a), else — for an un-@'d thread reply — the Slack thread's
+     * owner (c). @-mentions (b) and the top-level room rule (d) are applied by
+     * the dispatcher. Never throws.
+     *
+     * @param message - Inbound message
+     * @param mapping - Its room
+     * @param members - Agents the room resolves names against (local)
+     * @param team - The room's team, or null for an ad-hoc room
+     * @param mentions - Local agents @'d
+     * @param handoffTo - Local agent the message was handed to
+     * @returns One-responder options for the dispatcher
+     */
+    async oneResponderFor(message, mapping, members, team, mentions, handoffTo, threadId, messageId) {
+        const nameFor = (session) => members.find((m) => m.sessionName === session)?.name ??
+            message.room?.members.find((m) => localAgentSession(m.agentSession) === session)?.displayName;
+        const base = { nameFor };
+        const isThreadReply = !!message.threadTs && message.threadTs !== message.ts;
+        if (handoffTo || !isThreadReply)
+            return base;
+        try {
+            const roomSessions = team ? teamChannelMembers(team).map((m) => m.sessionName) : [...(mapping.members ?? [])];
+            const isLocal = (s) => this.deps.isLocalAgent?.(s) ?? members.some((m) => m.sessionName === s);
+            // Which machine decides when the shared picture is not enough: the
+            // #1019 room owner (or Cloud's fallback machine). Without presence this
+            // machine is the only one that can.
+            const room = message.room ?? null;
+            const me = room && this.deps.resolveInstanceId ? await this.deps.resolveInstanceId().catch(() => null) : null;
+            // The machine that decides and watches (owner, else fallback, else the
+            // lowest instance id). A machine that cannot tell who it is watches
+            // anyway: two watchers beat none (the fallback reads Slack first).
+            const watcher = room ? roomWatcherInstance(room) : null;
+            const ownsRoom = !room || !me || !watcher || watcher === me;
+            const isWatcher = !!room && !!me && (!watcher || watcher === me);
+            // Cloud named no owner and no fallback machine: the last-resort watcher
+            // may be gone, so every machine that received this keeps a note-only
+            // watch. So does a machine that cannot tell who it is.
+            const lastResort = !!room && !roomOwnerInstance(room) && !room.fallback;
+            const noteOnlyHere = !!room && !isWatcher && (!me || lastResort);
+            const watchFlags = () => isWatcher ? { watchHere: true } : noteOnlyHere ? { watchHere: true, watchNoteOnly: true } : {};
+            // Not ours to decide: the owner machine applies the room's rules and watches.
+            const deferToRoomOwner = { ...base, pinned: { session: null, reason: 'deferred', ...watchFlags() } };
+            // Ours to watch, but not to guess: nobody here answers; the 90 s watch does.
+            const watchOnly = { ...base, pinned: { session: null, reason: 'deferred', ...watchFlags() } };
+            // (a) The decision path: one shared run per Slack message.
+            const decision = this.deps.decisionReplyFor
+                ? await withinMs(this.deps.decisionReplyFor(message).catch(() => null), ROOM_RESPONDER_CONSTANTS.DECISION_WAIT_MS, null)
+                : null;
+            if (decision) {
+                const askerHere = isLocal(decision.asker) && roomSessions.includes(decision.asker);
+                const name = nameFor(decision.asker) ?? decision.asker;
+                if (decision.consumed) {
+                    return {
+                        ...base,
+                        pinned: { session: null, answeredBy: decision.asker, name, reason: 'decision-consumed', ...(askerHere ? { alreadyHas: decision.asker } : {}) },
+                    };
+                }
+                if (askerHere)
+                    return { ...base, pinned: { session: decision.asker, answeredBy: decision.asker, name, reason: 'decision' } };
+                // The asker is not in this room and the card is still open: the room's own rules.
+            }
+            if (mentions.length > 0)
+                return base;
+            // (c) The Slack thread's owner — the same answer on every machine.
+            const read = await this.slackThreadOwner(message, members, roomSessions, isLocal);
+            if (!read.readable) {
+                // Machines that cannot read the thread would each guess from their
+                // own log: only the room's owner machine does — and only when its log
+                // can be trusted to name the last speaker. Otherwise it answers
+                // nothing and keeps the 90 s watch.
+                if (!ownsRoom)
+                    return deferToRoomOwner;
+                if (!room)
+                    return base;
+                return this.localThreadLogTrusted(mapping.chatChannelId, threadId, messageId, room, me) ? base : watchOnly;
+            }
+            if (!read.owner)
+                return base;
+            const { agent, via } = read.owner;
+            // A remote owner counts only while Cloud shows it awake — an offline,
+            // stale or retired machine never answers. Every machine judges by the
+            // same snapshot (its own agents included). A card's asker is the
+            // exception: its machine's decision path takes the reply.
+            const live = !room || room.members.some((m) => localAgentSession(m.agentSession) === localAgentSession(agent.session) && m.awake);
+            if (live || via === 'card') {
+                if (agent.local)
+                    return { ...base, pinned: { session: agent.session, answeredBy: agent.session, name: agent.name, reason: 'thread-owner' } };
+                // An awake asker's machine answers a card through the decision path —
+                // no placeholder, no thread post — so a watch here would hand the
+                // message to our lead at 90 s and answer it twice. Watch only an
+                // asker that is not awake (its machine may be offline).
+                const watch = !(via === 'card' && live);
+                return { ...base, pinned: { session: null, answeredBy: agent.session, name: agent.name, reason: 'thread-owner', ...(watch ? watchFlags() : {}) } };
             }
+            return ownsRoom ? base : deferToRoomOwner;
         }
-        else if (!remoteAgent) {
-            // Never a silent no-op: say why nobody got it.
-            this.logger.warn('Slack room message reached nobody on this machine', {
-                teamId: mapping.teamId,
-                slackChannel: `#${mapping.slackChannelName}`,
-                ts: message.ts,
-                planned: planned ? [...planned.keys()] : null,
-                failed: (dispatch?.huddleOutcomes ?? []).filter((o) => !o.dispatched).map((o) => o.sessionName),
-                awakeHere: presence?.state.awakeHere ?? null,
-                awakeElsewhere: presence?.state.awakeElsewhere ?? null,
-                wakeWhenAllAsleep: presence?.state.wakeWhenAllAsleep ?? null,
-                handoffTo,
-                recipients,
+        catch (err) {
+            this.logger.warn('Could not choose the responder — using the room rules', {
+                slackChannel: mapping.slackChannelName ?? message.channelId,
+                error: err instanceof Error ? err.message : String(err),
             });
-            // A message deferred to another machine is watched there, by its
-            // owner, only — two machines running the fallback would answer twice.
-            if (!handoffTo && !presence?.deferredElsewhere && !presence?.fallbackElsewhere && isOwnerAuthored(message, this.deps.getOwnerUserId?.())) {
-                this.watchUnanswered(message, mapping, persisted, dispatchOptions.threadId, recipients);
+        }
+        return base;
+    }
+    /**
+     * Whether this machine's chat log can name a thread's last speaker when
+     * Slack cannot be read. Cloud never forwards other machines' bot posts, so
+     * with colleagues on other machines in the room the log is trusted only
+     * when its latest agent turn in the thread is local and recent.
+     *
+     * @param chatChannelId - The huddle
+     * @param threadId - The thread root here, when known
+     * @param messageId - The message being routed (not counted)
+     * @param room - Cloud's room presence
+     * @param me - This machine's instance id, when known
+     * @returns True when local rules may answer from the log
+     */
+    localThreadLogTrusted(chatChannelId, threadId, messageId, room, me) {
+        const othersInRoom = room.members.some((m) => !me || m.instanceId !== me);
+        if (!othersInRoom)
+            return true;
+        if (!threadId || !this.deps.chat.listThreadForBridge)
+            return false;
+        const rows = this.deps.chat.listThreadForBridge(chatChannelId, threadId).filter((r) => r.id !== messageId);
+        const isLocal = (s) => this.deps.isLocalAgent?.(localAgentSession(s)) ?? false;
+        // A person @'d an agent on another machine: that agent's answer (no @
+        // of anyone here) never reaches this log, so it cannot name the last speaker.
+        const askedElsewhere = (r) => {
+            if (r.senderType !== 'user' || typeof r.metadata?.[OWNER_EVIDENCE_METADATA.REMOTE_AGENT_SESSION] === 'string')
+                return false;
+            const named = r.metadata?.[SLACK_TEAM_CHANNEL_CONSTANTS.AGENT_MENTIONS_METADATA_KEY];
+            return Array.isArray(named) && named.some((s) => typeof s === 'string' && !isLocal(s));
+        };
+        for (let i = rows.length - 1; i >= 0; i--) {
+            const r = rows[i];
+            if (askedElsewhere(r))
+                return false;
+            const remote = r.senderType === 'user' && typeof r.metadata?.[OWNER_EVIDENCE_METADATA.REMOTE_AGENT_SESSION] === 'string';
+            if (r.senderType !== 'agent' && !remote)
+                continue;
+            if (remote)
+                return false;
+            const now = this.deps.now ? this.deps.now().getTime() : Date.now();
+            return now - r.createdAt <= ROOM_RESPONDER_CONSTANTS.LOCAL_LOG_FRESH_MS;
+        }
+        return false;
+    }
+    /**
+     * Record on the owner's row who was chosen to answer it — the reply gate
+     * holds only a post that repeats what one of them already said.
+     *
+     * @param persisted - The owner's huddle row
+     * @param dispatch - What was delivered here
+     * @param one - The one-responder options used
+     */
+    recordChosenResponders(persisted, dispatch, one) {
+        const chosen = [
+            ...new Set([
+                ...(dispatch?.huddleOutcomes ?? []).filter((o) => o.dispatched).map((o) => o.sessionName),
+                ...(one.pinned?.answeredBy ? [one.pinned.answeredBy] : []),
+            ]),
+        ];
+        if (chosen.length === 0 || !this.deps.chat.updateMessageMetadata)
+            return;
+        try {
+            this.deps.chat.updateMessageMetadata(persisted.id, { [ROOM_RESPONDER_CONSTANTS.CHOSEN_RESPONDERS_METADATA_KEY]: chosen });
+        }
+        catch {
+            // The gate then holds nothing for this message: never worse than before.
+        }
+    }
+    /**
+     * The owner of the Slack thread a message replies in, read from Slack
+     * (`message.threadContext`), so every machine names the same agent. Null
+     * owner when no agent has spoken in it; `readable: false` when the thread
+     * could not be read in time.
+     *
+     * @param message - Inbound thread reply
+     * @param members - Local agents the room resolves names against
+     * @param roomSessions - This machine's room members
+     * @param isLocal - Whether a session runs here
+     * @returns The thread owner, or null
+     */
+    async slackThreadOwner(message, members, roomSessions, isLocal) {
+        let ctx = message.threadContext
+            ? await withinMs(message.threadContext, ROOM_RESPONDER_CONSTANTS.THREAD_CONTEXT_WAIT_MS, null)
+            : null;
+        if (!ctx && this.deps.readThreadContext) {
+            // One retry after a short pause; a rate limit's retry-after is waited
+            // out too, up to THREAD_READ_RETRY_MAX_WAIT_MS in all.
+            const backoff = ROOM_RESPONDER_CONSTANTS.THREAD_READ_RETRY_BACKOFF_MS;
+            await new Promise((resolve) => {
+                const t = setTimeout(resolve, backoff);
+                t.unref?.();
+            });
+            const maxWaitMs = ROOM_RESPONDER_CONSTANTS.THREAD_READ_RETRY_MAX_WAIT_MS - backoff;
+            ctx = await withinMs(this.deps.readThreadContext(message, { maxWaitMs }).catch(() => null), ROOM_RESPONDER_CONSTANTS.THREAD_CONTEXT_WAIT_MS + maxWaitMs, null);
+        }
+        if (!ctx)
+            return { readable: false, owner: null };
+        const local = members
+            .filter((m) => roomSessions.includes(m.sessionName))
+            .map((m) => ({ session: m.sessionName, name: m.name, botUserId: this.deps.identities?.get(m.sessionName)?.botUserId ?? null }));
+        const remote = (message.room?.members ?? [])
+            .filter((m) => !isLocal(localAgentSession(m.agentSession)))
+            .map((m) => ({ session: m.agentSession, name: m.displayName }));
+        return { readable: true, owner: threadOwnerFromSlack(ctx, buildRoomAgentDirectory({ local, remote })) };
+    }
+    /**
+     * The reply gate (specs/2026-10-03-one-responder-per-message.md §2): an
+     * agent is about to post in a room thread where a different agent already
+     * answered the owner's latest message. Reads this machine's huddle thread
+     * only — no Slack call.
+     *
+     * @param input - Conversation (huddle id), the thread named (huddle message id or Slack thread key), and the agent
+     * @returns The earlier answer when the post should be held, else null
+     */
+    async heldReplyFor(input) {
+        try {
+            await this.load();
+            const mapping = (this.store?.mappings ?? []).find((m) => m.chatChannelId === input.conversationId);
+            const raw = input.thread?.trim();
+            if (!mapping || !raw || !this.deps.chat.listThreadForBridge)
+                return null;
+            let rootId;
+            const named = this.deps.chat.getMessageForBridge(raw);
+            if (named && named.channelId === input.conversationId)
+                rootId = named.threadId ?? named.id;
+            const key = parseSlackThreadKey(raw);
+            if (!rootId && key && key.slackChannelId === mapping.slackChannelId) {
+                rootId = this.deps.chat.findSlackThreadRoot(input.conversationId, key.threadTs)?.id;
             }
+            if (!rootId)
+                return null;
+            const thread = this.deps.chat.listThreadForBridge(input.conversationId, rootId).slice(-ROOM_RESPONDER_CONSTANTS.GATE_THREAD_SCAN);
+            const local = (await this.deps.storage.getTeams()).flatMap((t) => teamChannelMembers(t));
+            const nameFor = (s) => local.find((m) => m.sessionName === s)?.name ??
+                this.lastRooms.get(mapping.slackChannelId)?.members.find((m) => localAgentSession(m.agentSession) === s)?.displayName;
+            return findPriorRoomAnswer(thread, input.agentSession, nameFor);
+        }
+        catch {
+            // The gate is a backstop: never block a reply because it failed.
+            return null;
         }
-        return { mapping, message: persisted, mentions: resolved.mentions, dispatch };
     }
     /**
      * Hold an owner's room message that reached nobody here until an agent
@@ -1541,13 +1878,13 @@ export class SlackTeamChannelService {
      * @param persisted - The huddle row it was recorded as
      * @param threadId - Huddle thread the replies land in
      */
-    watchUnanswered(message, mapping, persisted, threadId, recipients = []) {
+    watchUnanswered(message, mapping, persisted, threadId, recipients = [], heldBy = [], noteOnly = false) {
         const threadTs = message.threadTs || message.ts;
         const key = `${message.channelId}:${threadTs}`;
         this.settleUnanswered(key);
         const timer = setTimeout(() => {
             void this.runUnansweredFallback(key);
-        }, SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_UNANSWERED_FALLBACK_MS);
+        }, noteOnly ? ROOM_RESPONDER_CONSTANTS.NOTE_ONLY_WATCH_MS : SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_UNANSWERED_FALLBACK_MS);
         timer.unref?.();
         this.unanswered.set(key, {
             message,
@@ -1557,6 +1894,8 @@ export class SlackTeamChannelService {
             threadId,
             messageId: persisted.id,
             recipients,
+            ...(heldBy.length > 0 ? { heldBy } : {}),
+            ...(noteOnly ? { noteOnly: true } : {}),
             timer,
         });
     }
@@ -1565,9 +1904,156 @@ export class SlackTeamChannelService {
         const pending = this.unanswered.get(key);
         if (!pending)
             return;
-        clearTimeout(pending.timer);
+        if (pending.timer)
+            clearTimeout(pending.timer);
         this.unanswered.delete(key);
     }
+    /**
+     * Arm the route guard for an owner's room message that was just recorded
+     * (crewly#1015 §7). `dispatchStarting` right before dispatch: it stops the
+     * timer and answers false when a rescue already ran (the caller must not
+     * dispatch then). `fail` when routing threw — a rescue only when dispatch
+     * had not started. `disarm` when routing finished. Not at dispatch within
+     * ROUTE_STALL_MS → the message is rescued.
+     *
+     * @param message - The inbound Slack message
+     * @param mapping - Its room
+     * @param persisted - The huddle row it was recorded as
+     * @param threadId - Huddle thread the replies land in
+     * @returns The guard
+     */
+    armRouteGuard(message, mapping, persisted, threadId) {
+        let done = false;
+        let rescued = false;
+        const placeholders = [];
+        const rescue = (why, err) => {
+            if (done)
+                return;
+            done = true;
+            rescued = true;
+            clearTimeout(timer);
+            this.logger.error(why === 'stalled'
+                ? 'Owner room message routing has not finished — rescuing it with the unanswered-message fallback'
+                : 'Owner room message routing failed — rescuing it with the unanswered-message fallback', {
+                slackChannel: `#${mapping.slackChannelName}`,
+                ts: message.ts,
+                threaded: !!message.threadTs,
+                handoff: message.handoffTo ?? null,
+                ...(err !== undefined ? { error: err instanceof Error ? err.message : String(err) } : {}),
+            });
+            // The original routing's placeholders come down first (quietly): the
+            // hand-off posts its own, and a placeholder of an agent that never
+            // got the message would promise an answer nobody owes.
+            const withdraw = async () => {
+                for (const key of placeholders.splice(0)) {
+                    await this.deps.typing?.withdraw?.(key).catch(() => 0);
+                }
+            };
+            void withdraw()
+                .then(() => this.rescueUnroutedMessage(message, mapping, persisted, threadId))
+                .catch((rescueErr) => this.logger.error('Could not rescue an unrouted owner room message', {
+                ts: message.ts,
+                error: rescueErr instanceof Error ? rescueErr.message : String(rescueErr),
+            }));
+        };
+        const timer = setTimeout(() => rescue('stalled'), this.routeStallMs());
+        timer.unref?.();
+        return {
+            disarm: () => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+            },
+            // After dispatch started, a throw is not an undelivered message:
+            // rescuing then could deliver it twice.
+            fail: (err) => rescue('failed', err),
+            rescued: () => rescued,
+            notePlaceholder: (key) => {
+                if (!rescued)
+                    placeholders.push(key);
+            },
+            dispatchStarting: () => {
+                if (rescued)
+                    return false;
+                done = true;
+                clearTimeout(timer);
+                return true;
+            },
+        };
+    }
+    /**
+     * Wait for a routing step at most ROUTE_STEP_TIMEOUT_MS; on timeout (or a
+     * rejection) go on with `fallback` and say so. Only for steps before
+     * dispatch that routing can do without (crewly#1015 §7).
+     *
+     * @param step - The step
+     * @param fallback - Value used when it does not settle in time
+     * @param label - For the log
+     * @param message - The message being routed (for the log)
+     * @returns The step's value, or the fallback
+     */
+    async bounded(step, fallback, label, message) {
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve({ timedOut: true }), this.windowMs(SLACK_TEAM_CHANNEL_CONSTANTS.ROUTE_STEP_TIMEOUT_ENV, SLACK_TEAM_CHANNEL_CONSTANTS.ROUTE_STEP_TIMEOUT_MS));
+            timer.unref?.();
+        });
+        try {
+            const out = await Promise.race([step.then((value) => ({ value })), timeout]);
+            if ('timedOut' in out) {
+                this.logger.warn('A routing step did not finish in time — going on without it', { step: label, ts: message.ts });
+                return fallback;
+            }
+            return out.value;
+        }
+        catch (err) {
+            this.logger.warn('A routing step failed — going on without it', { step: label, ts: message.ts, error: err instanceof Error ? err.message : String(err) });
+            return fallback;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    /** @returns How long routing may take before the guard rescues the message (env override for tests). */
+    routeStallMs() {
+        return this.windowMs(SLACK_TEAM_CHANNEL_CONSTANTS.ROUTE_STALL_ENV, SLACK_TEAM_CHANNEL_CONSTANTS.ROUTE_STALL_MS);
+    }
+    /**
+     * Rescue an owner's room message whose routing stalled or failed: the
+     * unanswered-message fallback runs at once (the room lead here is handed
+     * the message). A message that was itself such a hand-off is not handed
+     * over again: the owner is told in the thread.
+     *
+     * @param message - The inbound Slack message
+     * @param mapping - Its room
+     * @param persisted - The huddle row
+     * @param threadId - Huddle thread the replies land in
+     */
+    async rescueUnroutedMessage(message, mapping, persisted, threadId) {
+        const threadTs = message.threadTs || message.ts;
+        const key = `${message.channelId}:${threadTs}`;
+        const pending = {
+            // The hand-off does without the Slack thread context: reading it may
+            // be what got stuck.
+            message: { ...message, threadContext: undefined },
+            chatChannelId: mapping.chatChannelId,
+            slackChannelId: message.channelId,
+            threadTs,
+            threadId,
+            messageId: persisted.id,
+            recipients: [],
+            note: SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_ROUTE_STALLED_NOTE,
+        };
+        if (message.handoffTo) {
+            await this.postUnansweredNote(pending, mapping);
+            return;
+        }
+        this.settleUnanswered(key);
+        this.unanswered.set(key, pending);
+        await this.runUnansweredFallback(key);
+    }
     /**
      * An agent spoke in a room — any message we were waiting on in that
      * thread (or the room, for a top-level post) has been taken.
@@ -1599,7 +2085,43 @@ export class SlackTeamChannelService {
             return;
         this.unanswered.delete(key);
         try {
+            // The chosen responder holds it on its queue (it was busy): it will
+            // answer when idle; handing it to the lead too means two answers.
+            if ((pending.heldBy ?? []).length > 0) {
+                this.logger.info('Unanswered room message: the responder holds it on its queue — no hand-off', {
+                    slackChannel: pending.slackChannelId,
+                    ts: pending.message.ts,
+                    heldBy: pending.heldBy,
+                });
+                return;
+            }
+            // An agent — here or on another machine — already replied in the
+            // thread, or shows "working on it": nothing to hand over.
+            const after = this.deps.slackRepliesAfter
+                ? await withinMs(this.deps.slackRepliesAfter(pending.slackChannelId, pending.threadTs, pending.message.ts).catch(() => null), ROOM_RESPONDER_CONSTANTS.THREAD_CONTEXT_WAIT_MS, null)
+                : null;
+            const harnessNotes = [SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_UNANSWERED_NOTE, SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_ROUTE_STALLED_NOTE];
+            if (after?.some((m) => m.isBot && !harnessNotes.includes(m.text.trim()))) {
+                this.logger.info('Unanswered room message: an agent has replied or is working on it in Slack — no hand-off', {
+                    slackChannel: pending.slackChannelId,
+                    ts: pending.message.ts,
+                });
+                return;
+            }
             const mapping = this.findBySlackChannelId(pending.slackChannelId);
+            // Not this machine's to hand over (another may be the watcher), or the
+            // thread could not be read just now: tell the owner rather than hand
+            // it over blind and risk a second answer.
+            const unreadable = !!this.deps.slackRepliesAfter && after === null && !!pending.timer;
+            if (pending.noteOnly || unreadable) {
+                this.logger.warn('Unanswered room message: telling the owner instead of handing it over', {
+                    slackChannel: pending.slackChannelId,
+                    ts: pending.message.ts,
+                    reason: pending.noteOnly ? 'not this machine\'s hand-off' : 'Slack thread unreadable',
+                });
+                await this.postUnansweredNote(pending, mapping);
+                return;
+            }
             const lead = mapping ? await this.localRoomLead(mapping) : null;
             if (mapping && lead && pending.recipients.includes(lead)) {
                 // The lead already holds it (delivered as optional): handing it over
@@ -1684,7 +2206,7 @@ export class SlackTeamChannelService {
             await this.deps.slack.sendMessage({
                 channelId: pending.slackChannelId,
                 threadTs: pending.threadTs,
-                text: SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_UNANSWERED_NOTE,
+                text: pending.note ?? SLACK_TEAM_CHANNEL_CONSTANTS.ROOM_UNANSWERED_NOTE,
                 skipChatV2Mirror: true,
                 notAnAnswer: true,
                 ...(botToken ? { botToken } : {}),
@@ -1714,7 +2236,7 @@ export class SlackTeamChannelService {
      * @param remoteAgent - Authoring agent, when an agent wrote it
      * @returns The ticket the message belongs to, or null
      */
-    async intakeTicket(message, mapping, mentions, planned, handoffTo, remoteAgent) {
+    async intakeTicket(message, mapping, mentions, planned, handoffTo, remoteAgent, delivered) {
         try {
             const intake = getTicketIntakeService();
             if (!intake || remoteAgent)
@@ -1738,7 +2260,16 @@ export class SlackTeamChannelService {
                 userName: message.user?.realName || message.user?.name,
                 hasFiles: message.hasFiles,
                 ownerUserId: this.deps.getOwnerUserId?.() ?? null,
-            }, 'team-channel', { ...(targetAgent ? { targetAgent } : {}), ...(postAs ? { receiptPostAs: postAs } : {}) }));
+            }, 'team-channel', { ...(targetAgent ? { targetAgent } : {}), ...(postAs ? { receiptPostAs: postAs } : {}) }), undefined, 
+            // Filed after the message went out without its marker: link the
+            // ticket to the copy that was dispatched (crewly#1015 follow-up L2).
+            delivered
+                ? (late) => {
+                    const linked = linkLateTicket(late, delivered);
+                    if (linked)
+                        this.logger.info('Late ticket linked to the delivered message', { ticketId: linked.id, messageId: delivered.id });
+                }
+                : undefined);
             return ticketOfOutcome(outcome);
         }
         catch (err) {
@@ -3006,6 +3537,28 @@ export class SlackTeamChannelService {
     }
 }
 /** Type guard for persisted mapping rows. */
+/**
+ * A promise's value, or `fallback` when it takes longer than `ms`.
+ *
+ * @param promise - What to wait for
+ * @param ms - Longest wait
+ * @param fallback - Value on timeout
+ * @returns The value, or the fallback
+ */
+async function withinMs(promise, ms, fallback) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(fallback), ms);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 function isMapping(value) {
     const v = value;
     return (!!v &&