Use the active turn deadline budget in timeout errors and timeout telemetry. This keeps resumed turns with shorter host request deadlines from reporting the configured maximum instead of the operative timeout.

Refs GH-470
Co-Authored-By: GPT-5 Codex <codex@openai.com>

Treat tool results, not steering user messages, as the terminal assistant output boundary. This prevents mid-turn steering from truncating assistant text that belongs to the same finalized reply.

Refs GH-470
Co-Authored-By: GPT-5 Codex <codex@openai.com>

Apply Pi steering inside the durable injection callback so a steering failure rejects before mailbox records are marked injected. This keeps Slack follow-ups pending for a later worker instead of silently dropping them.

Refs GH-470
Co-Authored-By: GPT-5 Codex <codex@openai.com>

Thread durable worker yield checks into Pi safe boundaries so Slack turns pause before starting another model iteration when the worker soft deadline has elapsed.

Carry host request deadlines into resumed Slack turns and skip heartbeat timeout-resume recovery when the persisted conversation no longer marks that session as the active turn.

Refs GH-470
Co-Authored-By: GPT-5 Codex <codex@openai.com>

Persist soft-yield boundaries with a distinct yield resume reason so routine worker continuation does not consume timeout resume slices.

Bubble cooperative yield through Slack runtime handling so the generic conversation worker releases the lease and requeues the next slice at the durable worker boundary.

Refs GH-470
Co-Authored-By: GPT-5 Codex <codex@openai.com>

Mark expired conversation leases runnable so recovered queue nudges can reach continuation scanning even when mailbox messages were already injected.

Include cooperative yield records in stale continuation heartbeat recovery.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Treat a timeout or yield continuation summary without a valid resume request as a worker failure instead of completed idle work.

This keeps the conversation runnable for queue retry or heartbeat repair instead of clearing needsRun after recovered idle work.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Make Slack resume startup report whether a continuation actually started so idle durable work can distinguish a real resume from a stale no-op.

Terminalize invalid or skipped awaiting timeout/yield sessions before completing idle work, and cover both invalid metadata and stale active-turn mismatch with component tests.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

When a new Slack message arrives while a previous turn is awaiting resume, schedule the old continuation without marking the new message as replied.

This keeps the follow-up available for steering or the next handled turn instead of silently treating it as answered.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Return a model-visible MCP tool error when a resumed slice asks for a tool name that is no longer present in the rebuilt provider catalog. Include recovery guidance so the agent can refresh the provider catalog before retrying.

Fixes GH-492

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Only mark Slack mailbox records injected after the runtime has durably persisted the turn handoff. Preserve pending mailbox work when a handler only reschedules an awaiting continuation, while still marking already-handled early replies after their thread state is saved.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Prefer awaiting turn continuation recovery before routing pending Slack mailbox records. When a continuation starts, leave pending mail runnable so the queue re-drives it after the active turn finishes instead of looping through a no-handoff Slack handler path.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Sign Vercel conversation work queue payloads with JUNIOR_SECRET and verify the decoded callback payload before processing work. This keeps the public queue route from executing forged conversation work even outside Vercel trigger enforcement.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Keep failed continuation persistence from becoming a generated assistant error reply, while preserving the terminal timeout slice-cap record as failed state.

Propagate Slack handoff lost-lease results through the conversation worker so downstream completion does not treat the run as successful.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Handle already-replied Slack deliveries before rescheduling an active continuation so duplicate events complete mailbox handoff without nudging the old turn again.

Keep auth-pause persistence failure behavior aligned with the existing provider-error contract while preserving the continuation failure fixes for yield and timeout paths.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Worker errors already marked the conversation runnable before releasing its lease, but a recent enqueue marker could make heartbeat defer recovery. Send a fresh wake-up nudge for failed runner slices so runnable work is redelivered promptly.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Cooperative yields could snapshot Pi state before queued steering messages appeared in agent.state.messages. Keep the latest safe boundary candidate available so yielded, timed-out, and auth-paused resumes do not overwrite a longer steering-aware transcript.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Bound signed conversation-work callbacks to a small timestamp window so old queue payloads cannot be replayed indefinitely.

When a Slack follow-up arrives during an active parked turn, keep auth pauses parked and fail malformed awaiting continuations before accepting new work. This prevents a fresh turn from replacing the durable session state.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Preserve rapid Slack follow-ups through durable conversation work and tighten timeout-resume scheduling.

Add shared test adapters for queue, Slack webhook, Slack outbox, waitUntil, and signed resume requests so tests exercise real boundaries with less mocking.

Document Django-inspired test adapter principles and stabilize slow Slack integration timeouts under clustered runs.

Refs GH-470

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Replace automatic processing eyes with a completion check when Slack turns finish.

Leave parked, skipped, and failed turns without completion so reactions match the lifecycle.

Restore requester credential context when timeout resumes rebuild reply context after the rebase.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Report whether running turn checkpoints actually persist before committing durable Slack mailbox input.

Propagate lost-input ownership errors instead of allowing a successful turn without mailbox commit.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Keep runnable conversation ids in the heartbeat recovery index when pruning overflow entries.

Treat failed worker lease check-ins as lost ownership so in-flight work cannot complete after lease loss.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Keep terminal timeout resume failures on the error path after the session record reaches the slice cap. This prevents Slack delivery from treating an exhausted turn as a successful assistant reply containing an Error-prefixed message.

Add a regression that seeds the durable session at the timeout cap and verifies the runtime throws while persisting the failed terminal record.

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Skip duplicate inbound retries when the conversation already has a fresh queue marker.

Repair stale or missing markers with a fresh idempotency key so failed handoffs still recover promptly.

Add fake queue attempt introspection and Slack retry coverage so duplicate sends are visible in tests.

Refs GH-470

Co-Authored-By: GPT-5 Codex <codex@openai.com>

Drop unused imports left after the latest rebase conflict resolution so lint passes with warnings denied.

Refs GH-470

Co-Authored-By: GPT-5 Codex <codex@openai.com>