feat(slack): Recover durable reply delivery

[dcramer]

Slack replies now persist a delivery intent before the provider write and recover uncertain or interrupted delivery through one SQL outbox. Ordinary Slack turns, continuations, OAuth resumes, and internal dispatches share the same post/reconcile/terminal path; accepted multipart replies commit the accepted prefix once, while rejected output is rolled back without discarding already committed model or tool continuity.

Heartbeat recovery claims due work with bounded leases and projection reads, then uses first-terminal-wins lifecycle updates to avoid duplicate completion or failure. Reconciliation never blindly reposts an ambiguous write. Background post and reconciliation resolve the Slack installation from the persisted destination workspace, so recovery remains correctly scoped in multi-workspace deployments.

Authorization callbacks register an exact recovery identity before consuming a one-time code. A separate TTL-bound, capacity-bounded index makes committed callback gaps enumerable without relying on the capped operational session feed; exact retries are idempotent, overflow fails before code exchange, and entries clear after durable wake or terminalization.

This PR stacks on #916. It leaves the canonical conversation-event migration 0005 byte-for-byte unchanged and adds only 0006_pending_delivery_outbox for the outbox table and due-work index. Review should start with the outbox and recoverable delivery service, then the three runtime integrations, and finally callback/heartbeat fencing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
junior-docs	Ready	Preview	Jul 18, 2026 4:24pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 31aa235. Configure here.}

[cursor]

Dispatch status flips on retry

Medium Severity

The delivered-marker repair path writes a persistence_failed terminal and marks the dispatch completed, but a later callback that reads that same terminal through priorTerminal sets status from modelSucceeded, which is false for any turn_failed. A crash between the lifecycle write and markDispatch therefore projects the same delivered reply as failed on retry.

 

^{Reviewed by Cursor Bugbot for commit 31aa235. Configure here.}