fix(slack): route Enterprise Grid messages by workspace (#120087)

* fix(slack): route Grid messages by workspace

* fix(slack): use authorized Grid DM sender

* fix(slack): preserve ordinary client calls in grid routing

* test(slack): keep grid target coverage in scoped suite

* fix(slack): preserve workspace scope in approval routes

* feat(slack): scope Grid uploads and reactions by workspace

* fix(slack): preserve ordinary action read targets

* fix(slack): reuse Grid clients for thread status

* fix(slack): infer current Grid workspace for native actions

* fix(slack): record streamed thread participation promptly

* fix(slack): scope Grid member info to current workspace

* feat(slack): support Grid write actions

* feat(slack): support Grid read actions

* fix(slack): remove obsolete channel resolver

* fix(slack): route current Grid outbound delivery

* test(slack): cover Grid thread participation

* test(slack): use valid Grid team ID

* fix(slack): keep Grid thread participation without bot identity

* fix(slack): enable Grid pin reads

* fix(slack): keep current Grid sends workspace aware

* test(slack): assert Grid send routing synchronously

* refactor(slack): remove obsolete Grid action allowlist

* refactor(slack): derive Grid channel routing targets

* refactor(slack): pass optional team scope uniformly

* test(slack): expect uniform client options

* refactor(slack): name unscoped cache key explicitly

* refactor(slack): always pass action options

* refactor(slack): pass optional team scope directly

* refactor(slack): build team-scoped action options once

* refactor(slack): centralize optional team target formatting

* refactor(slack): construct reconciliation clients from scope

* refactor(slack): resolve delivery policy before sending

* refactor(slack): clarify inbound target roles

* refactor(slack): minimize validated event scope

* fix(slack): route outbound workspace through target

* fix(slack): format post response errors safely

---------

Co-authored-by: Sarah Fortune <sarah.fortune@gmail.com>

docs/channels/slack.md

@@ -240,14 +240,21 @@ bot-authored `message` and `app_mention` events before dispatch, regardless of
 `allowBots`, because org installs do not provide a stable workspace-qualified
 bot identity for loop prevention.
 
-Enterprise support is intentionally limited to direct Socket Mode or HTTP
-`message` and `app_mention` events and their immediate replies. Relay mode,
-slash commands, interactions, App Home, reaction event listeners, pins, Slack
-action tools, Slack-native approvals, bindings, queued or scheduled delivery,
-and proactive sends are unavailable for an enterprise account. Outbound
-acknowledgment, typing, and status reactions are supported through the
-listener-owned Slack client and require `reactions:write`; inbound reaction
-notifications and reaction action tools remain unavailable.
+Enterprise support accepts direct Socket Mode or HTTP `message` and
+`app_mention` events plus workspace-qualified outbound messages. Relay mode,
+slash commands, interactions, App Home, reaction event listeners, pins,
+Slack-native approvals, and bindings remain unavailable for an enterprise
+account. Slack action tools remain unavailable except for file uploads and
+adding or removing emoji reactions. Outbound acknowledgment, typing, and
+status reactions are supported and require `reactions:write`; inbound reaction
+notifications remain unavailable.
+
+OpenClaw records Enterprise Grid destinations as
+`team:<team-id>:channel:<channel-id>` or `team:<team-id>:user:<user-id>`.
+Current-conversation sends, uploads, and reactions inherit that destination.
+Detached or proactive calls must provide the workspace-qualified target;
+bare channel and user IDs fail closed because those IDs can be reused by
+different workspaces.
 
 Immediate replies reuse the standard Slack delivery behavior for chunks,
 media, metadata, identity fallback, unfurls, and receipts, but only while the