[cgaravitoq]

A progress milestone reached Slack unredacted whenever Bloop posted it itself: the verbatim: true branch was the only one that ran redact, so the direct path (narration unset, the delegation-only default at apps/slack-agent/src/index.ts:55-77) and the narration fallback both posted <!here> or a token quoted from a thread as given. Redacting the milestone text before replyOf appends the trusted mentions and links block fixes both, and the closing block is untouched: redacting the finished reply would escape <@U…> into <@U…> and break admitted mentions.

Verify

• A direct milestone (narration undefined, verbatim unset) with <!here> Bearer xoxb-1234-not-a-real-token posts neither: narrated progress endpoint > redacts what a direct milestone would carry, red on f28de36 (Expected to not contain: "<!here>" / Received: "<!here> Bearer xoxb-1234-not-a-real-token\n<https://example.com/run>"), green after.
• The narration fallback with the same text posts neither: narrated progress endpoint > redacts what the narration fallback would carry, red on f28de36 with the same received text, green after.
• fallbackText through the delivery path posts neither: narrated progress endpoint > redacts the fallback text the delivery path owes the thread drives the real delivery path with the binding progress built (narrate turn, then openSlackDelivery/finishSlackDelivery), green after, and, on f28de36 too: that one was already redacted at packages/core/src/delivery.ts:731 (post(sanitizeReply(notice), closingBudget)), where the fallback trailer and failure notice are sanitized like any streamed text. It is a pin, not a fix; durable Slack delivery covers the same fallback on the durable record.
• The verbatim test still passes: redacts what a verbatim milestone would carry (unchanged).
• bun run verify: exit 0, 374 pass / 0 fail across 17 files, format, lint, typecheck, knip, deploy:dry and bun audit (561 packages, 1 ignored) green.

Commits

1. test 37c3757: pins the three texts plus the delivery path.
2. fix 6a21349: one redact(milestone.text) per reply that leaves for Slack, in the direct branch and in the narration fallback.

Not covered

• The live run: proving this against a real workspace is the conductor's wave-end pass.
• The root message (<title> · <label>) is unchanged: it carries no milestone text.
• The narrated reply still reaches Slack through the delivery boundary, which redacts the model's text and the fallback text; a milestone with a narration turn is not redacted before the model sees it, since the model output is what is posted.

Goal: bloop-delegation-3 row A2.