fix(channels): slack caveat comment matches the gateway's new wording

CHANGELOG.md

@@ -47,6 +47,10 @@ carries the paired entry and the release notes.
   Lark `open_id` (`ou_…`); pasting a Lark `user_id` into the old label built an allowlist that never
   matched. The field is now labelled "Allowed Lark open_ids (ou_…, comma-separated)" with a short
   hint that `/claim` adds one automatically. (#130)
+- **The Slack card's caveat comment matches the gateway's new wording.** With Socket Mode on and
+  a `channel_id` set, the bot now ignores every other channel while direct messages still arrive;
+  the comment on `SlackCard` and the Socket Mode test fixture both relay that sentence, and two
+  stale "three cards" comments are reworded to drop the count.
 
 ## [0.3.28] — 2026-09-08
 

src/components/ops/channel-setup.tsx

@@ -177,7 +177,7 @@ export function MissingCredentialNotice({ what }: { what: string }) {
 }
 
 export interface ChannelSetupOptions {
-  /** Catalog key, used for the field ids so three cards can coexist. */
+  /** Catalog key, used for the field ids so the cards can coexist. */
   channelKey: string;
   /** The saved allowlist, which seeds the editor once connected. */
   allowedUsers: string[];

src/components/ops/channels-panel.test.tsx

@@ -724,8 +724,9 @@ describe("ChannelsPanel Slack", () => {
 
   it("shows the gateway's Socket Mode caveat rather than inventing one", async () => {
     // F-3 from the 2026-09-11 drive: with Socket Mode on, a channel id filter
-    // makes the bot ignore every direct message. The gateway decides when that
-    // applies and returns the sentence; the console must not guess at it.
+    // makes the bot ignore every other channel, while direct messages still
+    // arrive. The gateway decides when that applies and returns the sentence;
+    // the console must not guess at it.
     render(<ChannelsPanel />);
     const bot = (await screen.findByLabelText("Slack bot token")) as HTMLInputElement;
     fireEvent.change(bot, { target: { value: "xoxb-1" } });
@@ -735,15 +736,15 @@ describe("ChannelsPanel Slack", () => {
       bot_username: null,
       allowed_users: 0,
       warning:
-        "Socket Mode with a channel_id set: the bot ignores direct messages and every other conversation.",
+        "Socket Mode is on and channel_id is set: the bot ignores every channel except that one. Direct messages still reach it. Clear channel_id to accept every channel.",
       restarts_runtime: true,
     });
     fireEvent.click(screen.getByRole("button", { name: "Connect Slack" }));
 
     await waitFor(() => expect(toastSuccess).toHaveBeenCalledTimes(1));
     expect(toastSuccess.mock.calls[0][1]).toEqual({
       description:
-        "Socket Mode with a channel_id set: the bot ignores direct messages and every other conversation.",
+        "Socket Mode is on and channel_id is set: the bot ignores every channel except that one. Direct messages still reach it. Clear channel_id to accept every channel.",
     });
   });
 

src/components/ops/channels-panel.tsx

@@ -485,11 +485,11 @@ function ApprovalsCard({ boundary }: { boundary: { owners: string[]; autonomousT
  * Telegram's card, rebuilt on the shared pieces.
  *
  * Its words and its control names are untouched, deliberately. The suites pin
- * `Connect`, `Save allowlist` and `Disconnect` as bare names, and with three
- * cards on the page those read as ambiguous — but renaming them is a Telegram
- * behaviour change, and this plan's stop condition says to keep the behaviour
- * and report it. Discord and Slack name their controls in full; the asymmetry
- * is recorded rather than smoothed over.
+ * `Connect`, `Save allowlist` and `Disconnect` as bare names, and where the
+ * cards share the page those read as ambiguous — but renaming them is a
+ * Telegram behaviour change, and this plan's stop condition says to keep the
+ * behaviour and report it. Discord and Slack name their controls in full; the
+ * asymmetry is recorded rather than smoothed over.
  */
 function TelegramCard({
   connected,
@@ -804,9 +804,10 @@ function DiscordCard({
  * filter.
  *
  * The bot token authenticates API calls; the app-level token opens Socket Mode.
- * With Socket Mode on, a channel filter makes the bot ignore direct messages —
- * the gateway returns that caveat in `warning` and the card relays it verbatim
- * rather than deciding for itself when it applies.
+ * The gateway decides when a channel filter applies and returns the caveat in
+ * `warning`; the card relays it verbatim — other channels ignored, direct
+ * messages still arrive — rather than deciding for itself when the caveat
+ * applies.
  */
 function SlackCard({
   connected,