support_desk 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f20ef59f51139224d4dc822bc4d96eced0d5517e6b308399f707d43eef11d229
-  data.tar.gz: fde3321433991bb1c7aa89a944e57a5fa4cd7cf19da1ba3444f8a81289b962ab
+  metadata.gz: f59effae389db2716b2776132aa991881576422815776fe189e984ca95ce72ae
+  data.tar.gz: 2c8b33513576b69e28e787820f9059178c5f16a2f76cbe2b9b812e0bd1b5c835
 SHA512:
-  metadata.gz: 0fcd4009a005176029c7f2c07dc5f4a4dd7c6bee5a46428025d9ccc56d30f9b2a76170713d9362a3f5aab658f34c0f9c0ad151d048969fc7b7a0ea3b641ec724
-  data.tar.gz: ae545aeec1cac66db40a3df1777fd2c7747dda0103c99d7424b55d06cbbd6dd67cb9cb8b1685e642d97f82153afc2ea149257967957da63b2e1524a7c437bf52
+  metadata.gz: 61e07986793fef354b19954ca00d97b162c452a16244f7db3969e5e76d04aabd70610a5a98279f260c712f15043246000a2918b2f573af497f95f2a3dd7380f5
+  data.tar.gz: 3b426605c9c9395efedc6ef2d77fb2e3a135e5f36e2fa6415f3925591a7d99f42014a7dccdac95c0064adccaa0454aecebad7e9eef757adab5a10557a890df55

data/CHANGELOG.md

@@ -4,6 +4,85 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-10-25
+
+A desk per customer, a record you can replay, and two kinds of provenance.
+Two additive migrations (`rails g support_desk:upgrade`); without an owner,
+nothing about an existing install changes.
+
+**Turning owners on is staged**: migrate, deploy 0.6 to every process and
+retire every 0.5 one, and only then set `SupportDesk::Current.owner`. A 0.5
+process looks desks and assistants up by key alone and, once owned rows
+exist, can pick another owner's. See "Upgrading to 0.6" in the README.
+
+### Added
+
+- **Owners.** Desks and assistants gain an optional polymorphic `owner`
+  (migration `add_owners_to_support_desk`): keys are unique per owner, and
+  the old unique key stays, as a partial index, for rows with no owner.
+  `SupportDesk::Current.owner` says whose desks a request or job means;
+  `SupportDesk.desk`, `SupportDesk.assistant`, `Ticket.for_desk`, the SLA
+  scopes (`overdue`, `at_risk`, `past_sla`), `find_topic` and the console's
+  default desk list read that owner's rows. Both readers take `owner:` to
+  name one explicitly. A desk's assistant is its owner's assistant, whatever
+  `Current.owner` says, so another owner's assistant is a `NotAnAssistant`.
+  Owned records are cached per request or job (in `Current`); ownerless ones
+  stay memoised per process, as before.
+- **Settings from rows.** `config.desk_settings = ->(desk) { … }` and
+  `config.assistant_settings = ->(assistant) { … }` return a Hash overlaid on
+  the initializer, through the same validating setters (`topics:` takes a
+  block). `Desk#config` and `Assistant#config` are the overlaid settings.
+- **Durable replay** (PostgreSQL 13+, migration `add_replay_to_support_desk`).
+  Read uncached: under the query cache every request and job runs with, a
+  repeated snapshot query would freeze the horizon.
+  `support_desk_events` and `support_desk_message_registrations` gain
+  `xact_id` (the writing transaction, `pg_current_xact_id()`, stored as
+  bigint so `schema.rb` can dump it) and `position` (one sequence for both
+  tables). `SupportDesk::Events.replay(horizon:, resume: nil, batch_size: 500)`
+  yields every row below the oldest running transaction in `(xact_id,
+  position)` order and returns the next horizon once the range is drained; a
+  cursor yielded with each row resumes a range that raised. See "Replaying
+  what was written down" in the README for the schedule a position
+  checkpoint loses.
+- **`assistant_turn` and `draft_proposed` event rows.** Both signals are now
+  written down in the transaction that produced them (new `Event::KINDS`,
+  internal, and `Event::SIGNAL_KINDS`, kept out of the timeline by the new
+  `Event.history` scope). `redispatch_assistant_turns!` re-emits without
+  writing another row.
+- **Conditional human replies.** `reply!(…, turn:)` and `note!(…, turn:)` by
+  a person raise `StaleTurn` and write nothing when the case moved on since
+  the turn was read. Without `turn:` they are unchanged.
+- **Message provenance.** `post_requester_message!(body, files:, via:,
+  external_id:)` is public and stamps `metadata["support_desk"]` with `via`
+  (never for `:in_app`) and `external_id`; `open!(via:)` stamps the opening
+  message.
+
+### Changed
+
+- **Everything a requester sees is the current owner's.** The engine's list,
+  case lookup (by reference and id) and limit wall, `conversations_of` /
+  `requester_conversation` (and so chats' lookup through
+  `SupportDesk::ConversationAccess`), `awaiting_support_reply?`,
+  `unread_support_count`, the inbox door and `open_support_ticket_about` read
+  `support_tickets.on_current_desks` (new scopes `Ticket.owned_by(owner)` and
+  `Ticket.on_current_desks`). The brief's and context card's open-case counts
+  are the case owner's.
+- **The launcher badge streams per owner** (`SupportDesk::Launcher.stream`,
+  `[requester, :support_desk, owner]` when there is one) and the broadcast job
+  counts under the case's owner.
+- The console's queue badge is cached per desk ROW, not per key.
+- The generated turn job resolves the case's own assistant
+  (`ticket.assistant`, its desk owner's) and acts only if her key is the one
+  queued. A worker has no `Current.owner`; a lookup by key named the ownerless
+  assistant. Regenerate, or make the same two-line change in yours.
+- A note with a `turn:` locks the conversation and folds in unregistered
+  requester messages before comparing it, as a reply does.
+- `release_silent_assistants!` and `redispatch_assistant_turns!` iterate
+  assistant and desk rows rather than configured keys, so one run covers
+  every owner.
+- The requester views' desk name, promise and inbox door read the current
+  owner's desk (`support_desk_config`), still without creating it.
+
 ## [0.5.0] - 2026-10-19
 
 Intended as **0.5.0**: "Need help?" in the corner. **Requires chats >= 0.7.1**

data/README.md

@@ -152,12 +152,14 @@ configuration mistake is a boot failure, never a 3 a.m. `NoMethodError`.
 | `current_requester_method` | `:current_user` | how the engine finds the person asking |
 | `current_agent_method` | `:current_user` | how the console finds the person answering (or define `current_agent` in your controller) |
 | `authenticate_method` | `:authenticate_user!` | your own filter, run before every requester screen |
-| `visible_desks_for` | `nil` (every desk) | `->(agent) { … }` returning the desks this agent may work; scopes the whole console |
+| `visible_desks_for` | `nil` (every desk of `Current.owner`) | `->(agent) { … }` returning the desks this agent may work; scopes the whole console |
 | `thread_page` | `:chats` | where a requester reads a case: `:chats` (its thread in the chats inbox) or `:support` (this engine's own ticket page, for support kept apart from the inbox; see [Support apart from the inbox](#support-apart-from-the-inbox)) |
 | `authorize_console` | `nil` (allow) | `->(agent, ticket, action) { … }`; asked before every console action, `ticket` is nil for `index`, `new`, `next` and `open_conversation`; a hook that raises **denies** |
 | `assistant(key) { … }` | — | declare an assistant (see [Assistants](#-assistants)); `config.assistants`, `config.assistant?(key)` read them back |
 | `default_assistant` | the only one declared | which assistant the `:default` desk gets when more than one exists |
 | `on(event) { … }` | — | subscribe to an event (see [Events](#events)); pass `key:` from code that reloads |
+| `desk_settings` | `nil` | `->(desk) { … }` returning a Hash of desk settings for that row, overlaid on the initializer (see [A desk per customer](#a-desk-per-customer)) |
+| `assistant_settings` | `nil` | `->(assistant) { … }`, the same for an assistant |
 
 ### Desk settings
 
@@ -202,6 +204,76 @@ SupportDesk.desk(:billing)  # another one (nil if nobody configured it)
 `SupportDesk.doctor.print` checks all of it against a running app (see
 [Doctor](#doctor)).
 
+### A desk per customer
+
+One app, many customers, each with its own desk. Give every desk an
+**owner** — any record: an account, a workspace, a product — by saying whose
+request or job this is:
+
+```ruby
+# app/controllers/application_controller.rb
+before_action { SupportDesk::Current.owner = current_workspace }
+
+# a job
+SupportDesk::Current.set(owner: workspace) { workspace.support_digest! }
+```
+
+Now `SupportDesk.desk` is **that workspace's** `:default` desk, created the
+first time it is asked for, and everything that names a desk by key follows:
+`ask_support!`, `Ticket.for_desk`, `overdue` and `at_risk`, the console's desk
+list, `find_topic`. Keys are still declared in code, so `:billing` means the
+same thing for every owner; owners multiply rows, not keys. Everything a
+**requester** sees is that owner's too — their list, a case by reference,
+chats' lookup of their support conversations, `unread_support_count`, the
+launcher's badge (on its own stream per owner) — so one person who is a
+customer of two owners never sees one owner's case from the other's app. Anything reached
+from a ticket ignores `Current.owner` — a case knows its desk, a desk knows
+its owner, and its assistant is that owner's assistant. One owner's assistant
+asking to answer another owner's case is a `NotAnAssistant`.
+
+Each owner can have its own settings, from its own rows:
+
+```ruby
+config.desk_settings      = ->(desk)      { desk.owner&.support_settings }      # { name: "Acme Help", reply_within: 4.hours }
+config.assistant_settings = ->(assistant) { assistant.owner&.assistant_settings } # { autonomy: :reply, max_turns: 3 }
+```
+
+A hook returns a Hash or nil. Every value goes through its own setter, so a
+bad row fails exactly like a bad initializer (`ConfigurationError`), and
+whatever the Hash leaves out comes from the initializer. `topics:` takes the
+same block `config.topics` does.
+
+Without an owner nothing changes: the desk with no owner is the one every
+install had before 0.6, memoised for the process. An owned desk is cached for
+one request or job instead — owners are many and change their settings at
+runtime, so a process-wide memo would grow with every customer and serve
+yesterday's name. `SupportDesk.desk(:default, owner: acme)` and
+`SupportDesk.assistant(:rose, owner: acme)` name one explicitly. The sweeps
+(`release_silent_assistants!`, `redispatch_assistant_turns!`) run once for
+everybody.
+
+**Upgrading to 0.6 — in three stages.** The owners migration adds a nullable
+polymorphic `owner` to desks and assistants, makes keys unique per owner, and
+keeps the old unique key for rows with no owner (a partial index; MySQL has
+none, so there an ownerless key is kept unique by the lookup only). `owner_id`
+follows your generator's primary key type.
+
+1. **Migrate** (`rails g support_desk:upgrade && rails db:migrate`). 0.5
+   processes keep working: nothing has an owner yet.
+2. **Deploy 0.6 to every process** — web, jobs, consoles, anything that loads
+   the gem — and retire the last 0.5 one.
+3. **Only then turn owners on**: set `SupportDesk::Current.owner`, and with it
+   create the first owned desk or assistant.
+
+The order is not a formality. 0.5 finds a desk with `find_by(key:)`, which
+knew nothing of owners, and from the first owned row on a key no longer names
+one row: a 0.5 process still running could hand a case to another owner's
+desk, or act as another owner's assistant. Until stage 3 there is nothing for
+it to pick wrongly; 0.6 never picks an owned row for a request with no owner.
+
+The replay migration (PostgreSQL only) rewrites the events table: run it in a
+quiet window.
+
 ## Topics
 
 Topics are a **tree defined in code** and stored on the ticket as a stable
@@ -307,6 +379,7 @@ ticket.overdue?  ticket.at_risk?
 ticket.time_to_first_reply  ticket.time_to_close
 
 ticket.reply!("…", by: lucia)               # sent by the desk, signed by Lucía
+ticket.reply!("…", by: lucia, turn: seen)   # …only if the case is still at the turn Lucía read
 ticket.note!("VIP customer", by: lucia)     # internal; never in the conversation
 ticket.assign!(to: lucia, by: lucia)        # "take"
 ticket.hand_off!(to: pedro, note: "…", by: lucia)
@@ -335,6 +408,7 @@ ticket.export              # a GDPR-friendly Hash: the requester's transcript an
 ticket.notification_title  # "Support · new message" — safe for a lock screen
 ticket.notification_body   # the label — for an authenticated feed
 ticket.register!(message)  # fold a chats message into the clocks by hand (imports); idempotent, and what the chats subscriber calls
+ticket.post_requester_message!("…", via: :email, external_id: "<id@mail>")   # as the requester, with provenance
 ticket.desk_config         # this desk's slice of the configuration
 
 SupportDesk::Ticket.find_by_reference!("t-ab12cd")      # forgives case, the prefix and Crockford lookalikes (O→0, I/L→1)
@@ -350,7 +424,22 @@ has a `kind` (`opened` `assigned` `handed_off` `released` `drop_in` `closed`
 `reopened` `topic_changed` `subject_attached` `note` `escalated`
 `human_requested` `assistant_paused` `assistant_resumed` `draft_sent`
 `draft_rejected` `assistant_withheld` — plus kinds reserved for later
-releases), an `actor` and a `payload`, and is read-only once written.
+releases), an `actor` and a `payload`, and is read-only once written. Two
+more kinds are signals rather than history — `assistant_turn` (there is
+something to answer, at this turn) and `draft_proposed` — written down so a
+[durable reader](#replaying-what-was-written-down) hears about them; they are
+not in the timeline or the export.
+
+A person's `reply!` and `note!` take an optional `turn:`. With one, they are
+**conditional**: a case that moved on since the turn was read (a customer
+wrote again, somebody else answered) raises `SupportDesk::StaleTurn` and
+nothing is written — the `If-Match` of an answer composed in a review screen
+or sent through an API. Without one, they are what they always were.
+
+`post_requester_message!` posts as the requester — what an importer or a
+channel connector calls. `via:` and `external_id:` ride on the message as
+`metadata["support_desk"]` (`:in_app` is the default and is never stamped);
+a case opened with `open!(via: :email)` stamps its first message too.
 
 ### Scopes
 
@@ -1101,7 +1190,8 @@ seat: `assign!(to: rose, by: rose, turn:)` and `release!(by: rose, turn:)`
 require it when `by:` is an assistant (an omitted turn is an
 `ArgumentError`, a stale one a `StaleTurn`), because a run that finished
 after the case moved on must not release the seat a newer one took. A
-**person's** calls are unchanged and take no turn.
+**person's** calls need no turn; `reply!` and `note!` accept one and are
+then conditional too (see [Tickets](#tickets)).
 
 Two consequences worth knowing:
 
@@ -1698,6 +1788,58 @@ nobody holds the case — the gem computes it so every host gets "assignee or
 everyone" right. System messages (opening lines, closure notices) never emit
 anything and never move the clocks.
 
+### Replaying what was written down
+
+Events fire after commit, in memory: a process that dies between the commit
+and the subscriber loses them. What it cannot lose is what the transaction
+wrote — an event row per transition (the `assistant_turn` and
+`draft_proposed` signals included) and a registration row per message. On
+PostgreSQL 13+ you can read those back, in order, without ever skipping one:
+
+```ruby
+horizon = SupportDesk::Events.replay(horizon: checkpoint.horizon) do |row|
+  Bridge.ingest(row)    # a SupportDesk::Event or a SupportDesk::MessageRegistration
+end
+checkpoint.update!(horizon: horizon)
+```
+
+Every row stores `xact_id`, the transaction that wrote it, and `position`,
+from one sequence for both tables. `replay` captures the oldest transaction
+still running, `h = pg_snapshot_xmin(pg_current_snapshot())`, yields every
+row with `horizon <= xact_id < h` in `(xact_id, position)` order, and returns
+`h` only once that whole range is read. Below `h` every transaction has
+committed or aborted, so the range is final.
+
+Why not "the last position I saw"? Because positions are handed out when a
+row is **inserted**, and transactions commit in any order:
+
+1. B starts a transaction; A starts a later one and inserts position 1.
+2. B inserts position 2 and commits.
+3. A reader polls, sees position 2, and checkpoints it.
+4. A commits position 1 — behind the checkpoint, never read.
+
+The horizon reader polls at step 3 too, but stops below A's transaction,
+which is still open; it reads position 1 on the next poll. The cost is that
+one long-running transaction holds the horizon back for as long as it lives,
+so keep transactions short and watch their age. Transaction ids belong to
+the whole PostgreSQL **server**, so that means any transaction on it — in
+another database too, another app's, a console left in `BEGIN`.
+
+A raise returns nothing and the range is read again, so readers deduplicate
+— `position` identifies a row across both tables. A long range can be
+resumed: the block's second argument is a cursor (JSON-friendly) to save once
+a row's effects are durable, and to pass back as `resume:`:
+
+```ruby
+SupportDesk::Events.replay(horizon: c.horizon, resume: c.resume, batch_size: 500) do |row, resume|
+  Bridge.ingest(row)
+  c.update!(resume: resume)
+end
+```
+
+Call it outside a transaction. On SQLite and MySQL it raises
+`ConfigurationError`; the columns are PostgreSQL only.
+
 ## Errors
 
 Every error inherits `SupportDesk::Error`, so `rescue SupportDesk::Error`
@@ -1765,6 +1907,7 @@ historical cases is deliberately exempt from new-case deduplication: if a newer
 already exists, both histories remain open and support is notified of the reply. No
 conversation is silently merged, closed or discarded. MySQL has no partial indexes,
 so these guarantees are model-only there; the suite's matrix is SQLite and PostgreSQL.
+[Durable replay](#replaying-what-was-written-down) needs PostgreSQL 13 or later.
 
 ## Testing
 
@@ -1818,8 +1961,10 @@ desk records.
 
 ```ruby
 SupportDesk.configure { |config| … }   SupportDesk.config   SupportDesk.configured?
-SupportDesk.desk(key = :default)       # the Desk record, found or created, memoised
-SupportDesk.assistant(key = nil)       # the Assistant record, memoised; nil when none is configured
+SupportDesk.desk(key = :default, owner: Current.owner)   # the Desk record, found or created, memoised
+SupportDesk.assistant(key = nil, owner: Current.owner)   # the Assistant record, memoised; nil when none is configured
+SupportDesk::Current.owner = workspace                   # whose desks these are, per request or job
+SupportDesk::Events.replay(horizon:, resume: nil, batch_size: 500) { |row, resume| … }   # PostgreSQL 13+
 SupportDesk.reset_assistants!          SupportDesk.ai_actor?(record)
 SupportDesk.release_silent_assistants!            # the net under a dead harness (schedule it)
 SupportDesk.reclaim_assistant_seats!              # seats an assistant may no longer sit in
@@ -1841,7 +1986,7 @@ SupportDesk::VERSION
 
 After checking out the repo, run `bundle install`, then `bundle exec rake ci`. The dummy app lives in `test/dummy` and mounts all three surfaces the way a real host does: the requester engine at `/messages/support`, `chats` at `/messages`, and the turnkey console at `/admin/support` — plus the same console again inside a host-owned `madmin` namespace, because "the console uses only the public API" is a claim that needs a second implementation to be worth anything.
 
-`chats` is the kernel this gem is a product on and the two are developed in lockstep. support_desk requires `chats >= 0.7.1, < 1.0`. Until that is on rubygems, the bundle takes the reviewed chats package from `vendor/cache` (provenance, checksum and the step that adds it in `vendor/cache/README.md`), so `bundle exec rake ci` needs no network and no sibling checkout.
+`chats` is the kernel this gem is a product on and the two are developed in lockstep. support_desk requires `chats >= 0.7.1, < 1.0`, from rubygems; CI asserts the exact chats it resolved (`CHATS_VERSION_UNDER_TEST` in `.github/workflows/test.yml`), so a new chats release is adopted by a deliberate bump, never silently.
 
 ## Contributing
 

data/app/controllers/support_desk/tickets_controller.rb

@@ -26,7 +26,7 @@ module SupportDesk
     def index
       # `:assignee` because a row says who is on the case when that is a
       # machine, and a name per row is a query per row.
-      tickets = current_requester.support_tickets
+      tickets = current_requester.support_tickets.on_current_desks
                                  .includes(:desk, :subject, :assignee, conversation: { last_message: :sender })
       @open_tickets = tickets.not_closed.recent_activity_first.to_a
       @closed_tickets = tickets.closed.newest_first.limit(CLOSED_TICKETS_SHOWN).to_a
@@ -195,9 +195,11 @@ module SupportDesk
 
     # By id, or by the reference people read down a phone line ("T-AB12CD").
     # Always through the requester's OWN tickets, so somebody else's case is
-    # a 404 rather than a redirect into a conversation they can't read.
+    # a 404 rather than a redirect into a conversation they can't read —
+    # and only on the current owner's desks, so another owner's case is a
+    # 404 too.
     def find_ticket
-      scope = current_requester.support_tickets
+      scope = current_requester.support_tickets.on_current_desks
       reference = SupportDesk::Ticket.normalize_reference(params[:id])
 
       if params[:id].to_s.upcase.start_with?(SupportDesk::Ticket::REFERENCE_PREFIX)
@@ -219,7 +221,7 @@ module SupportDesk
     # (their open cases), never a 500 and never a silent failure.
     def render_limit_wall(error)
       @limit_reason = error.is_a?(SupportDesk::TooManyOpenTickets) ? "too_many_open" : "too_fast"
-      @open_tickets = current_requester.support_tickets.not_closed
+      @open_tickets = current_requester.support_tickets.on_current_desks.not_closed
                                        .includes(:desk, :subject, conversation: { last_message: :sender })
                                        .recent_activity_first.to_a
       @unread_counts = unread_counts_for(@open_tickets)

data/app/helpers/support_desk/engine_helper.rb

@@ -152,7 +152,7 @@ module SupportDesk
     # the desk promises nothing. The same `config.reply_within` the SLA
     # breaches on — one setting, one truth.
     def support_reply_promise(desk_key = :default)
-      SupportDesk.config.desk(desk_key).reply_promise
+      support_desk_config(desk_key).reply_promise
     end
 
     # The status line under a case in the requester's list: who owes the next
@@ -183,9 +183,9 @@ module SupportDesk
       return false unless viewer.respond_to?(:ask_support!)
 
       key = viewer.class.try(:support_desk_key) || :default
-      return false unless SupportDesk.config.desk(key).inbox_entry == :always
+      return false unless support_desk_config(key).inbox_entry == :always
 
-      !viewer.support_tickets.exists?
+      !viewer.support_tickets.on_current_desks.exists?
     end
 
     # The desk RECORD for +desk_key+, resolved WITHOUT ever creating one.
@@ -205,11 +205,21 @@ module SupportDesk
     # never a Class.
     #
     # Memoised per view instance, so the door's avatar and its badge cost ONE
-    # query between them rather than one each.
+    # query between them rather than one each. SupportDesk::Current.owner's
+    # desk, like everything else that names a desk by key.
     def support_desk_record(desk_key = :default)
       key = desk_key.to_s
       @support_desk_records ||= {}
-      @support_desk_records[key] ||= SupportDesk::Desk.find_by(key: key) || SupportDesk::Desk.new(key: key)
+      @support_desk_records[key] ||= begin
+        desks = SupportDesk::Desk.owned_by(SupportDesk::Current.owner)
+        desks.find_by(key: key) || desks.new(key: key)
+      end
+    end
+
+    # The settings that desk works under — its own, when
+    # `config.desk_settings` gives it some — without creating it either.
+    def support_desk_config(desk_key = :default)
+      support_desk_record(desk_key).config
     end
 
     # The desk's face. Once the desk has a row it is just another chats
@@ -221,7 +231,7 @@ module SupportDesk
       desk = support_desk_record(desk_key)
       return chats_messager_avatar(desk, css_class: css_class) if desk.persisted?
 
-      name = SupportDesk.config.desk(desk_key).name
+      name = support_desk_config(desk_key).name
       initials = name.to_s.split.first(2).filter_map { |word| word[0] }.join.upcase
       tag.span(initials.presence || "?", class: "#{css_class} chats-avatar--initials", "aria-hidden": true)
     end
@@ -278,7 +288,7 @@ module SupportDesk
     # Memoised on the view instance, which is the render's own scope — the
     # same place chats caches its slot lookups.
     def open_support_ticket_about(record, requester)
-      @support_open_tickets ||= SupportDesk::Ticket.not_closed
+      @support_open_tickets ||= SupportDesk::Ticket.on_current_desks.not_closed
                                                    .where(requester: requester)
                                                    .where.not(subject_id: nil)
                                                    .index_by { |t| [ t.subject_type, t.subject_id.to_s ] }

data/app/views/chats/slots/_inbox_top.html.erb

@@ -22,7 +22,7 @@
                 official-account badge beside it always shows. %>
             <span class="chats-row__name">
               <span class="chats-row__title">
-                <%= SupportDesk.config.desk(desk_key).name %>
+                <%= support_desk_config(desk_key).name %>
               </span>
               <%= support_desk_badge(desk_key) %>
             </span>

data/app/views/support_desk/launcher/_badge.html.erb

@@ -1,6 +1,14 @@
 <%# The launcher's badge: unread messages across the requester's cases
     (`unread_support_count`), hidden at zero. What their
-    `[requester, :support_desk]` stream replaces (SupportDesk::Launcher, which
+    `SupportDesk::Launcher.stream` replaces (SupportDesk::Launcher, which
     hands it the requester and lets it count as it renders) and GET
-    tickets/badge answers. Locals: count, or requester. %>
-<%= chats_tray_badge local_assigns.fetch(:count) { requester.unread_support_count }, id: SupportDesk::Launcher::BADGE_ID %>
+    tickets/badge answers. Locals: count, or requester and the owner whose
+    cases it counts (a broadcast job has no SupportDesk::Current of its own). %>
+<% count = local_assigns.fetch(:count) do
+     if local_assigns.key?(:owner)
+       SupportDesk::Current.set(owner: local_assigns[:owner]) { requester.unread_support_count }
+     else
+       requester.unread_support_count
+     end
+   end %>
+<%= chats_tray_badge count, id: SupportDesk::Launcher::BADGE_ID %>

data/app/views/support_desk/launcher/_launcher.html.erb

@@ -13,13 +13,13 @@
 
     Locals: requester (nil when signed out), help_url. %>
 <% desk_key = requester ? requester.class.support_desk_key : :default %>
-<% desk = SupportDesk.config.desk(desk_key) %>
+<% desk = support_desk_config(desk_key) %>
 <%= stylesheet_link_tag "support_desk" %>
 <%= chats_tray_item :support,
       label: t("support_desk.launcher.label"),
       title: safe_join([ tag.span(desk.name, class: "support-desk-launcher__name"), support_desk_badge(desk_key) ]),
       icon: render("support_desk/launcher/icon"),
-      badge: (safe_join([ turbo_stream_from(requester, :support_desk),
+      badge: (safe_join([ turbo_stream_from(*SupportDesk::Launcher.stream(requester)),
                           render("support_desk/launcher/badge", count: requester.unread_support_count) ]) if requester),
       badge_url: (support_desk_routes.badge_tickets_path if requester) do %>
   <% if requester %>

data/lib/generators/support_desk/install_generator.rb

@@ -49,6 +49,18 @@ module SupportDesk
                            File.join(db_migrate_path, "create_support_desk_message_registrations.rb")
       end
 
+      # 0.6: owners on desks and assistants, and the replay columns. The same
+      # files on a fresh install and an upgrade.
+      def create_owners_migration
+        migration_template "add_owners_to_support_desk.rb.erb",
+                           File.join(db_migrate_path, "add_owners_to_support_desk.rb")
+      end
+
+      def create_replay_migration
+        migration_template "add_replay_to_support_desk.rb.erb",
+                           File.join(db_migrate_path, "add_replay_to_support_desk.rb")
+      end
+
 
       # The annotated initializer — every setting the gem has, with what it
       # means and what it defaults to.

data/lib/generators/support_desk/templates/add_owners_to_support_desk.rb.erb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# support_desk 0.6.0 — OWNERS.
+#
+# A polymorphic, nullable `owner` on desks and assistants, for an app that
+# runs a support desk per customer (an account, a workspace, a product):
+# every owner gets its own `:default` desk, and SupportDesk::Current.owner
+# says whose is meant. Rows with no owner are the single-desk app every
+# install was before, and nothing about them changes.
+#
+# A key is unique PER OWNER: `(owner_type, owner_id, key)`. The old unique
+# index on `key` alone becomes a partial one over the rows with no owner,
+# where partial indexes exist (PostgreSQL, SQLite). MySQL has none, so there
+# an ownerless key is kept unique by the find-first lookup only.
+#
+# `owner_id` follows your generator's primary key type (uuid or bigint).
+# If your owners are keyed differently, change `owner_id_type` before you
+# migrate. Every statement is guarded.
+#
+# The migration itself is safe under 0.5: until a row has an owner, a key
+# still names one row. TURNING OWNERS ON is not: 0.5 finds desks and
+# assistants with `find_by(key:)`, so the first owned row can be picked by a
+# 0.5 process. Migrate, deploy 0.6 to every process and retire every 0.5
+# one, and only then set SupportDesk::Current.owner.
+class AddOwnersToSupportDesk < ActiveRecord::Migration<%= migration_version %>
+  TABLES = { support_desk_desks: "desks", support_desk_assistants: "assistants" }.freeze
+
+  def up
+    TABLES.each do |table, name|
+      unless column_exists?(table, :owner_id)
+        add_reference table, :owner, polymorphic: true, null: true, type: owner_id_type, index: false
+      end
+
+      owned = "index_support_desk_#{name}_on_owner_and_key"
+      add_index table, %i[owner_type owner_id key], unique: true, name: owned unless index_name_exists?(table, owned)
+
+      global = "index_support_desk_#{name}_on_key"
+      remove_index table, name: global if index_name_exists?(table, global)
+
+      ownerless = "index_support_desk_#{name}_on_key_without_owner"
+      next unless partial_indexes?
+      next if index_name_exists?(table, ownerless)
+
+      add_index table, :key, unique: true, name: ownerless, where: "owner_type IS NULL AND owner_id IS NULL"
+    end
+  end
+
+  # Exactly what `up` took away comes back. It fails — on purpose — once two
+  # owners share a key: the old schema has no way to hold them.
+  def down
+    TABLES.each do |table, name|
+      %W[index_support_desk_#{name}_on_owner_and_key index_support_desk_#{name}_on_key_without_owner].each do |index|
+        remove_index table, name: index if index_name_exists?(table, index)
+      end
+      global = "index_support_desk_#{name}_on_key"
+      add_index table, :key, unique: true, name: global unless index_name_exists?(table, global)
+      remove_reference table, :owner, polymorphic: true if column_exists?(table, :owner_id)
+    end
+  end
+
+  private
+
+  def owner_id_type
+    generators = Rails.configuration.generators
+    generators.options[generators.orm][:primary_key_type] == :uuid ? :uuid : :bigint
+  end
+
+  # Whether this adapter can enforce a rule over SOME rows. Everything but
+  # MySQL can — and Trilogy is MySQL under a different ADAPTER_NAME.
+  def partial_indexes?
+    !connection.adapter_name.match?(/mysql|trilogy/i)
+  end
+end

data/lib/generators/support_desk/templates/add_replay_to_support_desk.rb.erb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# support_desk 0.6.0 — DURABLE REPLAY (PostgreSQL 13+; a no-op elsewhere).
+#
+# Two columns on the two tables that are the desk's durable record,
+# `support_desk_events` and `support_desk_message_registrations`:
+#
+# - `xact_id`: the transaction that wrote the row, `pg_current_xact_id()`.
+#   Stored as bigint — an xid8 IS a 64-bit integer — because Rails cannot
+#   dump an xid8 column: schema.rb would silently lose the whole table.
+# - `position`: from ONE sequence for both tables, so `(xact_id, position)`
+#   orders every row of both, and `position` alone identifies one.
+#
+# SupportDesk::Events.replay reads them. Adding a column with a sequence
+# default rewrites the table under an exclusive lock: on a large events
+# table, run it in a quiet window. Rows that already exist get the
+# migration's own transaction id, so a reader starting from zero reads them
+# all. Every statement is guarded, so it is safe to run twice.
+class AddReplayToSupportDesk < ActiveRecord::Migration<%= migration_version %>
+  SEQUENCE = "support_desk_events_position_seq"
+  XACT_ID = "(pg_current_xact_id()::text::bigint)"
+  TABLES = {
+    support_desk_events: "index_support_desk_events_on_replay",
+    support_desk_message_registrations: "index_sd_registrations_on_replay"
+  }.freeze
+
+  def up
+    return unless postgresql?
+
+    if connection.database_version < 130_000
+      raise ActiveRecord::MigrationError,
+            "support_desk's durable replay needs PostgreSQL 13 or later (pg_current_xact_id)."
+    end
+
+    # The events column OWNS the sequence (bigserial); the registrations
+    # column draws from it — the same order, for both tables.
+    unless column_exists?(:support_desk_events, :position)
+      execute "ALTER TABLE support_desk_events ADD COLUMN position bigserial NOT NULL"
+    end
+    unless column_exists?(:support_desk_message_registrations, :position)
+      execute "ALTER TABLE support_desk_message_registrations " \
+              "ADD COLUMN position bigint NOT NULL DEFAULT nextval('#{SEQUENCE}'::regclass)"
+    end
+
+    TABLES.each do |table, index|
+      unless column_exists?(table, :xact_id)
+        execute "ALTER TABLE #{table} ADD COLUMN xact_id bigint NOT NULL DEFAULT #{XACT_ID}"
+      end
+      add_index table, [ :xact_id, :position ], name: index unless index_exists?(table, [ :xact_id, :position ], name: index)
+    end
+  end
+
+  # Exactly what `up` added. The registrations column goes first: its
+  # default draws from the sequence the events column owns.
+  def down
+    return unless postgresql?
+
+    TABLES.each do |table, index|
+      remove_index table, name: index if index_exists?(table, [ :xact_id, :position ], name: index)
+    end
+    %i[support_desk_message_registrations support_desk_events].each do |table|
+      remove_column table, :xact_id if column_exists?(table, :xact_id)
+      remove_column table, :position if column_exists?(table, :position)
+    end
+  end
+
+  private
+
+  # Matched by prefix, because PostGIS answers "PostGIS".
+  def postgresql?
+    connection.adapter_name.match?(/\Apostg/i)
+  end
+end

data/lib/generators/support_desk/templates/assistant/turn_job.rb.erb

@@ -41,7 +41,12 @@ module Support
       ticket = SupportDesk::Ticket.find(ticket_id)
       return unless ticket.assistant_turn == turn          # the case moved on while we waited
 
-      <%= key %> = SupportDesk.assistant(assistant_key)
+      # The CASE's assistant — its desk's, and its desk's owner's — never one
+      # looked up by key here: a worker has no request, so a key alone would
+      # name the assistant with no owner. And only if she is still the one
+      # this turn was queued for.
+      <%= key %> = ticket.assistant
+      return unless <%= key %> && <%= key %>.key == assistant_key.to_s
       return unless ticket.assistant_policy(<%= key %>).may_observe?
 
       answer = <%= service_class %>.answer(ticket.brief, ticket.transcript)