@pegma/support-desk-application 0.1.0 → 0.2.0

package/dist/index.js

@@ -3,7 +3,26 @@ import { hasPermission } from "@pegma/authorization-core";
 import { defineMail, maxMailAttempts } from "@pegma/mail";
 import { noopLogger } from "@pegma/spine";
 import { defineCollection, MAX_SCAN_PAGE_SIZE, } from "@pegma/storage-core";
-import { applyTicketEvent, createTicket } from "@pegma/support-desk-core";
+import { applyTicketEvent, createTicket, effectiveTicketHandling, } from "@pegma/support-desk-core";
+import { assertAssistantTurnRecord, createAssistantTurnRecord, resolveAssistantTurnOptions, } from "./assistant-turn-records.js";
+import { createAssistantTurnServices, } from "./assistant-turns.js";
+import { createEngineeringEvidenceServices, planEngineeringTicketMutation, } from "./engineering-evidence.js";
+import { assertEngineeringRecord, createEngineeringSource, resolveEngineeringOptions, } from "./engineering-records.js";
+import { createEngineeringPolicyServices } from "./engineering-policy.js";
+import { createEngineeringWorkerServices } from "./engineering-work.js";
+import { createEngineeringReconciliationServices } from "./engineering-reconciliation.js";
+import { assertEngineeringFollowupRecord, resolveEngineeringFollowupOptions, } from "./engineering-followup-records.js";
+import { createEngineeringFollowupSourceServices, planEngineeringFollowupSourceChange, planEngineeringFollowupTicketMutation, } from "./engineering-followup-source.js";
+import { createEngineeringFollowupWorkServices } from "./engineering-followup-work.js";
+import { fields as followupFields, integer as followupInteger, text as followupText, } from "./assistant-turn-records.js";
+import { engineeringFollowupCommandKey, engineeringFollowupHeadKey, safeEngineeringFollowupSnapshot as followupSnapshot, checkEngineeringFollowupRecordCapacity, } from "./engineering-followup-records.js";
+import { engineeringFollowupNow, engineeringFollowupVersionsCurrent, } from "./engineering-followup-source.js";
+import { assertResolutionLearningRecord, resolveResolutionLearningOptions, } from "./resolution-learning-records.js";
+import { createResolutionLearningServices, createResolutionLearningSource, planResolutionLearningTicketMutation, } from "./resolution-learning.js";
+export { resolutionLearningDeliveryBinding, resolutionLearningManifestHash, } from "./resolution-learning-worker.js";
+export { engineeringFollowupModelManifestHash, engineeringFollowupContextHash, engineeringFollowupPublicFactsHash, engineeringFollowupChecksBinding, engineeringFollowupRetestRequestId, engineeringFollowupRetestProductBinding, engineeringFollowupRetestRequestHash, engineeringFollowupRetestSummary, engineeringFollowupModelAttemptCount, } from "./engineering-followup-records.js";
+export { engineeringPolicyRecords, engineeringPolicyAudit, engineeringPolicyAuditActions, createEngineeringPolicyServices, } from "./engineering-policy.js";
+export { engineeringModelManifestHash, engineeringRoutingBinding, engineeringExportChecksBinding, engineeringRoutingBindingHash, engineeringStaffSelectionHash, } from "./engineering-work.js";
 export const supportPermissions = Object.freeze({
     create: "support.ticket.create",
     readOwn: "support.ticket.read.own",
@@ -14,6 +33,32 @@ export const supportPermissions = Object.freeze({
     assign: "support.ticket.assign",
     manage: "support.ticket.manage",
     auditRead: "support.audit.read",
+    assistantStart: "support.ticket.assistant.start",
+    assistantRead: "support.ticket.assistant.read",
+    assistantReply: "support.ticket.assistant.reply",
+    assistantEscalate: "support.ticket.assistant.escalate",
+    requestPerson: "support.ticket.request_person.own",
+    takeOver: "support.ticket.take_over",
+    confirmSuccess: "support.ticket.confirm_success.own",
+    learningRead: "support.learning.read",
+    learningEvidenceSubmit: "support.learning.evidence.submit",
+    learningProcess: "support.learning.process",
+    learningReview: "support.learning.review",
+    learningWithdraw: "support.learning.withdraw",
+    engineeringRead: "support.engineering.read",
+    engineeringEvidenceSubmit: "support.engineering.evidence.submit",
+    engineeringProcess: "support.engineering.process",
+    engineeringReview: "support.engineering.review",
+    engineeringWithdraw: "support.engineering.withdraw",
+    engineeringRestrictedRead: "support.engineering.restricted.read",
+    engineeringSecurityReview: "support.engineering.security.review",
+    engineeringReconcile: "support.engineering.reconcile",
+    engineeringPolicyRead: "support.engineering.policy.read",
+    engineeringPolicyManage: "support.engineering.policy.manage",
+    engineeringFollowupRead: "support.engineering.followup.read",
+    engineeringFollowupProcess: "support.engineering.followup.process",
+    engineeringFollowupReview: "support.engineering.followup.review",
+    engineeringFollowupEvidenceSubmit: "support.engineering.followup.evidence.submit",
 });
 export const defaultSupportDeskLimits = Object.freeze({
     maxSubjectCharacters: 200,
@@ -42,6 +87,17 @@ export class SupportDeskConflictError extends Error {
         this.name = "SupportDeskConflictError";
     }
 }
+/** Content-safe collision hint, available only after staff authorization. */
+export class SupportDeskStaleRevisionError extends SupportDeskConflictError {
+    currentRevision;
+    updatedAt;
+    constructor(currentRevision, updatedAt) {
+        super("The ticket changed since it was loaded");
+        this.currentRevision = currentRevision;
+        this.updatedAt = updatedAt;
+        this.name = "SupportDeskStaleRevisionError";
+    }
+}
 export class SupportDeskLimitError extends Error {
     field;
     maximum;
@@ -79,10 +135,65 @@ export const supportTicketAuditActions = Object.freeze({
     assigned: "support.ticket.assigned",
     unassigned: "support.ticket.unassigned",
     priorityChanged: "support.ticket.priority_changed",
+    tagsChanged: "support.ticket.tags_changed",
     resolved: "support.ticket.resolved",
     closed: "support.ticket.closed",
     reopened: "support.ticket.reopened",
+    assistantReplied: "support.ticket.assistant_replied",
+    humanRequested: "support.ticket.human_requested",
+    humanEscalated: "support.ticket.human_escalated",
+    humanTakenOver: "support.ticket.human_taken_over",
+    customerSuccessConfirmed: "support.ticket.customer_success_confirmed",
+    learningEnrolled: "support.learning.enrolled",
+    learningEvidenceRecorded: "support.learning.evidence_recorded",
+    learningEvidenceInvalidated: "support.learning.evidence_invalidated",
+    learningWithdrawn: "support.learning.withdrawn",
+    learningReviewed: "support.learning.reviewed",
+    engineeringEnrolled: "support.engineering.enrolled",
+    engineeringEvidenceRecorded: "support.engineering.evidence_recorded",
+    engineeringEvidenceInvalidated: "support.engineering.evidence_invalidated",
+    engineeringWithdrawn: "support.engineering.withdrawn",
+    engineeringRepositorySelected: "support.engineering.repository_selected",
+    engineeringProposalPrepared: "support.engineering.proposal_prepared",
+    engineeringReviewed: "support.engineering.reviewed",
+    engineeringDispatchStarted: "support.engineering.dispatch_started",
+    engineeringExportRecorded: "support.engineering.export_recorded",
+    engineeringReconciled: "support.engineering.reconciled",
+    engineeringFollowupObserved: "support.engineering.followup.observed",
+    engineeringFollowupBundlePrepared: "support.engineering.followup.bundle_prepared",
+    engineeringFollowupReassessed: "support.engineering.followup.reassessed",
+    engineeringFollowupRetried: "support.engineering.followup.retried",
+    engineeringFollowupAbandoned: "support.engineering.followup.abandoned",
+    engineeringFollowupRejected: "support.engineering.followup.rejected",
+    engineeringFollowupNoticePosted: "support.engineering.followup.notice_posted",
+    engineeringFollowupRetestRecorded: "support.engineering.followup.retest_recorded",
 });
+function sameInboundReceiptRoute(left, right) {
+    if (left?.kind !== right.kind) {
+        return false;
+    }
+    switch (right.kind) {
+        case "suppressed":
+            return left.kind === "suppressed" && left.reason === right.reason;
+        case "duplicate_message":
+            return (left.kind === "duplicate_message" &&
+                left.ticketId === right.ticketId &&
+                left.messageId === right.messageId);
+        case "reply":
+            return (left.kind === "reply" &&
+                left.ticketId === right.ticketId &&
+                left.matchMethod === right.matchMethod);
+        case "new_conversation":
+            return (left.kind === "new_conversation" &&
+                left.ticketId === right.ticketId &&
+                left.matchMethod === right.matchMethod &&
+                left.association === right.association &&
+                left.principalId === right.principalId &&
+                left.priority === right.priority &&
+                left.category === right.category &&
+                left.relatedTicketId === right.relatedTicketId);
+    }
+}
 export const deliveryCallbackDedupeDays = 30;
 export const maxDeliveryCallbacksPerBucket = 256;
 export const inboundReceiptDedupeDays = 30;
@@ -97,6 +208,36 @@ function jsonCodec(key) {
     return {
         encode(value) {
             const location = key(value);
+            if ([
+                "engineering_followup_head",
+                "engineering_followup_work",
+                "engineering_followup_receipt",
+            ].includes(value.kind ?? "") ||
+                location.id === "engineering-followup-head" ||
+                location.id.startsWith("engineering-followup:") ||
+                location.id.startsWith("engineering-followup-command:"))
+                assertEngineeringFollowupRecord(value, location);
+            if ([
+                "engineering_source",
+                "engineering_work",
+                "engineering_receipt",
+            ].includes(value.kind ?? "") ||
+                location.id === "engineering-source" ||
+                location.id.startsWith("engineering-work:") ||
+                location.id.startsWith("engineering-command:"))
+                assertEngineeringRecord(value, location);
+            if ([
+                "resolution_learning_source",
+                "resolution_learning_work",
+                "resolution_learning_review",
+            ].includes(value.kind ?? "") ||
+                location.id === "learning-source" ||
+                location.id.startsWith("resolution-learning:") ||
+                location.id.startsWith("learning-review:"))
+                assertResolutionLearningRecord(value, location);
+            if (value.kind === "assistant_turn" ||
+                location.id.startsWith("assistant-turn:"))
+                assertAssistantTurnRecord(value, location);
             return {
                 partition: location.partition,
                 id: location.id,
@@ -107,7 +248,70 @@ function jsonCodec(key) {
             if (typeof record.payload !== "string") {
                 throw new TypeError("stored Support Desk record has no JSON payload");
             }
-            return JSON.parse(record.payload);
+            const decoded = JSON.parse(record.payload);
+            if ([
+                "engineering_followup_head",
+                "engineering_followup_work",
+                "engineering_followup_receipt",
+            ].includes(decoded?.kind ?? "") ||
+                record.id === "engineering-followup-head" ||
+                (typeof record.id === "string" &&
+                    (record.id.startsWith("engineering-followup:") ||
+                        record.id.startsWith("engineering-followup-command:")))) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Follow-up record has invalid physical envelope");
+                assertEngineeringFollowupRecord(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
+            if ([
+                "engineering_source",
+                "engineering_work",
+                "engineering_receipt",
+            ].includes(decoded?.kind ?? "") ||
+                record.id === "engineering-source" ||
+                (typeof record.id === "string" &&
+                    (record.id.startsWith("engineering-work:") ||
+                        record.id.startsWith("engineering-command:")))) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Engineering record has invalid physical envelope");
+                assertEngineeringRecord(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
+            if ([
+                "resolution_learning_source",
+                "resolution_learning_work",
+                "resolution_learning_review",
+            ].includes(decoded?.kind ?? "") ||
+                record.id === "learning-source" ||
+                (typeof record.id === "string" &&
+                    (record.id.startsWith("resolution-learning:") ||
+                        record.id.startsWith("learning-review:")))) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Learning record has invalid physical envelope");
+                assertResolutionLearningRecord(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
+            if (decoded?.kind === "assistant_turn" ||
+                (typeof record.id === "string" &&
+                    record.id.startsWith("assistant-turn:"))) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("stored assistant turn has no string partition/id envelope");
+                assertAssistantTurnRecord(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
+            return decoded;
         },
     };
 }
@@ -280,6 +484,7 @@ export const defaultQueueScanBudgets = Object.freeze({
     maxActiveResults: 1_000,
     scanPageSize: 100,
 });
+const replyRoutingTokenPattern = /^[A-Za-z0-9_-]{22,128}$/;
 export const ticketNumberPartition = "instance";
 export const ticketNumberRecordId = "ticket-number";
 const maxNotificationVariables = 32;
@@ -341,9 +546,12 @@ function ticketReservationKey(ticketId) {
 function commandKey(ticketId, commandId) {
     return { partition: ticketId, id: `command:${commandId}` };
 }
-function ownDataProperty(source, key, field, optional = false) {
+function ownDataProperty(source, key, field, optional = false, rejectInherited = false) {
     const descriptor = Object.getOwnPropertyDescriptor(source, key);
     if (descriptor === undefined) {
+        if (rejectInherited && Reflect.has(source, key)) {
+            throw new TypeError(`${field} must be an own data property`);
+        }
         if (optional) {
             return undefined;
         }
@@ -414,6 +622,12 @@ function snapshotNotification(input) {
     const subject = readString("subject");
     const outboundMessageId = readString("outboundMessageId");
     const maxAttempts = ownDataProperty(input, "maxAttempts", "notification.maxAttempts", true);
+    const replyRoutingToken = ownDataProperty(input, "replyRoutingToken", "notification.replyRoutingToken", true);
+    if (replyRoutingToken !== undefined &&
+        (typeof replyRoutingToken !== "string" ||
+            !replyRoutingTokenPattern.test(replyRoutingToken))) {
+        throw new TypeError("notification.replyRoutingToken must be 22 to 128 URL-safe base64 characters");
+    }
     requireIdentifier(id, "notification.id");
     requireIdentifier(recipientRef, "notification.recipientRef");
     requireIdentifier(templateId, "notification.templateId");
@@ -444,6 +658,9 @@ function snapshotNotification(input) {
         ...(maxAttempts === undefined
             ? {}
             : { maxAttempts: maxAttempts }),
+        ...(replyRoutingToken === undefined
+            ? {}
+            : { replyRoutingToken: replyRoutingToken }),
     });
 }
 function boundaryObject(input, field) {
@@ -462,16 +679,16 @@ function boundaryString(value, field) {
 const requesterEmailMaximumCharacters = 254;
 const requesterEmailLocalPart = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/;
 const requesterEmailDomain = /^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
-function normalizeRequesterEmail(value) {
+function normalizeRequesterEmail(value, field = "requesterEmail") {
     if (value === undefined) {
         return undefined;
     }
     if (typeof value !== "string") {
-        throw new TypeError("requesterEmail must be a string");
+        throw new TypeError(`${field} must be a string`);
     }
     if (value.length > requesterEmailMaximumCharacters ||
         /[\u0000-\u001F\u007F<>&"\\]/.test(value)) {
-        throw new TypeError(`requesterEmail must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
+        throw new TypeError(`${field} must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
     }
     const normalized = value.trim();
     const separator = normalized.indexOf("@");
@@ -488,7 +705,7 @@ function normalizeRequesterEmail(value) {
         !requesterEmailLocalPart.test(local) ||
         domain.length > 253 ||
         !requesterEmailDomain.test(domain)) {
-        throw new TypeError(`requesterEmail must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
+        throw new TypeError(`${field} must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
     }
     return `${local}@${domain.toLowerCase()}`;
 }
@@ -504,6 +721,111 @@ function snapshotCategory(value, field) {
     }
     return value;
 }
+function normalizedTag(value) {
+    if (typeof value !== "string" ||
+        value.length > 64 ||
+        /[\u0000-\u001F\u007F]/.test(value)) {
+        throw new TypeError("tag must be a bounded safe identifier");
+    }
+    const tag = value.trim().toLowerCase();
+    if (!categoryPattern.test(tag))
+        throw new TypeError("tag must match the category identifier discipline");
+    return tag;
+}
+function snapshotTags(input) {
+    if (!Array.isArray(input) || input.length > 32) {
+        throw new TypeError("tags must be an array of at most 32 values");
+    }
+    const tags = new Set();
+    for (let index = 0; index < input.length; index += 1) {
+        tags.add(normalizedTag(ownDataProperty(input, index, `tags[${index}]`)));
+    }
+    return Object.freeze([...tags].sort());
+}
+function snapshotRevisionHint(source) {
+    const value = ownDataProperty(source, "expectedRevision", "expectedRevision", true);
+    if (value === undefined)
+        return {};
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) {
+        throw new TypeError("expectedRevision must be a positive safe integer");
+    }
+    return { expectedRevision: value };
+}
+function requireExpectedRevision(ticket, command) {
+    if (command.expectedRevision !== undefined &&
+        ticket.revision !== command.expectedRevision) {
+        throw new SupportDeskStaleRevisionError(ticket.revision, ticket.updatedAt);
+    }
+}
+function parseResponseTargetPolicy(input) {
+    if (input === undefined)
+        return undefined;
+    const source = boundaryObject(input, "responseTargetPolicy");
+    const method = ownDataProperty(source, "computeTargets", "responseTargetPolicy.computeTargets");
+    if (typeof method !== "function")
+        throw new TypeError("responseTargetPolicy must provide computeTargets()");
+    return Object.freeze({
+        computeTargets: (context) => method.call(source, context),
+    });
+}
+function staffLifecycleFields(ticket) {
+    return {
+        ...(ticket.tags === undefined
+            ? {}
+            : { tags: Object.freeze([...ticket.tags]) }),
+        ...(ticket.firstResponseDueAt === undefined
+            ? {}
+            : { firstResponseDueAt: ticket.firstResponseDueAt }),
+        ...(ticket.resolutionDueAt === undefined
+            ? {}
+            : { resolutionDueAt: ticket.resolutionDueAt }),
+        ...(ticket.firstStaffRespondedAt === undefined
+            ? {}
+            : { firstStaffRespondedAt: ticket.firstStaffRespondedAt }),
+        ...(ticket.resolvedAt === undefined
+            ? {}
+            : { resolvedAt: ticket.resolvedAt }),
+    };
+}
+async function applyResponseTargets(ticket, policy, reason) {
+    if (policy === undefined)
+        return ticket;
+    const context = Object.freeze({
+        reason,
+        ticketId: ticket.id,
+        revision: ticket.revision,
+        priority: ticket.priority,
+        channel: ticket.channel,
+        createdAt: ticket.createdAt,
+        occurredAt: ticket.updatedAt,
+        ...(ticket.category === undefined ? {} : { category: ticket.category }),
+        ...(ticket.firstResponseDueAt === undefined
+            ? {}
+            : { firstResponseDueAt: ticket.firstResponseDueAt }),
+        ...(ticket.resolutionDueAt === undefined
+            ? {}
+            : { resolutionDueAt: ticket.resolutionDueAt }),
+        ...(ticket.firstStaffRespondedAt === undefined
+            ? {}
+            : { firstStaffRespondedAt: ticket.firstStaffRespondedAt }),
+        ...(ticket.resolvedAt === undefined
+            ? {}
+            : { resolvedAt: ticket.resolvedAt }),
+    });
+    const result = boundaryObject(await policy.computeTargets(context), "response targets");
+    const targets = {};
+    for (const field of ["firstResponseDueAt", "resolutionDueAt"]) {
+        const value = ownDataProperty(result, field, `response targets.${field}`, true);
+        if (value !== undefined) {
+            if (typeof value !== "string")
+                throw new TypeError("response target must be an ISO timestamp");
+            canonicalTimestamp(value, `response targets.${field}`);
+            targets[field] = value;
+        }
+    }
+    const { firstResponseDueAt: _first, resolutionDueAt: _resolution, ...rest } = ticket;
+    return Object.freeze({ ...rest, ...targets });
+}
 function snapshotCreateCustomerTicketCommand(input) {
     const source = boundaryObject(input, "create command");
     const raw = {
@@ -518,6 +840,9 @@ function snapshotCreateCustomerTicketCommand(input) {
         notification: ownDataProperty(source, "notification", "create command.notification", true),
     };
     const category = snapshotCategory(raw.category, "create command.category");
+    const initialHandling = ownDataProperty(source, "initialHandling", "create command.initialHandling", true);
+    if (initialHandling !== undefined && initialHandling !== "assistant")
+        throw new TypeError("initialHandling must be assistant when supplied");
     const requesterEmail = normalizeRequesterEmail(raw.requesterEmail);
     const notification = raw.notification === undefined
         ? undefined
@@ -532,6 +857,7 @@ function snapshotCreateCustomerTicketCommand(input) {
         ...(category === undefined ? {} : { category }),
         ...(requesterEmail === undefined ? {} : { requesterEmail }),
         ...(notification === undefined ? {} : { notification }),
+        ...(initialHandling === undefined ? {} : { initialHandling }),
     });
 }
 function snapshotReplyToCustomerTicketCommand(input) {
@@ -577,6 +903,9 @@ function deliveryContent(input) {
             variables: input.variables,
             subject: input.subject,
             outboundMessageId: input.outboundMessageId,
+            ...(input.replyRoutingToken === undefined
+                ? {}
+                : { replyRoutingToken: input.replyRoutingToken }),
         };
 }
 function bindNotificationTicketNumber(input, ticketNumber) {
@@ -640,6 +969,9 @@ function toCustomerTicketSummary(ticket) {
         channel: ticket.channel,
         createdAt: ticket.createdAt,
         customerUpdatedAt,
+        ...(ticket.handling === undefined
+            ? {}
+            : { handling: ticket.handling.state }),
     });
 }
 async function authoritativeView(records, principalId, ticketId, maxRecordsPerTicket) {
@@ -661,19 +993,19 @@ async function authoritativeView(records, principalId, ticketId, maxRecordsPerTi
  * Validate and copy host-supplied category allowlist into a private Set.
  * The host array is not retained; the Set is application-owned state.
  */
-function parseAllowedCategories(input) {
+function parseAllowedCategories(input, name = "application options.allowedCategories") {
     if (input === undefined) {
         return undefined;
     }
     if (!Array.isArray(input)) {
-        throw new TypeError("application options.allowedCategories must be an array");
+        throw new TypeError(`${name} must be an array`);
     }
     if (input.length > maxAllowedCategories) {
-        throw new TypeError(`application options.allowedCategories may contain at most ${maxAllowedCategories} values`);
+        throw new TypeError(`${name} may contain at most ${maxAllowedCategories} values`);
     }
     const values = new Set();
     for (let index = 0; index < input.length; index += 1) {
-        const field = `application options.allowedCategories[${index}]`;
+        const field = `${name}[${index}]`;
         const value = ownDataProperty(input, index, field);
         if (typeof value !== "string") {
             throw new TypeError(`${field} must be a string`);
@@ -682,7 +1014,7 @@ function parseAllowedCategories(input) {
             throw new TypeError(`${field} must match ${categoryPattern.source} and contain no controls`);
         }
         if (values.has(value)) {
-            throw new TypeError("application options.allowedCategories must not contain duplicates");
+            throw new TypeError(`${name} must not contain duplicates`);
         }
         values.add(value);
     }
@@ -694,6 +1026,18 @@ function duplicateMatches(existing, commandType, messageId, requestFingerprint)
         existing.messageId === messageId &&
         existing.requestFingerprint === requestFingerprint);
 }
+function inboundReplyRerouteFenceMatches(existing, commandId, messageId, requestFingerprint) {
+    return (existing?.kind === "inbound_reply_reroute_fence" &&
+        existing.commandId === commandId &&
+        existing.messageId === messageId &&
+        existing.requestFingerprint === requestFingerprint);
+}
+function inboundCreateRerouteFenceMatches(existing, commandId, messageId, requestFingerprint) {
+    return (existing?.kind === "inbound_create_reroute_fence" &&
+        existing.commandId === commandId &&
+        existing.messageId === messageId &&
+        existing.requestFingerprint === requestFingerprint);
+}
 const TICKET_PRIORITIES = [
     "low",
     "normal",
@@ -721,6 +1065,175 @@ function enforcePartitionRecordLimit(recordCount, maximum, additional = 0) {
         throw new SupportDeskLimitError("ticket_partition", maximum);
     }
 }
+export const assistantHumanReserveRows = 12;
+export const assistantHumanReserveMessages = 1;
+const firstHumanReplyReserveRows = 4;
+async function planTicketDerivationMutation(records, before, after, rows, visibleChange = false, notice) {
+    const learning = await planResolutionLearningTicketMutation(records, before, after, notice !== undefined && visibleChange);
+    const engineering = notice === undefined
+        ? await planEngineeringTicketMutation(records, before, after, {
+            visibleChange,
+        })
+        : { actions: [], additionalRows: 0 };
+    const reopened = ["resolved", "closed"].includes(before.value.ticket.status) &&
+        !["resolved", "closed"].includes(after.status);
+    const followup = visibleChange || reopened
+        ? await planEngineeringFollowupTicketMutation(records, rows, after.id, notice !== undefined
+            ? "approved_followup_notice"
+            : reopened
+                ? "reopened"
+                : "visible_source_changed", notice?.completedFollowupWorkId)
+        : { actions: [], nextWorkRows: [] };
+    return {
+        ...learning,
+        actions: [...learning.actions, ...engineering.actions, ...followup.actions],
+        additionalRows: learning.additionalRows + engineering.additionalRows,
+        nextWorkRows: followup.nextWorkRows,
+    };
+}
+/** Project reserved work transitions without inventing another quota counter. */
+function projectFollowupRows(rows, nextWorkRows) {
+    if (nextWorkRows.length > 8)
+        throw new SupportDeskConflictError("Follow-up transition bound exceeded");
+    const updates = new Map(nextWorkRows.map((row) => [row.id, row]));
+    if (updates.size !== nextWorkRows.length)
+        throw new SupportDeskConflictError("Duplicate follow-up transition");
+    const projected = rows.map((row) => {
+        if (row.kind !== "engineering_followup_work")
+            return row;
+        const next = updates.get(row.id);
+        updates.delete(row.id);
+        return next ?? row;
+    });
+    return [...projected, ...updates.values()];
+}
+function followupMessageSlots(rows) {
+    return rows.reduce((sum, row) => sum + (row.kind === "engineering_followup_work" ? row.messageSlots : 0), 0);
+}
+function humanReserveRows(rows) {
+    return (assistantHumanReserveRows +
+        (rows.some((row) => row.kind === "resolution_learning_source") ? 1 : 0));
+}
+function derivationReserveRows(rows, consuming = false) {
+    const learning = consuming !== "learning" &&
+        rows.some((row) => row.kind === "resolution_learning_source" && row.state !== "withdrawn")
+        ? 2
+        : 0;
+    const engineering = consuming !== "engineering" &&
+        rows.some((row) => row.kind === "engineering_source" && row.state !== "withdrawn")
+        ? 2
+        : 0;
+    const terminalWorkId = typeof consuming === "object" ? consuming.engineeringTerminalWorkId : null;
+    const terminal = rows.reduce((sum, row) => sum +
+        (row.kind === "engineering_work" && row.id !== terminalWorkId
+            ? row.terminalReserveRows
+            : 0), 0);
+    const followup = rows.reduce((sum, row) => sum + (row.kind === "engineering_followup_work" ? row.completionRows : 0), 0);
+    return learning + engineering + terminal + followup;
+}
+/** Reserve is opt-in metadata on the existing quota, never a second counter. */
+function enforceManagedAdmission(ticket, rows, limits, additionalRows, addsMessage = false, firstHumanReply = false, consumesWithdrawalReserve = false) {
+    const quota = rows.find((row) => row.kind === "ticket_quota");
+    const reserved = quota?.assistantManaged === true &&
+        ticket.firstStaffRespondedAt === undefined &&
+        !firstHumanReply;
+    enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket -
+        (reserved ? humanReserveRows(rows) : 0) -
+        derivationReserveRows(rows, consumesWithdrawalReserve), additionalRows);
+    if (addsMessage &&
+        quota !== undefined &&
+        quota.messageCount >=
+            limits.maxMessagesPerTicket -
+                (reserved ? assistantHumanReserveMessages : 0) -
+                followupMessageSlots(rows))
+        throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+}
+function latestVisibleRecord(rows) {
+    // Reuse the ordinal validation that protects ordinary customer views.
+    customerMessages(rows);
+    return rows
+        .filter((row) => row.kind === "message" && row.message.visibility === "customer")
+        .sort((a, b) => b.ordinal - a.ordinal)[0];
+}
+function enforceHandlingControlAdmission(ticket, rows, limits, additionalRows, consumesWithdrawalReserve = false) {
+    const quota = rows.find((row) => row.kind === "ticket_quota");
+    const reserved = quota?.assistantManaged === true &&
+        ticket.firstStaffRespondedAt === undefined;
+    enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket -
+        (reserved ? firstHumanReplyReserveRows : 0) -
+        derivationReserveRows(rows, consumesWithdrawalReserve), additionalRows);
+    if (reserved && quota.messageCount >= limits.maxMessagesPerTicket)
+        throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+}
+function handlingInput(input, fields, optional = []) {
+    const source = boundaryObject(input, "handling command");
+    if (Object.getOwnPropertySymbols(source).length !== 0)
+        throw new TypeError("Handling commands must contain data fields");
+    const allowed = [
+        "commandId",
+        "correlationId",
+        "ticketId",
+        ...fields,
+        ...optional,
+    ];
+    if (Object.getOwnPropertyNames(source).some((key) => !allowed.includes(key)))
+        throw new TypeError("Handling command contains unsupported fields");
+    const result = {};
+    for (const field of allowed) {
+        const value = ownDataProperty(source, field, "handling command." + field, optional.includes(field));
+        if (value !== undefined)
+            result[field] = value;
+    }
+    for (const field of ["commandId", "correlationId", "ticketId"]) {
+        const value = boundaryString(result[field], field);
+        requireIdentifier(value, field);
+        result[field] = value;
+    }
+    return result;
+}
+function handlingFence(input) {
+    for (const field of ["expectedRevision", "expectedHandlingGeneration"]) {
+        if (typeof input[field] !== "number" ||
+            !Number.isSafeInteger(input[field]) ||
+            input[field] < (field === "expectedRevision" ? 1 : 0))
+            throw new TypeError("Handling fence must be a safe integer");
+    }
+    return input;
+}
+function requireAssistantTurn(ticket, rows, command) {
+    const handling = effectiveTicketHandling(ticket);
+    const latest = latestVisibleRecord(rows);
+    if (ticket.channel !== "web" ||
+        isTerminalTicketStatus(ticket.status) ||
+        handling.state !== "assistant" ||
+        ticket.revision !== command.expectedRevision ||
+        handling.generation !== command.expectedHandlingGeneration ||
+        latest?.message.authorKind !== "customer" ||
+        latest.message.id !== command.triggerMessageId)
+        throw new SupportDeskConflictError("Assistant turn changed or is no longer available");
+}
+function handoffWork(input) {
+    const work = {
+        kind: "handoff_work",
+        partition: input.ticket.id,
+        id: "handoff:" + input.commandId,
+        status: "pending",
+        reason: input.reason,
+        ...(input.summary === undefined ? {} : { summary: input.summary }),
+        attemptedGuideIds: input.attemptedGuideIds ?? [],
+        transcript: {
+            ticketId: input.ticket.id,
+            throughRevision: input.ticket.revision,
+            lastVisibleMessageId: input.lastVisibleMessageId,
+        },
+        handlingGeneration: effectiveTicketHandling(input.ticket).generation,
+        createdAt: input.occurredAt,
+    };
+    // Support's existing codec stores one JSON string property, unlike KB chunks.
+    if (JSON.stringify(work).length * 2 > 60_000)
+        throw new SupportDeskLimitError("serialized_record", 60_000);
+    return work;
+}
 async function staffAuthoritativeView(records, ticketId, maxRecordsPerTicket) {
     const all = await records.list(ticketId);
     enforcePartitionRecordLimit(all.length, maxRecordsPerTicket);
@@ -757,6 +1270,7 @@ function snapshotStaffReplyCommand(input) {
         ? undefined
         : snapshotNotification(raw.notification);
     return Object.freeze({
+        ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "staff reply command.commandId"),
         correlationId: boundaryString(raw.correlationId, "staff reply command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "staff reply command.ticketId"),
@@ -775,6 +1289,7 @@ function snapshotAddNoteCommand(input) {
         body: ownDataProperty(source, "body", "add note command.body"),
     };
     return Object.freeze({
+        ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "add note command.commandId"),
         correlationId: boundaryString(raw.correlationId, "add note command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "add note command.ticketId"),
@@ -813,6 +1328,7 @@ function snapshotAssignTicketCommand(input) {
         }
     }
     return Object.freeze({
+        ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "assign command.commandId"),
         correlationId: boundaryString(raw.correlationId, "assign command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "assign command.ticketId"),
@@ -837,6 +1353,7 @@ function snapshotChangePriorityCommand(input) {
         throw new TypeError(`change priority command.priority must be one of: ${TICKET_PRIORITIES.join(", ")}`);
     }
     return Object.freeze({
+        ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "change priority command.commandId"),
         correlationId: boundaryString(raw.correlationId, "change priority command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "change priority command.ticketId"),
@@ -870,6 +1387,7 @@ function snapshotLifecycleTicketCommand(input, field) {
         }
     }
     return Object.freeze({
+        ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, `${field}.commandId`),
         correlationId: boundaryString(raw.correlationId, `${field}.correlationId`),
         ticketId: boundaryString(raw.ticketId, `${field}.ticketId`),
@@ -910,6 +1428,7 @@ function ticketBeyondTerminalCutoff(ticket, now, terminalRetentionMilliseconds)
 function deriveQueueIndexRecord(ticket) {
     return {
         ticketId: ticket.id,
+        ...staffLifecycleFields(ticket),
         id: "queue",
         projectedRevision: ticket.revision,
         state: isTerminalTicketStatus(ticket.status) ? "inactive" : "active",
@@ -922,6 +1441,9 @@ function deriveQueueIndexRecord(ticket) {
             ? {}
             : { assignedTo: ticket.assignedTo }),
         updatedAt: ticket.updatedAt,
+        ...(ticket.handling === undefined
+            ? {}
+            : { handling: { ...ticket.handling } }),
     };
 }
 function queueIndexContentEqual(left, right) {
@@ -932,10 +1454,16 @@ function queueIndexContentEqual(left, right) {
         left.status === right.status &&
         left.priority === right.priority &&
         left.category === right.category &&
+        JSON.stringify(left.tags ?? []) === JSON.stringify(right.tags ?? []) &&
+        left.firstResponseDueAt === right.firstResponseDueAt &&
+        left.resolutionDueAt === right.resolutionDueAt &&
+        left.firstStaffRespondedAt === right.firstStaffRespondedAt &&
+        left.resolvedAt === right.resolvedAt &&
         left.requesterAssociation === right.requesterAssociation &&
         left.channel === right.channel &&
         left.assignedTo === right.assignedTo &&
-        left.updatedAt === right.updatedAt);
+        left.updatedAt === right.updatedAt &&
+        JSON.stringify(left.handling) === JSON.stringify(right.handling));
 }
 function queueProjectionKey(ticketId) {
     return { partition: ticketId, id: "queue" };
@@ -1021,13 +1549,25 @@ export async function projectTicketToQueue(ticketId, options) {
         if (queueIndexContentEqual(current, derived)) {
             return { action: "keep" };
         }
+        // Exact pre-SD-01 rows may already contain Task-13 fields but no handling.
+        const { handling: _newHandling, ...beforeHandling } = derived;
+        if (current.handling === undefined &&
+            queueIndexContentEqual(current, beforeHandling))
+            return { action: "write", value: derived };
+        // Pre-Task-13 rows have none of these additive staff fields. Enrich
+        // only that exact legacy shape from freshly loaded authoritative state.
+        const { tags: _tags, firstResponseDueAt: _first, resolutionDueAt: _due, firstStaffRespondedAt: _responded, resolvedAt: _resolved, handling: _handling, ...legacy } = derived;
+        if (queueIndexContentEqual(current, legacy))
+            return { action: "write", value: derived };
         throw new SupportDeskConflictError("Queue projection revision collision with divergent content");
     }, { maxAttempts: maxConflictAttempts });
     return result.written ? "written" : "kept";
 }
 function toStaffQueueItem(ticket) {
     return Object.freeze({
+        handling: effectiveTicketHandling(ticket).state,
         ticketId: ticket.id,
+        ...staffLifecycleFields(ticket),
         revision: ticket.revision,
         status: ticket.status,
         priority: ticket.priority,
@@ -1046,7 +1586,23 @@ function normalizeFilterList(value) {
     }
     return new Set(Array.isArray(value) ? value : [value]);
 }
-function staffQueueItemMatches(item, query) {
+function staffQueueItemMatches(item, query, now) {
+    const handling = query.handling ?? "human";
+    if (handling !== "all" &&
+        (handling === "assistant") !== (item.handling === "assistant"))
+        return false;
+    if (query.tag !== undefined && !(item.tags ?? []).includes(query.tag))
+        return false;
+    if (query.targetState !== undefined) {
+        const due = pendingTargetDue(item, query.target);
+        if (due === undefined || now === undefined)
+            return false;
+        const epoch = canonicalTimestamp(due, "ticket target");
+        if (query.targetState === "overdue"
+            ? epoch >= now
+            : epoch < now || epoch - now > query.dueSoonMilliseconds)
+            return false;
+    }
     const statuses = normalizeFilterList(query.status);
     if (statuses !== undefined && !statuses.has(item.status)) {
         return false;
@@ -1073,6 +1629,15 @@ function staffQueueItemMatches(item, query) {
     }
     return true;
 }
+function pendingTargetDue(item, target) {
+    return target === "first_response"
+        ? item.firstStaffRespondedAt === undefined
+            ? item.firstResponseDueAt
+            : undefined
+        : item.resolvedAt === undefined
+            ? item.resolutionDueAt
+            : undefined;
+}
 const QUEUE_FILTER_STATUSES = [
     "open",
     "waiting_on_support",
@@ -1121,6 +1686,12 @@ function snapshotStaffQueueQuery(input) {
     }
     const source = boundaryObject(input, "staff queue query");
     const readOptional = (key) => ownDataProperty(source, key, `staff queue query.${key}`, true);
+    const handling = readOptional("handling");
+    if (handling !== undefined &&
+        handling !== "human" &&
+        handling !== "assistant" &&
+        handling !== "all")
+        throw new TypeError("invalid queue handling view");
     const status = readOptional("status");
     const priority = readOptional("priority");
     const association = readOptional("association");
@@ -1128,6 +1699,29 @@ function snapshotStaffQueueQuery(input) {
     const assignedTo = readOptional("assignedTo");
     const unassignedOnly = readOptional("unassignedOnly");
     const sort = readOptional("sort");
+    const rawTag = readOptional("tag");
+    const tag = rawTag === undefined ? undefined : normalizedTag(rawTag);
+    const target = readOptional("target");
+    const targetState = readOptional("targetState");
+    const dueSoonMilliseconds = readOptional("dueSoonMilliseconds");
+    if (target !== undefined &&
+        target !== "first_response" &&
+        target !== "resolution")
+        throw new TypeError("invalid queue target");
+    if (targetState !== undefined &&
+        targetState !== "overdue" &&
+        targetState !== "due_soon")
+        throw new TypeError("invalid queue targetState");
+    if (dueSoonMilliseconds !== undefined &&
+        (typeof dueSoonMilliseconds !== "number" ||
+            !Number.isSafeInteger(dueSoonMilliseconds) ||
+            dueSoonMilliseconds < 0 ||
+            dueSoonMilliseconds > 30 * 86_400_000))
+        throw new TypeError("dueSoonMilliseconds must be between 0 and 30 days");
+    if (targetState === "due_soon" && dueSoonMilliseconds === undefined)
+        throw new TypeError("due_soon requires dueSoonMilliseconds");
+    if (targetState !== "due_soon" && dueSoonMilliseconds !== undefined)
+        throw new TypeError("dueSoonMilliseconds requires targetState due_soon");
     if (assignedTo !== undefined) {
         if (typeof assignedTo !== "string") {
             throw new TypeError("staff queue query.assignedTo must be a string");
@@ -1139,10 +1733,20 @@ function snapshotStaffQueueQuery(input) {
     }
     if (sort !== undefined &&
         sort !== "updated_newest" &&
-        sort !== "updated_oldest") {
-        throw new TypeError('staff queue query.sort must be "updated_newest" or "updated_oldest"');
+        sort !== "updated_oldest" &&
+        sort !== "due_soonest" &&
+        sort !== "due_latest") {
+        throw new TypeError("invalid staff queue query.sort");
     }
-    const query = {};
+    const query = {
+        ...(handling === undefined ? {} : { handling }),
+        ...(tag === undefined ? {} : { tag }),
+        ...(target === undefined ? {} : { target }),
+        ...(targetState === undefined ? {} : { targetState }),
+        ...(dueSoonMilliseconds === undefined
+            ? {}
+            : { dueSoonMilliseconds: dueSoonMilliseconds }),
+    };
     if (status !== undefined) {
         query.status =
             snapshotEnumOrEnumArray(status, "staff queue query.status", QUEUE_FILTER_STATUSES);
@@ -1293,36 +1897,100 @@ export async function sweepInactiveQueueProjections(options) {
         deleted,
     };
 }
-export function createSupportDeskApplication(options) {
-    const source = boundaryObject(options, "application options");
-    const store = ownDataProperty(source, "store", "application options.store");
-    const clock = ownDataProperty(source, "clock", "application options.clock");
-    const rawLogger = ownDataProperty(source, "logger", "application options.logger", true);
-    const logger = rawLogger === undefined ? noopLogger : rawLogger;
-    const rawLimits = ownDataProperty(source, "limits", "application options.limits", true);
-    const rawMaxConflictAttempts = ownDataProperty(source, "maxConflictAttempts", "application options.maxConflictAttempts", true);
-    const rawTerminalRetention = ownDataProperty(source, "queueTerminalRetentionMilliseconds", "application options.queueTerminalRetentionMilliseconds", true);
-    const rawQueueBudgets = ownDataProperty(source, "queueScanBudgets", "application options.queueScanBudgets", true);
-    const allowedCategories = parseAllowedCategories(ownDataProperty(source, "allowedCategories", "application options.allowedCategories", true));
+const supportDeskLimitMaximums = Object.freeze({
+    maxSubjectCharacters: 1_000,
+    maxMessageCharacters: 20_000,
+    maxTicketsPerPrincipal: 1_000,
+    maxMessagesPerTicket: 100,
+    maxRecordsPerTicket: 2_000,
+});
+/** Merge validated host overrides onto the defaults and enforce maxima. */
+function resolveSupportDeskLimits(rawLimits, field) {
     const limitOverrides = {};
     if (rawLimits !== undefined) {
-        const limitSource = boundaryObject(rawLimits, "application options.limits");
-        for (const field of [
+        const limitSource = boundaryObject(rawLimits, field);
+        for (const name of [
             "maxSubjectCharacters",
             "maxMessageCharacters",
             "maxTicketsPerPrincipal",
             "maxMessagesPerTicket",
             "maxRecordsPerTicket",
         ]) {
-            const value = ownDataProperty(limitSource, field, `application options.limits.${field}`, true);
+            const value = ownDataProperty(limitSource, name, `${field}.${name}`, true);
             if (value !== undefined) {
                 if (typeof value !== "number") {
-                    throw new TypeError(`application options.limits.${field} must be a number`);
+                    throw new TypeError(`${field}.${name} must be a number`);
                 }
-                limitOverrides[field] = value;
+                limitOverrides[name] = value;
             }
         }
     }
+    const limits = { ...defaultSupportDeskLimits, ...limitOverrides };
+    for (const name of Object.keys(limits)) {
+        const value = limits[name];
+        if (!Number.isSafeInteger(value) ||
+            value <= 0 ||
+            value > supportDeskLimitMaximums[name]) {
+            throw new TypeError(`${name} must be a positive safe integer no greater than ${supportDeskLimitMaximums[name]}`);
+        }
+    }
+    return Object.freeze(limits);
+}
+/**
+ * Reserve the next instance-scoped ticket number outside any ticket
+ * transaction. A later failure leaves a gap; a duplicate is impossible.
+ */
+async function reserveNextTicketNumber(numbers, maxConflictAttempts) {
+    const result = await numbers.update({ partition: ticketNumberPartition, id: ticketNumberRecordId }, (current) => {
+        const lastIssued = current?.lastIssued ?? 0;
+        if (!Number.isSafeInteger(lastIssued) || lastIssued < 0) {
+            throw new SupportDeskConflictError("Ticket number counter is corrupt");
+        }
+        if (lastIssued >= Number.MAX_SAFE_INTEGER) {
+            throw new SupportDeskConflictError("Ticket number sequence is exhausted");
+        }
+        return {
+            action: "write",
+            value: { lastIssued: lastIssued + 1 },
+        };
+    }, { maxAttempts: maxConflictAttempts });
+    const issued = result.value?.lastIssued;
+    if (issued === undefined || !Number.isSafeInteger(issued) || issued <= 0) {
+        throw new SupportDeskConflictError("Ticket number was not reserved");
+    }
+    return issued;
+}
+export function createSupportDeskApplication(options) {
+    const source = boundaryObject(options, "application options");
+    const engineeringFollowupOptions = resolveEngineeringFollowupOptions(ownDataProperty(source, "engineeringFollowup", "application options.engineeringFollowup", true));
+    const engineeringOptions = resolveEngineeringOptions(ownDataProperty(source, "engineering", "application options.engineering", true));
+    const resolutionLearningOptions = resolveResolutionLearningOptions(ownDataProperty(source, "resolutionLearning", "application options.resolutionLearning", true));
+    const assistantTurnOptions = resolveAssistantTurnOptions(ownDataProperty(source, "assistantTurns", "application options.assistantTurns", true));
+    const rawAssistantEnabled = ownDataProperty(source, "assistantHandlingEnabled", "application options.assistantHandlingEnabled", true);
+    if (rawAssistantEnabled !== undefined &&
+        typeof rawAssistantEnabled !== "boolean")
+        throw new TypeError("assistantHandlingEnabled must be boolean");
+    const assistantHandlingEnabled = rawAssistantEnabled === true;
+    const store = ownDataProperty(source, "store", "application options.store");
+    const clock = ownDataProperty(source, "clock", "application options.clock");
+    const rawLogger = ownDataProperty(source, "logger", "application options.logger", true);
+    const logger = rawLogger === undefined ? noopLogger : rawLogger;
+    const rawLimits = ownDataProperty(source, "limits", "application options.limits", true);
+    const rawMaxConflictAttempts = ownDataProperty(source, "maxConflictAttempts", "application options.maxConflictAttempts", true);
+    const rawTerminalRetention = ownDataProperty(source, "queueTerminalRetentionMilliseconds", "application options.queueTerminalRetentionMilliseconds", true);
+    const rawQueueBudgets = ownDataProperty(source, "queueScanBudgets", "application options.queueScanBudgets", true);
+    const allowedCategories = parseAllowedCategories(ownDataProperty(source, "allowedCategories", "application options.allowedCategories", true));
+    const rawTags = ownDataProperty(source, "allowedTags", "allowedTags", true);
+    const allowedTags = new Set(rawTags === undefined ? [] : snapshotTags(rawTags));
+    const rawMaxTags = ownDataProperty(source, "maxTagsPerTicket", "maxTagsPerTicket", true);
+    const maxTagsPerTicket = rawMaxTags === undefined ? 8 : rawMaxTags;
+    if (typeof maxTagsPerTicket !== "number" ||
+        !Number.isSafeInteger(maxTagsPerTicket) ||
+        maxTagsPerTicket < 1 ||
+        maxTagsPerTicket > 32) {
+        throw new TypeError("maxTagsPerTicket must be between 1 and 32");
+    }
+    const responseTargetPolicy = parseResponseTargetPolicy(ownDataProperty(source, "responseTargetPolicy", "responseTargetPolicy", true));
     if (rawMaxConflictAttempts !== undefined &&
         typeof rawMaxConflictAttempts !== "number") {
         throw new TypeError("application options.maxConflictAttempts must be a number");
@@ -1331,13 +1999,36 @@ export function createSupportDeskApplication(options) {
     const index = store.collection(customerTicketIndex);
     const numbers = store.collection(ticketNumbers);
     const projections = store.collection(queueIndex);
-    const limits = { ...defaultSupportDeskLimits, ...limitOverrides };
+    const limits = resolveSupportDeskLimits(rawLimits, "application options.limits");
     const maxConflictAttempts = rawMaxConflictAttempts ?? 4;
     if (!Number.isSafeInteger(maxConflictAttempts) ||
         maxConflictAttempts <= 0 ||
         maxConflictAttempts > 20) {
         throw new TypeError("maxConflictAttempts must be between 1 and 20");
     }
+    const rawEngineeringPolicy = ownDataProperty(source, "engineeringPolicy", "application options.engineeringPolicy", true);
+    const engineeringPolicyOverrides = {};
+    if (rawEngineeringPolicy !== undefined) {
+        const policyOptions = boundaryObject(rawEngineeringPolicy, "engineeringPolicy options");
+        for (const field of [
+            "maxRepositories",
+            "maxRecords",
+            "historyRetentionMilliseconds",
+        ]) {
+            const value = ownDataProperty(policyOptions, field, `engineeringPolicy.${field}`, true);
+            if (value === undefined)
+                continue;
+            if (typeof value !== "number")
+                throw new TypeError(`engineeringPolicy.${field} must be a number`);
+            engineeringPolicyOverrides[field] = value;
+        }
+    }
+    const engineeringPolicy = createEngineeringPolicyServices({
+        store,
+        clock,
+        maxConflictAttempts,
+        ...engineeringPolicyOverrides,
+    });
     const terminalRetentionMilliseconds = rawTerminalRetention === undefined
         ? defaultQueueTerminalRetentionMilliseconds
         : rawTerminalRetention;
@@ -1382,21 +2073,6 @@ export function createSupportDeskApplication(options) {
             throw new TypeError(`queueScanBudgets.${field} must be a positive safe integer`);
         }
     }
-    const limitMaximums = {
-        maxSubjectCharacters: 1_000,
-        maxMessageCharacters: 20_000,
-        maxTicketsPerPrincipal: 1_000,
-        maxMessagesPerTicket: 100,
-        maxRecordsPerTicket: 2_000,
-    };
-    for (const field of Object.keys(limits)) {
-        const value = limits[field];
-        if (!Number.isSafeInteger(value) ||
-            value <= 0 ||
-            value > limitMaximums[field]) {
-            throw new TypeError(`${field} must be a positive safe integer no greater than ${limitMaximums[field]}`);
-        }
-    }
     let projectionHealth = Object.freeze({
         consecutiveFailures: 0,
     });
@@ -1448,13 +2124,65 @@ export function createSupportDeskApplication(options) {
             }
         }
     }
-    async function customerViewAfterChange(principalId, ticketId) {
+    /**
+     * Best-effort post-commit threading index writes. Never fails a committed
+     * command; `repairThreadIndexPage` converges anything missed. Does not
+     * sample the host clock.
+     */
+    async function safeIndexThreading(ticketId, threading) {
+        if (threading === undefined ||
+            (threading.messageId === undefined && threading.ticketNumber !== true)) {
+            return;
+        }
+        await indexThreadingAfterCommit(store, ticketId, threading, logger);
+    }
+    async function customerViewAfterChange(principalId, ticketId, threading) {
         await safeProjectQueue(ticketId);
+        await safeIndexThreading(ticketId, threading);
         return authoritativeView(records, principalId, ticketId, limits.maxRecordsPerTicket);
     }
-    async function staffViewAfterChange(ticketId) {
+    async function staffCommandResult(ticketId, commandId, threading) {
         await safeProjectQueue(ticketId);
-        return staffAuthoritativeView(records, ticketId, limits.maxRecordsPerTicket);
+        await safeIndexThreading(ticketId, threading);
+        const receipt = await records.get(commandKey(ticketId, commandId));
+        if (receipt?.kind !== "command" || receipt.resultTicket === undefined) {
+            // Pre-Task-13 receipts retain their existing replay behavior.
+            return staffAuthoritativeView(records, ticketId, limits.maxRecordsPerTicket);
+        }
+        const rows = await records.list(ticketId);
+        enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+        return {
+            ticket: receipt.resultTicket,
+            messages: staffMessages(rows.filter((row) => row.kind !== "message" ||
+                row.ordinal <= receipt.resultTicket.revision)),
+        };
+    }
+    async function checkStaffRevision(ticket, command, fingerprint) {
+        if (command.expectedRevision === undefined ||
+            command.expectedRevision === ticket.revision)
+            return false;
+        // A commit may race the first receipt read. Replay wins over a stale hint.
+        const receipt = await records.get(commandKey(command.ticketId, command.commandId));
+        if (receipt?.kind === "command" &&
+            receipt.requestFingerprint === fingerprint)
+            return true;
+        if (receipt !== null)
+            throw new SupportDeskConflictError("Command ID reused with different input");
+        requireExpectedRevision(ticket, command);
+        return false;
+    }
+    async function staffConflictResult(command, fingerprint) {
+        const receipt = await records.get(commandKey(command.ticketId, command.commandId));
+        if (receipt?.kind === "command" &&
+            receipt.requestFingerprint === fingerprint)
+            return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
+        if (receipt !== null)
+            throw new SupportDeskConflictError("Command ID reused with different input");
+        const current = await records.get(ticketKey(command.ticketId));
+        if (current?.kind === "ticket" &&
+            (await checkStaffRevision(current.ticket, command, fingerprint)))
+            return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
+        throw new SupportDeskConflictError();
     }
     async function reserveCustomerTicket(principalId, ticketId, reservedAt) {
         requireIdentifier(principalId, "principalId");
@@ -1555,114 +2283,870 @@ export function createSupportDeskApplication(options) {
         }
     }
     async function reserveTicketNumber() {
-        const result = await numbers.update({ partition: ticketNumberPartition, id: ticketNumberRecordId }, (current) => {
-            const lastIssued = current?.lastIssued ?? 0;
-            if (!Number.isSafeInteger(lastIssued) || lastIssued < 0) {
-                throw new SupportDeskConflictError("Ticket number counter is corrupt");
+        return reserveNextTicketNumber(numbers, maxConflictAttempts);
+    }
+    const resolutionLearning = createResolutionLearningServices({
+        records,
+        clock,
+        limits,
+        options: resolutionLearningOptions,
+        maxConflictAttempts,
+        admission: (ticket, rows, additional) => enforceManagedAdmission(ticket, rows, limits, additional),
+        withdrawalAdmission: (ticket, rows, additional) => enforceHandlingControlAdmission(ticket, rows, limits, additional, "learning"),
+        audit: (command, ticket, actorId, now, action) => ticketAuditAction({
+            commandId: command.commandId,
+            correlationId: command.correlationId,
+            ticketId: ticket.id,
+            revision: ticket.revision,
+            actorId,
+            occurredAt: now,
+            action: action,
+        }),
+    });
+    const engineeringDependencies = {
+        records,
+        clock,
+        limits,
+        options: engineeringOptions,
+        maxConflictAttempts,
+        policy: engineeringPolicy,
+        planFollowupSourceChange: (context) => planEngineeringFollowupSourceChange(records, context),
+        admission: (ticket, rows, additional) => enforceManagedAdmission(ticket, rows, limits, additional),
+        withdrawalAdmission: (ticket, rows, additional) => enforceHandlingControlAdmission(ticket, rows, limits, additional, "engineering"),
+        completionAdmission: (ticket, rows, additional, workId) => {
+            const consumption = { engineeringTerminalWorkId: workId };
+            const current = rows.find((row) => row.kind === "ticket" && row.ticket.id === ticket.id);
+            if (current !== undefined)
+                enforceHandlingControlAdmission(current.ticket, rows, limits, additional, consumption);
+            else
+                enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket - derivationReserveRows(rows, consumption), additional);
+        },
+        audit: (command, ticket, actorId, now, action) => ticketAuditAction({
+            commandId: command.commandId,
+            correlationId: command.correlationId,
+            ticketId: ticket.id,
+            revision: ticket.revision,
+            actorId,
+            occurredAt: now,
+            action: action,
+        }),
+    };
+    const engineeringEvidence = createEngineeringEvidenceServices(engineeringDependencies);
+    const engineeringWorkers = createEngineeringWorkerServices(engineeringDependencies, engineeringEvidence.load);
+    const engineeringReconciliation = createEngineeringReconciliationServices(engineeringDependencies);
+    const followupDependencies = {
+        records,
+        clock,
+        limits,
+        options: engineeringFollowupOptions,
+        maxConflictAttempts,
+        audit: (command, ticket, actorId, now, action) => ticketAuditAction({
+            commandId: command.commandId,
+            correlationId: command.correlationId,
+            ticketId: ticket.id,
+            revision: ticket.revision,
+            actorId,
+            occurredAt: now,
+            action: action,
+        }),
+        admission: (ticket, rows, nextWorkRows, addedPhysicalRows, addsMessage = false) => {
+            const projected = projectFollowupRows(rows, nextWorkRows);
+            const newlyProjected = projected.length - rows.length;
+            if (addedPhysicalRows < newlyProjected)
+                throw new SupportDeskConflictError("Follow-up admission uses a stale partition view");
+            const quota = projected.find((row) => row.kind === "ticket_quota");
+            if (followupMessageSlots(projected) > 0) {
+                if (quota === undefined)
+                    throw new SupportDeskConflictError("Follow-up quota metadata is missing");
+                const humanSlot = quota.assistantManaged === true &&
+                    ticket.firstStaffRespondedAt === undefined
+                    ? assistantHumanReserveMessages
+                    : 0;
+                if (quota.messageCount + followupMessageSlots(projected) + humanSlot >
+                    limits.maxMessagesPerTicket)
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
             }
-            if (lastIssued >= Number.MAX_SAFE_INTEGER) {
-                throw new SupportDeskConflictError("Ticket number sequence is exhausted");
+            enforceManagedAdmission(ticket, projected, limits, addedPhysicalRows - newlyProjected, addsMessage);
+        },
+    };
+    const engineeringFollowupSource = createEngineeringFollowupSourceServices(followupDependencies);
+    const engineeringFollowupWork = createEngineeringFollowupWorkServices(followupDependencies, engineeringFollowupSource.internal.load);
+    const approveAndPostEngineeringFollowupWebUpdate = async (access, input, guard) => {
+        const actorId = access.principalId;
+        const authorize = () => {
+            requireIdentifier(access.principalId, "principalId");
+            if (access.principalId !== actorId)
+                throw new SupportDeskAuthorizationError(supportPermissions.engineeringFollowupReview);
+            requirePermission(access, supportPermissions.engineeringFollowupReview);
+            requirePermission(access, supportPermissions.queueRead);
+            requirePermission(access, supportPermissions.replyAny);
+        };
+        authorize();
+        const command = followupSnapshot(followupFields(input, "follow-up web update", [
+            "ticketId",
+            "workId",
+            "commandId",
+            "correlationId",
+            "expectedWorkGeneration",
+            "expectedTicketRevision",
+            "bundleHash",
+            "messageId",
+        ]));
+        for (const name of [
+            "ticketId",
+            "workId",
+            "commandId",
+            "correlationId",
+            "bundleHash",
+            "messageId",
+        ])
+            followupText(command[name], name);
+        followupInteger(command.expectedWorkGeneration, "expectedWorkGeneration", 1);
+        followupInteger(command.expectedTicketRevision, "expectedTicketRevision", 1);
+        if (!/^[0-9a-f]{64}$/.test(command.bundleHash))
+            throw new TypeError("Invalid follow-up bundle hash");
+        if (typeof guard !== "function")
+            throw new TypeError("Follow-up posting requires a current-proof guard");
+        const hash = await requestFingerprint({
+            operation: "engineering_followup_web_update",
+            actorId,
+            command,
+        });
+        const receiptKey = engineeringFollowupCommandKey(command.ticketId, command.commandId);
+        const now = engineeringFollowupNow(followupDependencies);
+        for (let attempt = 0; attempt < maxConflictAttempts; attempt += 1) {
+            const prior = await records.get(receiptKey);
+            authorize();
+            if (prior !== null) {
+                if (prior.kind !== "engineering_followup_receipt" ||
+                    prior.fingerprint !== hash ||
+                    !("messageId" in prior.result) ||
+                    prior.result.messageId === undefined ||
+                    !("bundleHash" in prior.result) ||
+                    prior.result.bundleHash !== command.bundleHash ||
+                    !("ticketRevision" in prior.result) ||
+                    prior.result.ticketRevision === undefined ||
+                    !("workId" in prior.result) ||
+                    prior.result.workId !== command.workId)
+                    throw new SupportDeskConflictError("Follow-up posting command changed");
+                return followupSnapshot({
+                    ticketId: command.ticketId,
+                    workId: command.workId,
+                    messageId: prior.result.messageId,
+                    ticketRevision: prior.result.ticketRevision,
+                    bundleHash: prior.result.bundleHash,
+                });
             }
-            return {
-                action: "write",
-                value: { lastIssued: lastIssued + 1 },
+            if (!engineeringFollowupOptions.enabled)
+                throw new SupportDeskConflictError("Follow-up is disabled");
+            const current = await engineeringFollowupWork.internal.current({ ticketId: command.ticketId, workId: command.workId }, now);
+            authorize();
+            const work = current.work.value;
+            const prepared = work.preparedBundle;
+            const ticket = current.loaded.ticket.value.ticket;
+            if (prepared === undefined ||
+                current.loaded.head === null ||
+                work.workGeneration !== command.expectedWorkGeneration ||
+                ticket.revision !== command.expectedTicketRevision ||
+                prepared.bundleHash !== command.bundleHash ||
+                work.completionRows !== 3 ||
+                work.messageSlots !== 1 ||
+                now() >= Date.parse(work.deadline))
+                throw new SupportDeskConflictError("Follow-up exact prepared work or ticket changed");
+            const checked = await engineeringFollowupWork.internal.verifyBundle(current, now);
+            const body = prepared.bundle.customerDraft.body;
+            requireNonempty(body, "body");
+            enforceLimit(body, "body", limits.maxMessageCharacters);
+            const bodyHash = await requestFingerprint({ body });
+            await guard();
+            authorize();
+            const occurredAt = clampTicketTime(clock.now(), ticket.updatedAt);
+            const updated = applyTicketEvent(ticket, {
+                type: "customer_notice_added",
+                actorId,
+                occurredAt,
+            });
+            const derivations = await planTicketDerivationMutation(records, current.loaded.ticket, updated, current.loaded.rows, true, { completedFollowupWorkId: work.workId });
+            const { claim: _claim, leaseUntil: _lease, retryAt: _retry, candidate: _candidate, candidateHash: _candidateHash, preparedBundle: _prepared, ...remaining } = work;
+            const next = {
+                ...remaining,
+                stage: "delivered",
+                status: "delivered",
+                workGeneration: work.workGeneration + 1,
+                completionRows: 0,
+                messageSlots: 0,
+                modelAttempts: [],
+                usageTombstones: [
+                    ...new Map([
+                        ...(work.usageTombstones ?? []).map((entry) => [entry.stepId, entry]),
+                        ...work.modelAttempts.map((entry) => [
+                            entry.stepId,
+                            {
+                                stepId: entry.stepId,
+                                requestHash: entry.requestHash,
+                                usageReservationId: entry.binding.usageReservationId,
+                                accounting: entry.accounting,
+                            },
+                        ]),
+                    ]).values(),
+                ],
+                delivered: {
+                    messageId: command.messageId,
+                    ticketRevision: updated.revision,
+                    bodyHash,
+                    bundleHash: prepared.bundleHash,
+                    commandId: command.commandId,
+                    postedBy: actorId,
+                    postedAt: occurredAt,
+                },
+                handoff: {
+                    kbProposal: prepared.bundle.kbProposal,
+                    retestRequests: prepared.bundle.retestRequests,
+                },
             };
-        }, { maxAttempts: maxConflictAttempts });
-        const issued = result.value?.lastIssued;
-        if (issued === undefined || !Number.isSafeInteger(issued) || issued <= 0) {
-            throw new SupportDeskConflictError("Ticket number was not reserved");
-        }
-        return issued;
-    }
-    return {
-        async createCustomerTicket(access, input) {
-            requirePermission(access, supportPermissions.create);
-            requireIdentifier(access.principalId, "principalId");
-            const command = snapshotCreateCustomerTicketCommand(input);
-            requireIdentifier(command.ticketId, "ticketId");
-            requireIdentifier(command.messageId, "messageId");
-            requireIdentifier(command.commandId, "commandId");
-            requireIdentifier(command.correlationId, "correlationId");
-            enforceLimit(command.subject, "subject", limits.maxSubjectCharacters);
-            enforceLimit(command.body, "body", limits.maxMessageCharacters);
-            const fingerprintPayload = {
-                type: "create_customer_ticket",
+            checkEngineeringFollowupRecordCapacity(next);
+            const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
+            authorize();
+            if (quota?.value.kind !== "ticket_quota")
+                throw new SupportDeskConflictError("Follow-up quota metadata is missing");
+            const admissionRows = current.loaded.rows.map((row) => row.kind === "ticket_quota" ? quota.value : row);
+            followupDependencies.admission(updated, admissionRows, [...derivations.nextWorkRows, next], 3 + derivations.additionalRows, true);
+            const result = {
                 ticketId: command.ticketId,
+                workId: command.workId,
                 messageId: command.messageId,
-                subject: command.subject,
-                body: command.body,
-                // Omit absent category so pre-category receipts still match retries.
-                ...(command.category === undefined
-                    ? {}
-                    : { category: command.category }),
-                requesterEmail: command.requesterEmail ?? null,
-                notification: stableNotification(command.notification),
+                ticketRevision: updated.revision,
+                bundleHash: prepared.bundleHash,
             };
-            const fingerprint = await requestFingerprint(fingerprintPayload);
-            // Replay an already committed create before host allowlist checks so a
-            // later config change cannot break idempotent retries of the same command.
-            // Replay never reserves another instance ticket number.
-            const existingCreate = await records.get(commandKey(command.ticketId, command.commandId));
-            let createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, fingerprint);
-            if (!createIsReplay &&
-                existingCreate?.kind === "command" &&
-                existingCreate.commandType === "create_customer_ticket" &&
-                existingCreate.messageId === command.messageId) {
-                // Pre-Task-3 receipts included ticketNumber in the fingerprint.
-                const existingTicket = await records.get(ticketKey(command.ticketId));
-                if (existingTicket?.kind === "ticket") {
-                    // Pre-Task-3 hashed ticketNumber immediately after ticketId.
-                    const legacyFingerprint = await requestFingerprint({
-                        type: fingerprintPayload.type,
-                        ticketId: fingerprintPayload.ticketId,
-                        ticketNumber: existingTicket.ticket.number,
-                        messageId: fingerprintPayload.messageId,
-                        subject: fingerprintPayload.subject,
-                        body: fingerprintPayload.body,
-                        ...(command.category === undefined
-                            ? {}
-                            : { category: command.category }),
-                        requesterEmail: fingerprintPayload.requesterEmail,
-                        notification: fingerprintPayload.notification,
-                    });
-                    createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, legacyFingerprint);
-                }
-            }
-            if (createIsReplay) {
-                // A crash after ticket commit and before index confirmation must still
-                // converge the principal hint on retry.
-                const fence = await records.get(ticketReservationKey(command.ticketId));
-                if (fence?.kind === "ticket_reservation" &&
-                    fence.state === "committed") {
-                    await confirmCustomerTicket(access.principalId, command.ticketId, fence.token, fence.generation);
-                }
-                return customerViewAfterChange(access.principalId, command.ticketId);
-            }
-            if (command.category !== undefined) {
-                if (allowedCategories === undefined ||
-                    !allowedCategories.has(command.category)) {
-                    throw new TypeError("create command.category is not configured for this Support Desk instance");
-                }
-            }
-            // Fail closed before durable number/index reservation so a too-small
-            // partition budget cannot exhaust the principal ticket index with
-            // reserved-but-never-created tickets.
-            const estimatedCreateRows = 6 + // ticket, quota, reservation, message, audit, command
-                (command.notification === undefined ? 0 : 1);
-            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, estimatedCreateRows);
-            // Reserve outside the ticket transaction; gaps are accepted if create fails.
-            const ticketNumber = await reserveTicketNumber();
-            // Bind host-supplied notification content to the reserved number so mail
-            // cannot advertise a guessed ticket number.
+            const receipt = {
+                kind: "engineering_followup_receipt",
+                partition: command.ticketId,
+                id: receiptKey.id,
+                fingerprint: hash,
+                result,
+            };
+            checkEngineeringFollowupRecordCapacity(receipt);
+            if (!(await engineeringFollowupVersionsCurrent(followupDependencies, current.loaded, current.work, current.engineeringWork)))
+                continue;
+            authorize();
+            if (now() >=
+                Math.min(Date.parse(work.deadline), checked.deadline, Date.parse(current.proof.attestation.validUntil)))
+                throw new SupportDeskConflictError("Follow-up posting proof expired");
+            const outcome = await records.transact(command.ticketId, [
+                ...derivations.actions,
+                {
+                    action: "putIfUnchanged",
+                    version: current.loaded.source.version,
+                    value: current.loaded.source.value,
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: current.engineeringWork.version,
+                    value: current.engineeringWork.value,
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: current.loaded.head.version,
+                    value: current.loaded.head.value,
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: current.work.version,
+                    value: next,
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: quota.version,
+                    value: {
+                        ...quota.value,
+                        messageCount: quota.value.messageCount + 1,
+                    },
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "message",
+                        partition: command.ticketId,
+                        id: `message:${command.messageId}`,
+                        ordinal: updated.revision,
+                        message: {
+                            id: command.messageId,
+                            ticketId: command.ticketId,
+                            authorKind: "staff",
+                            authorPrincipalId: actorId,
+                            channel: "web",
+                            visibility: "customer",
+                            format: "plain_text",
+                            body,
+                            createdAt: occurredAt,
+                        },
+                    },
+                },
+                ticketAuditAction({
+                    commandId: command.commandId,
+                    correlationId: command.correlationId,
+                    ticketId: command.ticketId,
+                    revision: updated.revision,
+                    actorId,
+                    occurredAt,
+                    action: supportTicketAuditActions.engineeringFollowupNoticePosted,
+                }),
+                { action: "insert", value: receipt },
+            ]);
+            if (outcome.committed) {
+                authorize();
+                return result;
+            }
+        }
+        throw new SupportDeskConflictError();
+    };
+    function owns(ticket, principalId) {
+        return (ticket.requester.association === "authenticated" &&
+            ticket.requester.principalId === principalId);
+    }
+    function handlingAck(ticket, messageId) {
+        return {
+            ticketId: ticket.id,
+            revision: ticket.revision,
+            handlingGeneration: effectiveTicketHandling(ticket).generation,
+            ...(messageId === undefined ? {} : { messageId }),
+        };
+    }
+    /** Only the new handling commands share this small executor; legacy fingerprints stay untouched. */
+    async function mutateHandling(access, command, operation, assistantTurnCommit) {
+        requireIdentifier(access.principalId, "principalId");
+        const customer = operation === "request_person" ||
+            operation === "confirm_customer_success";
+        const fingerprint = await requestFingerprint({
+            type: operation,
+            actorId: access.principalId,
+            ...Object.fromEntries(Object.entries(command).filter(([key]) => key !== "commandId" && key !== "correlationId")),
+            ...(assistantTurnCommit === undefined
+                ? {}
+                : { assistantTurnFingerprint: assistantTurnCommit.fingerprint }),
+        });
+        for (let attempt = 0; attempt < maxConflictAttempts; attempt += 1) {
+            const versioned = await records.getVersioned(ticketKey(command.ticketId));
+            if (versioned?.value.kind !== "ticket" ||
+                (customer && !owns(versioned.value.ticket, access.principalId)))
+                throw new SupportDeskNotFoundError();
+            const ticket = versioned.value.ticket;
+            const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+            if (duplicateMatches(duplicate, operation, command.messageId, fingerprint)) {
+                if (duplicate?.kind !== "command" ||
+                    duplicate.resultTicket === undefined)
+                    throw new SupportDeskConflictError("Handling receipt is incomplete");
+                return duplicate.resultTicket;
+            }
+            if (duplicate !== null)
+                throw new SupportDeskConflictError("Command ID reused with different input");
+            if (operation === "assistant_reply" && !assistantHandlingEnabled)
+                throw new SupportDeskConflictError("Assistant handling is disabled");
+            const rows = await records.list(command.ticketId);
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+            const latest = latestVisibleRecord(rows);
+            if (operation === "assistant_reply" || operation === "assistant_escalate")
+                requireAssistantTurn(ticket, rows, command);
+            if (operation === "request_person" &&
+                !isTerminalTicketStatus(ticket.status) &&
+                effectiveTicketHandling(ticket).state !== "assistant")
+                return ticket;
+            if (operation === "confirm_customer_success") {
+                if (latest?.message.id !== command.lastSeenVisibleMessageId)
+                    throw new SupportDeskConflictError("Visible conversation changed");
+                if (ticket.status === "resolved" &&
+                    rows.some((row) => row.kind === "customer_success" &&
+                        row.lastSeenVisibleMessageId ===
+                            command.lastSeenVisibleMessageId &&
+                        (rows.find((record) => record.kind === "resolution_learning_source") === undefined ||
+                            row.resolutionCycle ===
+                                rows.find((record) => record.kind === "resolution_learning_source")?.resolutionCycle)))
+                    return ticket;
+            }
+            const now = clampTicketTime(clock.now(), ticket.updatedAt);
+            const common = { actorId: access.principalId, occurredAt: now };
+            const fence = {
+                expectedRevision: command.expectedRevision,
+                expectedHandlingGeneration: command.expectedHandlingGeneration,
+            };
+            const updated = operation === "assistant_reply"
+                ? applyTicketEvent(ticket, {
+                    type: "assistant_replied",
+                    ...common,
+                    ...fence,
+                })
+                : operation === "assistant_escalate"
+                    ? applyTicketEvent(ticket, {
+                        type: "human_escalated",
+                        ...common,
+                        ...fence,
+                    })
+                    : operation === "take_over"
+                        ? applyTicketEvent(ticket, {
+                            type: "human_taken_over",
+                            ...common,
+                            ...fence,
+                        })
+                        : operation === "request_person"
+                            ? applyTicketEvent(ticket, {
+                                type: "human_requested",
+                                ...common,
+                            })
+                            : applyTicketEvent(ticket, {
+                                type: "customer_success_confirmed",
+                                ...common,
+                            });
+            if (updated.revision === ticket.revision)
+                return ticket;
+            const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, rows, operation === "assistant_reply");
+            const learningConfirmation = operation === "confirm_customer_success"
+                ? await resolutionLearning.customerConfirmation(learningMutation.source, updated, access.principalId, command.lastSeenVisibleMessageId, command.commandId, rows)
+                : { actions: [], additionalRows: 0 };
+            const newRows = (operation === "take_over" ? 2 : 3) +
+                learningMutation.additionalRows +
+                learningConfirmation.additionalRows;
+            if (operation === "assistant_reply")
+                enforceManagedAdmission(ticket, projectFollowupRows(rows, learningMutation.nextWorkRows), limits, newRows, true);
+            else
+                enforceHandlingControlAdmission(ticket, projectFollowupRows(rows, learningMutation.nextWorkRows), limits, newRows);
+            const actions = [
+                ...learningMutation.actions,
+                ...learningConfirmation.actions,
+            ];
+            if (operation === "assistant_reply") {
+                const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                if (quota?.value.kind !== "ticket_quota")
+                    throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                if (quota.value.messageCount >= limits.maxMessagesPerTicket)
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                const assistantMessage = {
+                    kind: "message",
+                    partition: ticket.id,
+                    id: "message:" + command.messageId,
+                    ordinal: updated.revision,
+                    message: {
+                        id: command.messageId,
+                        ticketId: ticket.id,
+                        authorKind: "assistant",
+                        authorPrincipalId: access.principalId,
+                        channel: "web",
+                        visibility: "customer",
+                        format: "plain_text",
+                        body: command.body,
+                        createdAt: now,
+                    },
+                };
+                if (JSON.stringify(assistantMessage).length * 2 > 60_000)
+                    throw new SupportDeskLimitError("serialized_record", 60_000);
+                actions.push({
+                    action: "putIfUnchanged",
+                    version: quota.version,
+                    value: {
+                        ...quota.value,
+                        messageCount: quota.value.messageCount + 1,
+                    },
+                }, { action: "insert", value: assistantMessage });
+            }
+            else if (operation === "request_person" ||
+                operation === "assistant_escalate") {
+                if (latest === undefined)
+                    throw new SupportDeskConflictError("Ticket conversation is unavailable");
+                actions.push({
+                    action: "insert",
+                    value: handoffWork({
+                        ticket: updated,
+                        commandId: command.commandId,
+                        occurredAt: now,
+                        lastVisibleMessageId: latest.message.id,
+                        reason: operation === "request_person"
+                            ? "customer_requested"
+                            : (command.reason ?? "other"),
+                        ...(command.summary === undefined
+                            ? {}
+                            : { summary: command.summary }),
+                        ...(command.attemptedGuideIds === undefined
+                            ? {}
+                            : { attemptedGuideIds: command.attemptedGuideIds }),
+                    }),
+                });
+            }
+            else if (operation === "confirm_customer_success") {
+                actions.push({
+                    action: "insert",
+                    value: {
+                        kind: "customer_success",
+                        partition: ticket.id,
+                        id: "success:" + command.commandId,
+                        commandId: command.commandId,
+                        ticketId: ticket.id,
+                        confirmedBy: access.principalId,
+                        confirmedAt: now,
+                        lastSeenVisibleMessageId: command.lastSeenVisibleMessageId,
+                        revision: updated.revision,
+                        handlingGeneration: effectiveTicketHandling(updated).generation,
+                        ...(learningMutation.source === null
+                            ? {}
+                            : {
+                                resolutionCycle: learningMutation.source.value.resolutionCycle,
+                            }),
+                    },
+                });
+            }
+            const auditAction = operation === "assistant_reply"
+                ? supportTicketAuditActions.assistantReplied
+                : operation === "assistant_escalate"
+                    ? supportTicketAuditActions.humanEscalated
+                    : operation === "request_person"
+                        ? supportTicketAuditActions.humanRequested
+                        : operation === "take_over"
+                            ? supportTicketAuditActions.humanTakenOver
+                            : supportTicketAuditActions.customerSuccessConfirmed;
+            actions.push(ticketAuditAction({
+                commandId: command.commandId,
+                correlationId: command.correlationId,
+                ticketId: ticket.id,
+                revision: updated.revision,
+                actorId: access.principalId,
+                occurredAt: now,
+                action: auditAction,
+            }), {
+                action: "insert",
+                value: {
+                    kind: "command",
+                    partition: ticket.id,
+                    id: "command:" + command.commandId,
+                    commandId: command.commandId,
+                    commandType: operation,
+                    ...(command.messageId === undefined
+                        ? {}
+                        : { messageId: command.messageId }),
+                    requestFingerprint: fingerprint,
+                    completedAt: now,
+                    resultTicket: updated,
+                },
+            });
+            const assistantCommit = assistantTurnCommit === undefined
+                ? undefined
+                : await assistantTurns.completionAction(ticket, rows, updated, assistantTurnCommit);
+            if (assistantCommit !== undefined) {
+                actions.push(assistantCommit.action);
+                await assistantCommit.verifyBeforeCommit();
+            }
+            if ((await records.transact(ticket.id, actions)).committed) {
+                await safeProjectQueue(ticket.id);
+                return updated;
+            }
+        }
+        const current = await records.get(ticketKey(command.ticketId));
+        if (current?.kind !== "ticket" ||
+            (customer && !owns(current.ticket, access.principalId)))
+            throw new SupportDeskNotFoundError();
+        const receipt = await records.get(commandKey(command.ticketId, command.commandId));
+        if (duplicateMatches(receipt, operation, command.messageId, fingerprint) &&
+            receipt?.kind === "command" &&
+            receipt.resultTicket !== undefined)
+            return receipt.resultTicket;
+        throw new SupportDeskConflictError();
+    }
+    const assistantTurns = createAssistantTurnServices({
+        records,
+        clock,
+        options: assistantTurnOptions,
+        assistantHandlingEnabled,
+        limits,
+        maxConflictAttempts,
+        conversation(ticket, rows) {
+            return {
+                ticket: toCustomerTicketSummary(ticket),
+                messages: customerMessages(rows),
+                revision: ticket.revision,
+                handling: { ...effectiveTicketHandling(ticket) },
+                ...(latestVisibleRecord(rows) === undefined
+                    ? {}
+                    : { triggerMessageId: latestVisibleRecord(rows).message.id }),
+            };
+        },
+        mutateHandling,
+    });
+    return {
+        ...resolutionLearning.application,
+        ...engineeringEvidence.application,
+        ...engineeringWorkers,
+        ...engineeringReconciliation,
+        ...engineeringPolicy.application,
+        ...engineeringFollowupSource.application,
+        ...engineeringFollowupWork.application,
+        approveAndPostEngineeringFollowupWebUpdate,
+        scanAssistantTurnCandidates: assistantTurns.scanAssistantTurnCandidates,
+        claimAssistantTurn: assistantTurns.claimAssistantTurn,
+        prepareAssistantTurnAttempt: assistantTurns.prepareAssistantTurnAttempt,
+        completeAssistantTurn: assistantTurns.completeAssistantTurn,
+        finishAssistantTurnAttempt: assistantTurns.finishAssistantTurnAttempt,
+        async readHandoffWork(access, ticketId) {
+            requirePermission(access, supportPermissions.queueRead);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            const rows = await records.list(ticketId);
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+            if (!rows.some((row) => row.kind === "ticket"))
+                throw new SupportDeskNotFoundError();
+            return rows
+                .filter((row) => row.kind === "handoff_work")
+                .sort((a, b) => a.transcript.throughRevision - b.transcript.throughRevision ||
+                a.id.localeCompare(b.id))
+                .map((row) => Object.freeze({
+                ticketId,
+                workId: row.id,
+                status: row.status,
+                reason: row.reason,
+                ...(row.summary === undefined ? {} : { summary: row.summary }),
+                attemptedGuideIds: Object.freeze([...row.attemptedGuideIds]),
+                transcript: Object.freeze({ ...row.transcript }),
+                handlingGeneration: row.handlingGeneration,
+                createdAt: row.createdAt,
+            }));
+        },
+        async readAssistantConversation(access, ticketId) {
+            requirePermission(access, supportPermissions.assistantRead);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            const rows = await records.list(ticketId);
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+            const ticket = rows.find((row) => row.kind === "ticket")?.ticket;
+            if (ticket === undefined)
+                throw new SupportDeskNotFoundError();
+            if (ticket.channel !== "web" ||
+                isTerminalTicketStatus(ticket.status) ||
+                effectiveTicketHandling(ticket).state !== "assistant")
+                throw new SupportDeskConflictError("Assistant conversation is unavailable");
+            const latest = latestVisibleRecord(rows);
+            return {
+                ticket: toCustomerTicketSummary(ticket),
+                messages: customerMessages(rows),
+                revision: ticket.revision,
+                handling: { ...effectiveTicketHandling(ticket) },
+                ...(latest?.message.authorKind === "customer"
+                    ? { triggerMessageId: latest.message.id }
+                    : {}),
+            };
+        },
+        async replyAsAssistant(access, input) {
+            requirePermission(access, supportPermissions.assistantReply);
+            const raw = handlingInput(input, [
+                "expectedRevision",
+                "expectedHandlingGeneration",
+                "triggerMessageId",
+                "messageId",
+                "body",
+            ]);
+            handlingFence(raw);
+            for (const key of ["triggerMessageId", "messageId"])
+                requireIdentifier(boundaryString(raw[key], key), key);
+            const body = boundaryString(raw.body, "body");
+            enforceLimit(body, "body", limits.maxMessageCharacters);
+            const command = raw;
+            return handlingAck(await mutateHandling(access, command, "assistant_reply"), command.messageId);
+        },
+        async escalateToHuman(access, input) {
+            requirePermission(access, supportPermissions.assistantEscalate);
+            const raw = handlingInput(input, ["expectedRevision", "expectedHandlingGeneration", "triggerMessageId"], ["reason", "summary", "attemptedGuideIds"]);
+            handlingFence(raw);
+            requireIdentifier(boundaryString(raw.triggerMessageId, "triggerMessageId"), "triggerMessageId");
+            if (raw.reason !== undefined &&
+                ![
+                    "no_guidance",
+                    "unsuccessful",
+                    "capacity",
+                    "provider_failure",
+                    "other",
+                ].includes(raw.reason))
+                throw new TypeError("Invalid escalation reason");
+            if (raw.summary !== undefined) {
+                const summary = boundaryString(raw.summary, "summary");
+                requireNonempty(summary, "handoff_summary");
+                if (summary.length > 2_000)
+                    throw new SupportDeskLimitError("handoff_summary", 2_000);
+            }
+            if (raw.attemptedGuideIds !== undefined) {
+                if (!Array.isArray(raw.attemptedGuideIds) ||
+                    raw.attemptedGuideIds.length > 16)
+                    throw new TypeError("Too many attempted guide IDs");
+                const guides = raw.attemptedGuideIds;
+                if (Object.keys(guides).length !== guides.length ||
+                    Object.getOwnPropertySymbols(guides).length !== 0)
+                    throw new TypeError("Guide IDs must be dense data");
+                raw.attemptedGuideIds = Object.freeze(Array.from({ length: guides.length }, (_, index) => {
+                    const value = ownDataProperty(guides, String(index), "attemptedGuideIds");
+                    const id = boundaryString(value, "guideId");
+                    requireIdentifier(id, "guideId");
+                    if (id.length > 200 || id.includes("://"))
+                        throw new TypeError("Guide IDs must be bounded opaque references");
+                    return id;
+                }));
+            }
+            return handlingAck(await mutateHandling(access, raw, "assistant_escalate"));
+        },
+        async requestPerson(access, input) {
+            requirePermission(access, supportPermissions.requestPerson);
+            const command = handlingInput(input, []);
+            await mutateHandling(access, command, "request_person");
+            return customerViewAfterChange(access.principalId, command.ticketId);
+        },
+        async takeOverTicket(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.takeOver);
+            const command = handlingFence(handlingInput(input, [
+                "expectedRevision",
+                "expectedHandlingGeneration",
+            ]));
+            await mutateHandling(access, command, "take_over");
+            return staffCommandResult(command.ticketId, command.commandId);
+        },
+        async confirmCustomerSuccess(access, input) {
+            requirePermission(access, supportPermissions.confirmSuccess);
+            const raw = handlingInput(input, ["lastSeenVisibleMessageId"]);
+            requireIdentifier(boundaryString(raw.lastSeenVisibleMessageId, "lastSeenVisibleMessageId"), "lastSeenVisibleMessageId");
+            const command = raw;
+            await mutateHandling(access, command, "confirm_customer_success");
+            return customerViewAfterChange(access.principalId, command.ticketId);
+        },
+        async readCustomerSuccessConfirmations(access, ticketId) {
+            requireStaffMutationAccess(access, supportPermissions.auditRead);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            const rows = await records.list(ticketId);
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+            if (!rows.some((row) => row.kind === "ticket"))
+                throw new SupportDeskNotFoundError();
+            return rows
+                .filter((row) => row.kind === "customer_success")
+                .sort((a, b) => a.revision - b.revision || a.commandId.localeCompare(b.commandId))
+                .map(({ kind: _kind, partition: _partition, id: _id, ...proof }) => Object.freeze(proof));
+        },
+        async createCustomerTicket(access, input) {
+            requirePermission(access, supportPermissions.create);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotCreateCustomerTicketCommand(input);
+            if (command.initialHandling === "assistant") {
+                requirePermission(access, supportPermissions.assistantStart);
+            }
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.messageId, "messageId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            enforceLimit(command.subject, "subject", limits.maxSubjectCharacters);
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const fingerprintPayload = {
+                type: "create_customer_ticket",
+                ticketId: command.ticketId,
+                messageId: command.messageId,
+                subject: command.subject,
+                body: command.body,
+                // Omit absent category so pre-category receipts still match retries.
+                ...(command.category === undefined
+                    ? {}
+                    : { category: command.category }),
+                requesterEmail: command.requesterEmail ?? null,
+                notification: stableNotification(command.notification),
+                ...(command.initialHandling === undefined
+                    ? {}
+                    : { initialHandling: command.initialHandling }),
+            };
+            const fingerprint = await requestFingerprint(fingerprintPayload);
+            const createThreading = {
+                ticketNumber: true,
+                ...(command.notification === undefined
+                    ? {}
+                    : { messageId: command.messageId }),
+            };
+            // Replay an already committed create before host allowlist checks so a
+            // later config change cannot break idempotent retries of the same command.
+            // Replay never reserves another instance ticket number.
+            const existingCreate = await records.get(commandKey(command.ticketId, command.commandId));
+            let createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, fingerprint);
+            if (!createIsReplay &&
+                command.initialHandling === undefined &&
+                existingCreate?.kind === "command" &&
+                existingCreate.commandType === "create_customer_ticket" &&
+                existingCreate.messageId === command.messageId) {
+                // Pre-Task-3 receipts included ticketNumber in the fingerprint.
+                const existingTicket = await records.get(ticketKey(command.ticketId));
+                if (existingTicket?.kind === "ticket") {
+                    // Pre-Task-3 hashed ticketNumber immediately after ticketId.
+                    const legacyFingerprint = await requestFingerprint({
+                        type: fingerprintPayload.type,
+                        ticketId: fingerprintPayload.ticketId,
+                        ticketNumber: existingTicket.ticket.number,
+                        messageId: fingerprintPayload.messageId,
+                        subject: fingerprintPayload.subject,
+                        body: fingerprintPayload.body,
+                        ...(command.category === undefined
+                            ? {}
+                            : { category: command.category }),
+                        requesterEmail: fingerprintPayload.requesterEmail,
+                        notification: fingerprintPayload.notification,
+                    });
+                    createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, legacyFingerprint);
+                }
+            }
+            if (createIsReplay) {
+                const current = await records.get(ticketKey(command.ticketId));
+                if (current?.kind !== "ticket" ||
+                    !owns(current.ticket, access.principalId))
+                    throw new SupportDeskNotFoundError();
+                // A crash after ticket commit and before index confirmation must still
+                // converge the principal hint on retry.
+                const fence = await records.get(ticketReservationKey(command.ticketId));
+                if (fence?.kind === "ticket_reservation" &&
+                    fence.state === "committed") {
+                    await confirmCustomerTicket(access.principalId, command.ticketId, fence.token, fence.generation);
+                }
+                return customerViewAfterChange(access.principalId, command.ticketId, createThreading);
+            }
+            if (command.initialHandling === "assistant" && !assistantHandlingEnabled)
+                throw new SupportDeskConflictError("Assistant handling is disabled");
+            if (command.category !== undefined) {
+                if (allowedCategories === undefined ||
+                    !allowedCategories.has(command.category)) {
+                    throw new TypeError("create command.category is not configured for this Support Desk instance");
+                }
+            }
+            // Fail closed before durable number/index reservation so a too-small
+            // partition budget cannot exhaust the principal ticket index with
+            // reserved-but-never-created tickets.
+            const estimatedCreateRows = 6 + // ticket, quota, reservation, message, audit, command
+                (resolutionLearningOptions.enabled ? 1 : 0) +
+                (engineeringOptions.enabled ? 1 : 0) +
+                (command.notification === undefined ? 0 : 1) +
+                (assistantTurnOptions !== undefined &&
+                    command.initialHandling === "assistant"
+                    ? 1
+                    : 0);
+            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, estimatedCreateRows +
+                (resolutionLearningOptions.enabled ? 2 : 0) +
+                (engineeringOptions.enabled ? 2 : 0) +
+                (command.initialHandling === "assistant"
+                    ? assistantHumanReserveRows +
+                        (resolutionLearningOptions.enabled ? 1 : 0)
+                    : 0));
+            if (command.initialHandling === "assistant" &&
+                limits.maxMessagesPerTicket < 1 + assistantHumanReserveMessages)
+                throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+            // Reserve outside the ticket transaction; gaps are accepted if create fails.
+            const ticketNumber = await reserveTicketNumber();
+            // Bind host-supplied notification content to the reserved number so mail
+            // cannot advertise a guessed ticket number.
             const notification = command.notification === undefined
                 ? undefined
                 : bindNotificationTicketNumber(command.notification, ticketNumber);
             const now = clock.now();
-            const ticket = createTicket({
+            const ticket = await applyResponseTargets(createTicket({
                 id: command.ticketId,
                 number: ticketNumber,
                 subject: command.subject,
                 channel: "web",
+                ...(command.initialHandling === undefined
+                    ? {}
+                    : { initialHandling: command.initialHandling }),
                 ...(command.category === undefined
                     ? {}
                     : { category: command.category }),
@@ -1674,7 +3158,7 @@ export function createSupportDeskApplication(options) {
                         : { email: command.requesterEmail }),
                 },
                 createdAt: now,
-            });
+            }), responseTargetPolicy, "created");
             const message = {
                 id: command.messageId,
                 ticketId: command.ticketId,
@@ -1686,6 +3170,10 @@ export function createSupportDeskApplication(options) {
                 body: command.body,
                 createdAt: now,
             };
+            const assistantTurn = assistantTurnOptions !== undefined &&
+                command.initialHandling === "assistant"
+                ? await createAssistantTurnRecord(ticket, message, command.correlationId, assistantTurnOptions)
+                : undefined;
             const notificationJob = notification === undefined
                 ? undefined
                 : deliveryJobAction(command.ticketId, command.messageId, now, notification);
@@ -1728,6 +3216,22 @@ export function createSupportDeskApplication(options) {
                     ]
                     : [];
             const actions = [
+                ...(engineeringOptions.enabled
+                    ? [
+                        {
+                            action: "insert",
+                            value: await createEngineeringSource(ticket),
+                        },
+                    ]
+                    : []),
+                ...(resolutionLearningOptions.enabled
+                    ? [
+                        {
+                            action: "insert",
+                            value: await createResolutionLearningSource(ticket),
+                        },
+                    ]
+                    : []),
                 {
                     action: "insert",
                     value: {
@@ -1744,6 +3248,9 @@ export function createSupportDeskApplication(options) {
                         partition: command.ticketId,
                         id: "quota",
                         messageCount: 1,
+                        ...(command.initialHandling === "assistant"
+                            ? { assistantManaged: true }
+                            : {}),
                     },
                 },
                 ...reservationActions,
@@ -1783,6 +3290,9 @@ export function createSupportDeskApplication(options) {
                     },
                 },
                 ...(notificationJob === undefined ? [] : [notificationJob]),
+                ...(assistantTurn === undefined
+                    ? []
+                    : [{ action: "insert", value: assistantTurn }]),
             ];
             // Create starts an empty partition; fail closed if the first write would
             // exceed the configured physical-record budget.
@@ -1795,7 +3305,7 @@ export function createSupportDeskApplication(options) {
                 }
             }
             await confirmCustomerTicket(access.principalId, command.ticketId, reservation.reservationToken, reservation.reservationGeneration);
-            return customerViewAfterChange(access.principalId, command.ticketId);
+            return customerViewAfterChange(access.principalId, command.ticketId, createThreading);
         },
         async replyToCustomerTicket(access, input) {
             requirePermission(access, supportPermissions.replyOwn);
@@ -1816,7 +3326,7 @@ export function createSupportDeskApplication(options) {
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(duplicate, "reply_customer_ticket", command.messageId, fingerprint)) {
-                    return customerViewAfterChange(access.principalId, command.ticketId);
+                    return customerViewAfterChange(access.principalId, command.ticketId, notificationThreading(command));
                 }
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket" ||
@@ -1825,7 +3335,10 @@ export function createSupportDeskApplication(options) {
                     throw new SupportDeskNotFoundError();
                 }
                 const partitionRows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, command.notification === undefined ? 3 : 4);
+                const durableAssistantIngress = assistantTurnOptions !== undefined &&
+                    effectiveTicketHandling(versioned.value.ticket).state === "assistant";
+                const addedReplyRows = (command.notification === undefined ? 3 : 4) +
+                    (durableAssistantIngress ? 1 : 0);
                 const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
                 if (quota?.value.kind !== "ticket_quota") {
                     throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
@@ -1839,11 +3352,25 @@ export function createSupportDeskApplication(options) {
                 const now = sampledEpoch < storedEpoch
                     ? versioned.value.ticket.updatedAt
                     : sampledNow;
-                const updated = applyTicketEvent(versioned.value.ticket, {
+                let updated = await applyResponseTargets(applyTicketEvent(versioned.value.ticket, {
                     type: "customer_replied",
                     actorId: access.principalId,
                     occurredAt: now,
-                });
+                }), responseTargetPolicy, "customer_replied");
+                if (durableAssistantIngress && !assistantHandlingEnabled) {
+                    // Configuration can disable generation while an older assistant
+                    // conversation exists. The causal reply itself commits human work.
+                    updated = applyTicketEvent(updated, {
+                        type: "human_escalated",
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        expectedRevision: updated.revision,
+                        expectedHandlingGeneration: effectiveTicketHandling(updated).generation,
+                    });
+                }
+                const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, true);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedReplyRows + learningMutation.additionalRows);
+                enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, addedReplyRows + learningMutation.additionalRows, true);
                 const message = {
                     id: command.messageId,
                     ticketId: command.ticketId,
@@ -1856,15 +3383,22 @@ export function createSupportDeskApplication(options) {
                     createdAt: now,
                 };
                 const notificationContent = deliveryContent(command.notification);
+                const assistantIngress = !durableAssistantIngress
+                    ? undefined
+                    : assistantHandlingEnabled
+                        ? await createAssistantTurnRecord(updated, message, command.correlationId, assistantTurnOptions)
+                        : handoffWork({
+                            ticket: updated,
+                            commandId: command.commandId,
+                            occurredAt: now,
+                            lastVisibleMessageId: command.messageId,
+                            reason: "other",
+                        });
                 const notificationJob = command.notification === undefined
                     ? undefined
                     : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
                 const outcome = await records.transact(command.ticketId, [
-                    {
-                        action: "putIfUnchanged",
-                        version: versioned.version,
-                        value: { ...versioned.value, ticket: updated },
-                    },
+                    ...learningMutation.actions,
                     {
                         action: "putIfUnchanged",
                         version: quota.version,
@@ -1909,13 +3443,16 @@ export function createSupportDeskApplication(options) {
                         },
                     },
                     ...(notificationJob === undefined ? [] : [notificationJob]),
+                    ...(assistantIngress === undefined
+                        ? []
+                        : [{ action: "insert", value: assistantIngress }]),
                 ]);
                 if (outcome.committed) {
-                    return customerViewAfterChange(access.principalId, command.ticketId);
+                    return customerViewAfterChange(access.principalId, command.ticketId, notificationThreading(command));
                 }
                 const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(nowDuplicate, "reply_customer_ticket", command.messageId, fingerprint)) {
-                    return customerViewAfterChange(access.principalId, command.ticketId);
+                    return customerViewAfterChange(access.principalId, command.ticketId, notificationThreading(command));
                 }
             }
             throw new SupportDeskConflictError();
@@ -1956,6 +3493,10 @@ export function createSupportDeskApplication(options) {
             requirePermission(access, supportPermissions.queueRead);
             requireIdentifier(access.principalId, "principalId");
             const query = snapshotStaffQueueQuery(input);
+            // One trusted instant for the entire bounded request; no clock read for old queries.
+            const targetNow = query.targetState === undefined
+                ? undefined
+                : canonicalTimestamp(clock.now(), "clock.now()");
             // Request-local cursor only: every online queue read starts without one
             // and consumes a single complete projection scan cycle.
             let cursor;
@@ -2016,10 +3557,17 @@ export function createSupportDeskApplication(options) {
                     }
                     const ticket = ticketRecord.ticket;
                     if (ticket.id !== projection.ticketId ||
-                        ticket.revision !== projection.projectedRevision ||
+                        !Number.isSafeInteger(projection.projectedRevision) ||
+                        projection.projectedRevision <= 0 ||
+                        projection.projectedRevision > ticket.revision ||
                         isTerminalTicketStatus(ticket.status)) {
                         continue;
                     }
+                    const handlingView = query.handling ?? "human";
+                    if (handlingView !== "all" &&
+                        (handlingView === "assistant") !==
+                            (effectiveTicketHandling(ticket).state === "assistant"))
+                        continue;
                     if (seenTicketIds.has(ticket.id)) {
                         // Scan pages may repeat rows; de-duplicate after confirmation.
                         continue;
@@ -2035,9 +3583,33 @@ export function createSupportDeskApplication(options) {
                 }
                 cursor = page.nextCursor;
             }
-            const filtered = confirmed.filter((item) => staffQueueItemMatches(item, query));
+            const filtered = confirmed.filter((item) => staffQueueItemMatches(item, query, targetNow));
             const sort = query.sort ?? "updated_newest";
+            // Parse each pending due date once per read, not once per comparison.
+            const dueEpochs = new Map();
+            if (sort === "due_soonest" || sort === "due_latest") {
+                for (const item of filtered) {
+                    const due = pendingTargetDue(item, query.target);
+                    if (due !== undefined)
+                        dueEpochs.set(item, canonicalTimestamp(due, "ticket target"));
+                }
+            }
             filtered.sort((left, right) => {
+                if (sort === "due_soonest" || sort === "due_latest") {
+                    const leftDue = dueEpochs.get(left);
+                    const rightDue = dueEpochs.get(right);
+                    // Completed and missing targets sort last in both directions.
+                    if (leftDue === undefined && rightDue !== undefined)
+                        return 1;
+                    if (rightDue === undefined && leftDue !== undefined)
+                        return -1;
+                    const difference = leftDue === undefined || rightDue === undefined
+                        ? 0
+                        : sort === "due_soonest"
+                            ? leftDue - rightDue
+                            : rightDue - leftDue;
+                    return difference || left.ticketId.localeCompare(right.ticketId);
+                }
                 const byTime = sort === "updated_oldest"
                     ? left.updatedAt.localeCompare(right.updatedAt)
                     : right.updatedAt.localeCompare(left.updatedAt);
@@ -2061,6 +3633,7 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.correlationId, "correlationId");
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
             const fingerprint = await requestFingerprint({
+                ...snapshotRevisionHint(command),
                 type: "staff_reply",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
@@ -2070,14 +3643,17 @@ export function createSupportDeskApplication(options) {
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(duplicate, "staff_reply", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket") {
                     throw new SupportDeskNotFoundError();
                 }
+                if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 const partitionRows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, command.notification === undefined ? 3 : 4);
                 const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
                 if (quota?.value.kind !== "ticket_quota") {
                     throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
@@ -2091,6 +3667,11 @@ export function createSupportDeskApplication(options) {
                     actorId: access.principalId,
                     occurredAt: now,
                 });
+                const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, true);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, (command.notification === undefined ? 3 : 4) +
+                    learningMutation.additionalRows);
+                enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, (command.notification === undefined ? 3 : 4) +
+                    learningMutation.additionalRows, true, true);
                 const message = {
                     id: command.messageId,
                     ticketId: command.ticketId,
@@ -2107,11 +3688,7 @@ export function createSupportDeskApplication(options) {
                     ? undefined
                     : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
                 const outcome = await records.transact(command.ticketId, [
-                    {
-                        action: "putIfUnchanged",
-                        version: versioned.version,
-                        value: { ...versioned.value, ticket: updated },
-                    },
+                    ...learningMutation.actions,
                     {
                         action: "putIfUnchanged",
                         version: quota.version,
@@ -2153,19 +3730,20 @@ export function createSupportDeskApplication(options) {
                             messageId: command.messageId,
                             requestFingerprint: fingerprint,
                             completedAt: now,
+                            resultTicket: updated,
                         },
                     },
                     ...(notificationJob === undefined ? [] : [notificationJob]),
                 ]);
                 if (outcome.committed) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
                 const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(nowDuplicate, "staff_reply", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
             }
-            throw new SupportDeskConflictError();
+            return staffConflictResult(command, fingerprint);
         },
         async addNote(access, input) {
             requireStaffMutationAccess(access, supportPermissions.note);
@@ -2177,6 +3755,7 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.correlationId, "correlationId");
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
             const fingerprint = await requestFingerprint({
+                ...snapshotRevisionHint(command),
                 type: "add_note",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
@@ -2185,14 +3764,19 @@ export function createSupportDeskApplication(options) {
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(duplicate, "add_note", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket") {
                     throw new SupportDeskNotFoundError();
                 }
+                if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 const partitionRows = await records.list(command.ticketId);
                 enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 3);
+                enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, 3, true);
                 const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
                 if (quota?.value.kind !== "ticket_quota") {
                     throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
@@ -2268,18 +3852,19 @@ export function createSupportDeskApplication(options) {
                             messageId: command.messageId,
                             requestFingerprint: fingerprint,
                             completedAt: now,
+                            resultTicket: updated,
                         },
                     },
                 ]);
                 if (outcome.committed) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
                 const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(nowDuplicate, "add_note", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
             }
-            throw new SupportDeskConflictError();
+            return staffConflictResult(command, fingerprint);
         },
         async assignTicket(access, input) {
             requireStaffMutationAccess(access, supportPermissions.assign);
@@ -2298,6 +3883,7 @@ export function createSupportDeskApplication(options) {
                 enforceLimit(command.body, "body", limits.maxMessageCharacters);
             }
             const fingerprint = await requestFingerprint({
+                ...snapshotRevisionHint(command),
                 type: "assign_ticket",
                 ticketId: command.ticketId,
                 assigneeId: command.assigneeId,
@@ -2308,8 +3894,10 @@ export function createSupportDeskApplication(options) {
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(duplicate, "assign_ticket", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket") {
                     throw new SupportDeskNotFoundError();
@@ -2319,8 +3907,11 @@ export function createSupportDeskApplication(options) {
                     : command.notification === undefined
                         ? 3
                         : 4;
+                if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 const partitionRows = await records.list(command.ticketId);
                 enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords);
+                enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, addedRecords, command.messageId !== undefined);
                 let quotaVersion = null;
                 if (command.messageId !== undefined) {
                     quotaVersion = await records.getVersioned(ticketQuotaKey(command.ticketId));
@@ -2377,9 +3968,7 @@ export function createSupportDeskApplication(options) {
                                 action: "putIfUnchanged",
                                 version: quotaVersion.version,
                                 value: {
-                                    kind: "ticket_quota",
-                                    partition: command.ticketId,
-                                    id: "quota",
+                                    ...quotaVersion.value,
                                     messageCount: quotaVersion.value.messageCount + 1,
                                 },
                             },
@@ -2428,19 +4017,20 @@ export function createSupportDeskApplication(options) {
                                 : { messageId: command.messageId }),
                             requestFingerprint: fingerprint,
                             completedAt: now,
+                            resultTicket: updated,
                         },
                     },
                     ...(notificationJob === undefined ? [] : [notificationJob]),
                 ]);
                 if (outcome.committed) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
                 const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(nowDuplicate, "assign_ticket", command.messageId, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
             }
-            throw new SupportDeskConflictError();
+            return staffConflictResult(command, fingerprint);
         },
         async changePriority(access, input) {
             requireStaffMutationAccess(access, supportPermissions.manage);
@@ -2450,6 +4040,7 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.commandId, "commandId");
             requireIdentifier(command.correlationId, "correlationId");
             const fingerprint = await requestFingerprint({
+                ...snapshotRevisionHint(command),
                 type: "change_priority",
                 ticketId: command.ticketId,
                 priority: command.priority,
@@ -2457,23 +4048,28 @@ export function createSupportDeskApplication(options) {
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(duplicate, "change_priority", undefined, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket") {
                     throw new SupportDeskNotFoundError();
                 }
+                if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId);
                 const partitionRows = await records.list(command.ticketId);
                 enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 2);
+                enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, 2);
                 const statusBefore = versioned.value.ticket.status;
                 const customerUpdatedBefore = versioned.value.ticket.customerUpdatedAt;
                 const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
-                const updated = applyTicketEvent(versioned.value.ticket, {
+                const updated = await applyResponseTargets(applyTicketEvent(versioned.value.ticket, {
                     type: "priority_changed",
                     actorId: access.principalId,
                     priority: command.priority,
                     occurredAt: now,
-                });
+                }), responseTargetPolicy, "priority_changed");
                 if (updated.status !== statusBefore ||
                     updated.customerUpdatedAt !== customerUpdatedBefore) {
                     throw new SupportDeskConflictError("Priority change unexpectedly changed customer-visible ticket state");
@@ -2504,18 +4100,98 @@ export function createSupportDeskApplication(options) {
                             commandType: "change_priority",
                             requestFingerprint: fingerprint,
                             completedAt: now,
+                            resultTicket: updated,
                         },
                     },
                 ]);
                 if (outcome.committed) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
                 const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
                 if (duplicateMatches(nowDuplicate, "change_priority", undefined, fingerprint)) {
-                    return staffViewAfterChange(command.ticketId);
+                    return staffCommandResult(command.ticketId, command.commandId);
                 }
             }
-            throw new SupportDeskConflictError();
+            return staffConflictResult(command, fingerprint);
+        },
+        async setTags(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.manage);
+            requireIdentifier(access.principalId, "principalId");
+            const source = boundaryObject(input, "set tags command");
+            const command = Object.freeze({
+                ...snapshotRevisionHint(source),
+                commandId: boundaryString(ownDataProperty(source, "commandId", "commandId"), "commandId"),
+                correlationId: boundaryString(ownDataProperty(source, "correlationId", "correlationId"), "correlationId"),
+                ticketId: boundaryString(ownDataProperty(source, "ticketId", "ticketId"), "ticketId"),
+                tags: snapshotTags(ownDataProperty(source, "tags", "tags")),
+            });
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            const fingerprint = await requestFingerprint({
+                type: "set_tags",
+                ticketId: command.ticketId,
+                tags: command.tags,
+                ...snapshotRevisionHint(command),
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "set_tags", undefined, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId);
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket")
+                    throw new SupportDeskNotFoundError();
+                if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                    return staffCommandResult(command.ticketId, command.commandId);
+                if (command.tags.length > maxTagsPerTicket)
+                    throw new TypeError("tags exceed maxTagsPerTicket");
+                if (command.tags.some((tag) => !allowedTags.has(tag)))
+                    throw new TypeError("tags must be on the host allowlist");
+                const rows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket, 2);
+                enforceManagedAdmission(versioned.value.ticket, rows, limits, 2);
+                const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "tags_changed",
+                    actorId: access.principalId,
+                    occurredAt: now,
+                    tags: command.tags,
+                });
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: supportTicketAuditActions.tagsChanged,
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "set_tags",
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                            resultTicket: updated,
+                        },
+                    },
+                ]);
+                if (outcome.committed)
+                    return staffCommandResult(command.ticketId, command.commandId);
+            }
+            return staffConflictResult(command, fingerprint);
         },
         async resolveTicket(access, input) {
             return mutateLifecycle(access, input, {
@@ -2568,6 +4244,7 @@ export function createSupportDeskApplication(options) {
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
         }
         const fingerprint = await requestFingerprint({
+            ...snapshotRevisionHint(command),
             type: spec.commandType,
             ticketId: command.ticketId,
             messageId: command.messageId ?? null,
@@ -2577,19 +4254,25 @@ export function createSupportDeskApplication(options) {
         for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
             const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
             if (duplicateMatches(duplicate, spec.commandType, command.messageId, fingerprint)) {
-                return staffViewAfterChange(command.ticketId);
+                return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
             }
+            if (duplicate !== null)
+                throw new SupportDeskConflictError("Command ID reused with different input");
             const versioned = await records.getVersioned(ticketKey(command.ticketId));
             if (versioned?.value.kind !== "ticket") {
                 throw new SupportDeskNotFoundError();
             }
+            if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
+                return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
             const partitionRows = await records.list(command.ticketId);
-            const addedRecords = command.messageId === undefined
+            const needsReopenHandoff = assistantTurnOptions !== undefined &&
+                spec.eventType === "reopened" &&
+                effectiveTicketHandling(versioned.value.ticket).state === "assistant";
+            const addedRecords = (command.messageId === undefined
                 ? 2 // audit + command
                 : command.notification === undefined
                     ? 3 // message + audit + command
-                    : 4; // message + audit + command + delivery
-            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords);
+                    : 4) + (needsReopenHandoff ? 1 : 0); // optional atomic human handoff
             let quotaVersion = null;
             if (command.messageId !== undefined) {
                 quotaVersion = await records.getVersioned(ticketQuotaKey(command.ticketId));
@@ -2606,6 +4289,9 @@ export function createSupportDeskApplication(options) {
                 actorId: access.principalId,
                 occurredAt: now,
             });
+            const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, command.messageId !== undefined);
+            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords + learningMutation.additionalRows);
+            enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, addedRecords + learningMutation.additionalRows, command.messageId !== undefined);
             // Optional system message + mail commit with the lifecycle change so a
             // resolution notification cannot be lost after the ticket is resolved.
             const systemMessage = command.messageId === undefined || command.body === undefined
@@ -2625,11 +4311,7 @@ export function createSupportDeskApplication(options) {
                 ? undefined
                 : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
             const outcome = await records.transact(command.ticketId, [
-                {
-                    action: "putIfUnchanged",
-                    version: versioned.version,
-                    value: { ...versioned.value, ticket: updated },
-                },
+                ...learningMutation.actions,
                 ...(quotaVersion === null ||
                     systemMessage === undefined ||
                     quotaVersion.value.kind !== "ticket_quota"
@@ -2639,9 +4321,7 @@ export function createSupportDeskApplication(options) {
                             action: "putIfUnchanged",
                             version: quotaVersion.version,
                             value: {
-                                kind: "ticket_quota",
-                                partition: command.ticketId,
-                                id: "quota",
+                                ...quotaVersion.value,
                                 messageCount: quotaVersion.value.messageCount + 1,
                             },
                         },
@@ -2685,19 +4365,35 @@ export function createSupportDeskApplication(options) {
                             : { messageId: command.messageId }),
                         requestFingerprint: fingerprint,
                         completedAt: now,
+                        resultTicket: updated,
                     },
                 },
                 ...(notificationJob === undefined ? [] : [notificationJob]),
+                ...(needsReopenHandoff
+                    ? [
+                        {
+                            action: "insert",
+                            value: handoffWork({
+                                ticket: updated,
+                                commandId: command.commandId,
+                                occurredAt: now,
+                                lastVisibleMessageId: systemMessage?.id ??
+                                    latestVisibleRecord(partitionRows).message.id,
+                                reason: "other",
+                            }),
+                        },
+                    ]
+                    : []),
             ]);
             if (outcome.committed) {
-                return staffViewAfterChange(command.ticketId);
+                return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
             }
             const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
             if (duplicateMatches(nowDuplicate, spec.commandType, command.messageId, fingerprint)) {
-                return staffViewAfterChange(command.ticketId);
+                return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
             }
         }
-        throw new SupportDeskConflictError();
+        return staffConflictResult(command, fingerprint);
     }
 }
 function canonicalTimestamp(value, field) {
@@ -2922,7 +4618,8 @@ export async function sweepInboundReceipts(store, clock, input) {
     }
     const receipts = store.collection(inboundReceipts);
     const candidates = (await receipts.listVersioned(bucket))
-        .filter((versioned) => versioned.value.status !== "processing" &&
+        .filter((versioned) => (versioned.value.status === "processed" ||
+        versioned.value.status === "rejected") &&
         versioned.value.processedAt !== undefined &&
         versioned.value.processedAt <= processedBefore &&
         versioned.value.processedAt < horizonBefore)
@@ -3045,4 +4742,1671 @@ export async function pruneCustomerTicketIndex(store, principalId, input) {
     });
     return result.value?.entries.map((entry) => entry.ticketId) ?? [];
 }
+const threadIndexKey = (record) => ({
+    partition: record.key,
+    id: record.id,
+});
+export const threadIndex = defineCollection({
+    name: "support-desk.thread-index.v1",
+    key: threadIndexKey,
+    codec: jsonCodec(threadIndexKey),
+});
+/**
+ * Default lifetime of `Message-ID` and reply-token threading rows. Lookups,
+ * repair, and sweeping all treat older rows as absent; ticket-number rows
+ * live as long as their ticket.
+ */
+export const defaultThreadIndexRetentionMilliseconds = 365 * 86_400_000;
+/** Actor recorded on Audit events accepted from verified inbound mail. */
+export const inboundEmailSystemActorId = "support-desk.inbound-email";
+function notificationThreading(command) {
+    return command.notification === undefined || command.messageId === undefined
+        ? undefined
+        : { messageId: command.messageId };
+}
+function messageKey(ticketId, messageId) {
+    return { partition: ticketId, id: `message:${messageId}` };
+}
+async function sha256Hex(text) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+    return [...new Uint8Array(digest)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function messageIdIndexKey(value) {
+    return `mid:${await sha256Hex(`message-id\u0000${value}`)}`;
+}
+async function replyTokenIndexKey(token) {
+    return `rt:${await sha256Hex(`reply-token\u0000${token}`)}`;
+}
+function ticketNumberIndexKey(ticketNumber) {
+    return `number:${ticketNumber}`;
+}
+const inboundMessageIdPattern = /^<[^<>\s@]+@[^<>\s@]+>$/;
+const maxInboundMessageIdCharacters = 512;
+/**
+ * Accept a header-shaped `<local@domain>` identifier or nothing. Malformed
+ * sender-controlled identifiers are dropped rather than stored or matched.
+ */
+function normalizeInboundMessageId(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0 ||
+        trimmed.length > maxInboundMessageIdCharacters ||
+        /[\u0000-\u001F\u007F]/.test(trimmed) ||
+        !inboundMessageIdPattern.test(trimmed)) {
+        return undefined;
+    }
+    return trimmed;
+}
+/** Derive every thread-index row an authoritative record implies. */
+async function threadIndexEntriesFor(record) {
+    if (record.kind === "ticket") {
+        const ticket = record.ticket;
+        if (ticket.id !== record.partition ||
+            !Number.isSafeInteger(ticket.number) ||
+            ticket.number <= 0) {
+            return [];
+        }
+        return [
+            {
+                key: ticketNumberIndexKey(ticket.number),
+                id: "thread",
+                kind: "ticket_number",
+                ticketId: ticket.id,
+                issuedAt: ticket.createdAt,
+            },
+        ];
+    }
+    if (record.kind !== "message") {
+        return [];
+    }
+    const message = record.message;
+    if (message.ticketId !== record.partition ||
+        record.id !== `message:${message.id}`) {
+        return [];
+    }
+    const entries = [];
+    const content = record.deliveryContent;
+    if (content !== undefined) {
+        entries.push({
+            key: await messageIdIndexKey(content.outboundMessageId),
+            id: "thread",
+            kind: "message_id",
+            ticketId: message.ticketId,
+            messageId: message.id,
+            source: "outbound",
+            issuedAt: message.createdAt,
+        });
+        if (content.replyRoutingToken !== undefined) {
+            entries.push({
+                key: await replyTokenIndexKey(content.replyRoutingToken),
+                id: "thread",
+                kind: "reply_token",
+                ticketId: message.ticketId,
+                messageId: message.id,
+                issuedAt: message.createdAt,
+            });
+        }
+    }
+    if (message.channel === "email" &&
+        message.authorKind === "customer" &&
+        message.externalMessageId !== undefined &&
+        message.externalMessageId !== content?.outboundMessageId &&
+        normalizeInboundMessageId(message.externalMessageId) ===
+            message.externalMessageId) {
+        entries.push({
+            key: await messageIdIndexKey(message.externalMessageId),
+            id: "thread",
+            kind: "message_id",
+            ticketId: message.ticketId,
+            messageId: message.id,
+            source: "inbound",
+            issuedAt: message.createdAt,
+        });
+    }
+    return entries;
+}
+/** First writer wins; a different mapping for the same key is a collision. */
+async function putThreadIndexEntry(index, entry) {
+    const result = await index.insertIfAbsent(entry);
+    if (result.inserted) {
+        return "written";
+    }
+    const existing = result.value;
+    return existing.kind === entry.kind &&
+        existing.ticketId === entry.ticketId &&
+        existing.messageId === entry.messageId &&
+        existing.source === entry.source
+        ? "kept"
+        : "collision";
+}
+function safeLog(logger, level, event, fields) {
+    try {
+        logger.log(level, event, fields);
+    }
+    catch {
+        // ignore logger transport failures
+    }
+}
+/**
+ * Best-effort post-commit threading writes for one ticket. Failures are
+ * logged and later converged by {@link repairThreadIndexPage}; they never
+ * fail the command that already committed. Does not sample the clock.
+ */
+async function indexThreadingAfterCommit(store, ticketId, hint, logger) {
+    try {
+        const records = store.collection(supportRecords);
+        const index = store.collection(threadIndex);
+        const sources = [];
+        if (hint.ticketNumber === true) {
+            const ticket = await records.get(ticketKey(ticketId));
+            if (ticket !== null) {
+                sources.push(ticket);
+            }
+        }
+        if (hint.messageId !== undefined) {
+            const message = await records.get(messageKey(ticketId, hint.messageId));
+            if (message !== null) {
+                sources.push(message);
+            }
+        }
+        for (const source of sources) {
+            for (const entry of await threadIndexEntriesFor(source)) {
+                if ((await putThreadIndexEntry(index, entry)) === "collision") {
+                    safeLog(logger, "warn", "support-desk.thread_index.collision", {
+                        ticketId,
+                        kind: entry.kind,
+                    });
+                }
+            }
+        }
+    }
+    catch (error) {
+        safeLog(logger, "error", "support-desk.thread_index.write_failed", {
+            ticketId,
+            message: error instanceof Error ? error.message : "thread index write failed",
+        });
+    }
+}
+/**
+ * Re-derive a row from its authoritative ticket or message. Returns the
+ * current ticket only when the row still describes that record and, for
+ * message rows, is inside the retention window.
+ */
+async function confirmThreadEntry(records, entry, nowEpoch, retentionMilliseconds) {
+    const ticketRecord = await records.get(ticketKey(entry.ticketId));
+    if (ticketRecord?.kind !== "ticket" ||
+        ticketRecord.ticket.id !== entry.ticketId) {
+        return null;
+    }
+    let authoritative = ticketRecord;
+    if (entry.kind !== "ticket_number") {
+        if (entry.messageId === undefined) {
+            return null;
+        }
+        const message = await records.get(messageKey(entry.ticketId, entry.messageId));
+        if (message === null) {
+            return null;
+        }
+        authoritative = message;
+    }
+    const derived = (await threadIndexEntriesFor(authoritative)).find((candidate) => candidate.key === entry.key && candidate.kind === entry.kind);
+    if (derived === undefined ||
+        derived.ticketId !== entry.ticketId ||
+        derived.messageId !== entry.messageId ||
+        derived.source !== entry.source) {
+        return null;
+    }
+    if (derived.kind !== "ticket_number" &&
+        nowEpoch - canonicalTimestamp(derived.issuedAt, "thread index issuedAt") >=
+            retentionMilliseconds) {
+        return null;
+    }
+    return ticketRecord.ticket;
+}
+async function lookupThreadEntry(records, index, kind, key, nowEpoch, retentionMilliseconds) {
+    const entry = await index.get({ partition: key, id: "thread" });
+    if (entry === null || entry.key !== key || entry.kind !== kind) {
+        return null;
+    }
+    const ticket = await confirmThreadEntry(records, entry, nowEpoch, retentionMilliseconds);
+    return ticket === null ? null : { ticket, entry };
+}
+function parseRetentionMilliseconds(value, field) {
+    if (typeof value !== "number") {
+        throw new TypeError(`${field} must be a number`);
+    }
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new TypeError(`${field} must be a positive safe integer`);
+    }
+    return value;
+}
+function parseThreadIndexWorkerOptions(options, field) {
+    const source = boundaryObject(options, field);
+    const store = ownDataProperty(source, "store", `${field}.store`);
+    const clock = ownDataProperty(source, "clock", `${field}.clock`);
+    const retentionMilliseconds = parseRetentionMilliseconds(ownDataProperty(source, "threadIndexRetentionMilliseconds", `${field}.threadIndexRetentionMilliseconds`), `${field}.threadIndexRetentionMilliseconds`);
+    const rawCursor = ownDataProperty(source, "cursor", `${field}.cursor`, true);
+    const rawLimit = ownDataProperty(source, "limit", `${field}.limit`, true);
+    if (rawCursor !== undefined && typeof rawCursor !== "string") {
+        throw new TypeError(`${field}.cursor must be a string`);
+    }
+    if (rawLimit !== undefined && typeof rawLimit !== "number") {
+        throw new TypeError(`${field}.limit must be between 1 and ${MAX_SCAN_PAGE_SIZE}`);
+    }
+    const limit = rawLimit ?? 100;
+    if (!Number.isSafeInteger(limit) ||
+        limit <= 0 ||
+        limit > MAX_SCAN_PAGE_SIZE) {
+        throw new TypeError(`${field}.limit must be between 1 and ${MAX_SCAN_PAGE_SIZE}`);
+    }
+    return {
+        store,
+        clock,
+        retentionMilliseconds,
+        ...(rawCursor === undefined ? {} : { cursor: rawCursor }),
+        limit,
+    };
+}
+/**
+ * Scan one page of authoritative `support-desk.records.v1` rows and insert
+ * every thread-index row they imply (ticket numbers, outbound `Message-ID`s,
+ * reply tokens, and inbound `Message-ID`s). Rows past retention are not
+ * recreated. Hosts persist `nextCursor` only after the whole page succeeds
+ * and repeat complete cycles.
+ */
+export async function repairThreadIndexPage(options) {
+    const { store, clock, retentionMilliseconds, cursor, limit } = parseThreadIndexWorkerOptions(options, "thread index repair options");
+    const records = store.collection(supportRecords);
+    const index = store.collection(threadIndex);
+    const page = await records.scan({
+        limit,
+        ...(cursor === undefined ? {} : { cursor }),
+    });
+    const nowEpoch = canonicalTimestamp(clock.now(), "clock.now()");
+    let indexed = 0;
+    let collisions = 0;
+    for (const entry of page.records) {
+        if (entry.key.partition !== entry.value.partition ||
+            entry.key.id !== entry.value.id) {
+            continue;
+        }
+        for (const candidate of await threadIndexEntriesFor(entry.value)) {
+            if (candidate.kind !== "ticket_number" &&
+                nowEpoch -
+                    canonicalTimestamp(candidate.issuedAt, "thread index issuedAt") >=
+                    retentionMilliseconds) {
+                continue;
+            }
+            const outcome = await putThreadIndexEntry(index, candidate);
+            if (outcome === "written") {
+                indexed += 1;
+            }
+            else if (outcome === "collision") {
+                collisions += 1;
+            }
+        }
+    }
+    return {
+        nextCursor: page.nextCursor,
+        physicalRows: page.records.length,
+        indexed,
+        collisions,
+    };
+}
+/**
+ * Scan one page of thread-index rows and conditionally delete every row whose
+ * authoritative target is gone, no longer derives it, or is past retention.
+ * Uses `deleteIfUnchanged` with the scanned version.
+ */
+export async function sweepThreadIndexPage(options) {
+    const { store, clock, retentionMilliseconds, cursor, limit } = parseThreadIndexWorkerOptions(options, "thread index sweep options");
+    const records = store.collection(supportRecords);
+    const index = store.collection(threadIndex);
+    const page = await index.scan({
+        limit,
+        ...(cursor === undefined ? {} : { cursor }),
+    });
+    const nowEpoch = canonicalTimestamp(clock.now(), "clock.now()");
+    let deleted = 0;
+    for (const entry of page.records) {
+        if (entry.key.partition !== entry.value.key || entry.key.id !== "thread") {
+            continue;
+        }
+        if ((await confirmThreadEntry(records, entry.value, nowEpoch, retentionMilliseconds)) !== null) {
+            continue;
+        }
+        if (await index.deleteIfUnchanged(entry.key, entry.version)) {
+            deleted += 1;
+        }
+    }
+    return {
+        nextCursor: page.nextCursor,
+        physicalRows: page.records.length,
+        deleted,
+    };
+}
+const maxInboundReferences = 100;
+const maxThreadingLookups = 20;
+const maxLoopSignalCharacters = 998;
+const maxInboundDisplayNameCharacters = 200;
+const maxSupportAddresses = 32;
+const subjectMarkerPrefixPattern = /^[A-Z][A-Z0-9]{0,15}$/;
+const inboundSuppressingPrecedence = new Set([
+    "bulk",
+    "junk",
+    "list",
+    "auto_reply",
+    "auto-reply",
+]);
+function collapseHeaderText(value) {
+    return value
+        .replace(/[\u0000-\u001F\u007F]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function normalizeInboundSubject(value, maximum) {
+    const collapsed = collapseHeaderText(value);
+    const text = collapsed.length === 0 ? "(no subject)" : collapsed;
+    const points = [...text];
+    return points.length > maximum
+        ? points.slice(0, maximum).join("").trimEnd()
+        : text;
+}
+function normalizeInboundBody(value) {
+    return value
+        .replace(/\r\n?/g, "\n")
+        .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "");
+}
+function normalizeInboundDisplayName(value) {
+    const collapsed = collapseHeaderText(value);
+    if (collapsed.length === 0) {
+        return undefined;
+    }
+    return [...collapsed].slice(0, maxInboundDisplayNameCharacters).join("");
+}
+function snapshotLoopSignals(input) {
+    if (input === undefined) {
+        return Object.freeze({});
+    }
+    const source = boundaryObject(input, "inbound email.loopSignals");
+    const signals = {};
+    for (const key of [
+        "autoSubmitted",
+        "precedence",
+        "autoResponseSuppress",
+        "listId",
+        "contentType",
+        "envelopeSender",
+    ]) {
+        const value = ownDataProperty(source, key, `inbound email.loopSignals.${key}`, true);
+        if (value === undefined) {
+            continue;
+        }
+        if (typeof value !== "string") {
+            throw new TypeError(`inbound email.loopSignals.${key} must be a string`);
+        }
+        signals[key] = value.slice(0, maxLoopSignalCharacters);
+    }
+    const autoReply = ownDataProperty(source, "autoReplyHeaderPresent", "inbound email.loopSignals.autoReplyHeaderPresent", true);
+    if (autoReply !== undefined) {
+        if (typeof autoReply !== "boolean") {
+            throw new TypeError("inbound email.loopSignals.autoReplyHeaderPresent must be a boolean");
+        }
+        signals.autoReplyHeaderPresent = autoReply;
+    }
+    return Object.freeze(signals);
+}
+function snapshotInboundSenderAuthentication(input) {
+    if (input === undefined) {
+        return undefined;
+    }
+    const field = "inbound email.senderAuthentication";
+    const source = boundaryObject(input, field);
+    const method = ownDataProperty(source, "method", `${field}.method`);
+    if (method !== "dmarc" && method !== "host_identity") {
+        throw new TypeError(`${field}.method must be dmarc or host_identity`);
+    }
+    const result = ownDataProperty(source, "result", `${field}.result`);
+    if (result !== "pass" && result !== "fail") {
+        throw new TypeError(`${field}.result must be pass or fail`);
+    }
+    const email = normalizeRequesterEmail(boundaryString(ownDataProperty(source, "email", `${field}.email`), `${field}.email`), `${field}.email`);
+    if (method === "host_identity") {
+        for (const key of ["dkimAligned", "spfAligned"]) {
+            ownDataProperty(source, key, `${field}.${key}`, true, true);
+            if (Object.hasOwn(source, key)) {
+                throw new TypeError(`${field}.${key} is not valid when method is host_identity`);
+            }
+        }
+        return Object.freeze({ method, result, email });
+    }
+    const dkimAligned = ownDataProperty(source, "dkimAligned", `${field}.dkimAligned`);
+    if (typeof dkimAligned !== "boolean") {
+        throw new TypeError(`${field}.dkimAligned must be a boolean`);
+    }
+    const spfAligned = ownDataProperty(source, "spfAligned", `${field}.spfAligned`);
+    if (typeof spfAligned !== "boolean") {
+        throw new TypeError(`${field}.spfAligned must be a boolean`);
+    }
+    return Object.freeze({
+        method,
+        result,
+        email,
+        dkimAligned,
+        spfAligned,
+    });
+}
+function snapshotInboundEmailInput(input, limits) {
+    const source = boundaryObject(input, "inbound email");
+    const field = (key) => `inbound email.${key}`;
+    const readString = (key) => boundaryString(ownDataProperty(source, key, field(key)), field(key));
+    const readIdentifier = (key) => {
+        const value = readString(key);
+        requireIdentifier(value, field(key));
+        return value;
+    };
+    const readOptional = (key) => ownDataProperty(source, key, field(key), true);
+    const channelId = readIdentifier("channelId");
+    const providerEventId = readIdentifier("providerEventId");
+    const ticketId = readIdentifier("ticketId");
+    const messageId = readIdentifier("messageId");
+    const correlationId = readIdentifier("correlationId");
+    const from = normalizeRequesterEmail(readString("from"), field("from"));
+    const rawSenderAuthentication = ownDataProperty(source, "senderAuthentication", field("senderAuthentication"), true, true);
+    const senderAuthentication = snapshotInboundSenderAuthentication(rawSenderAuthentication);
+    const rawName = readOptional("fromName");
+    const fromName = rawName === undefined
+        ? undefined
+        : normalizeInboundDisplayName(boundaryString(rawName, field("fromName")));
+    const subject = normalizeInboundSubject(readString("subject"), limits.maxSubjectCharacters);
+    const body = normalizeInboundBody(readString("body"));
+    enforceLimit(body, "body", limits.maxMessageCharacters);
+    const rawFormat = readOptional("format");
+    if (rawFormat !== undefined &&
+        rawFormat !== "plain_text" &&
+        rawFormat !== "markdown") {
+        throw new TypeError(`${field("format")} must be plain_text or markdown`);
+    }
+    const format = rawFormat ?? "plain_text";
+    const externalMessageId = normalizeInboundMessageId(readOptional("externalMessageId"));
+    const inReplyTo = normalizeInboundMessageId(readOptional("inReplyTo"));
+    const rawReferences = readOptional("references");
+    const references = [];
+    if (rawReferences !== undefined) {
+        if (!Array.isArray(rawReferences)) {
+            throw new TypeError(`${field("references")} must be an array`);
+        }
+        const start = Math.max(0, rawReferences.length - maxInboundReferences);
+        for (let position = start; position < rawReferences.length; position += 1) {
+            const normalized = normalizeInboundMessageId(ownDataProperty(rawReferences, position, `${field("references")}[${position}]`));
+            if (normalized !== undefined && !references.includes(normalized)) {
+                references.push(normalized);
+            }
+        }
+    }
+    const rawToken = readOptional("replyRoutingToken");
+    if (rawToken !== undefined && typeof rawToken !== "string") {
+        throw new TypeError(`${field("replyRoutingToken")} must be a string`);
+    }
+    const token = rawToken?.trim();
+    const replyRoutingToken = token !== undefined && replyRoutingTokenPattern.test(token)
+        ? token
+        : undefined;
+    const loopSignals = snapshotLoopSignals(readOptional("loopSignals"));
+    return Object.freeze({
+        channelId,
+        providerEventId,
+        ticketId,
+        messageId,
+        correlationId,
+        from,
+        ...(senderAuthentication === undefined ? {} : { senderAuthentication }),
+        ...(fromName === undefined ? {} : { fromName }),
+        subject,
+        body,
+        format,
+        ...(externalMessageId === undefined ? {} : { externalMessageId }),
+        ...(inReplyTo === undefined ? {} : { inReplyTo }),
+        references: Object.freeze(references),
+        ...(replyRoutingToken === undefined ? {} : { replyRoutingToken }),
+        loopSignals,
+    });
+}
+/** Content fingerprint for one provider event; excludes host-minted IDs. */
+function inboundFingerprintPayload(input, format = "current") {
+    const canonicalSender = format === "current";
+    const includeSenderResult = format !== "pre_sender_result";
+    return {
+        type: "inbound_email",
+        channelId: input.channelId,
+        providerEventId: input.providerEventId,
+        from: canonicalSender ? input.from.toLowerCase() : input.from,
+        ...(!includeSenderResult || input.senderAuthentication === undefined
+            ? {}
+            : {
+                senderAuthentication: canonicalSender
+                    ? {
+                        ...input.senderAuthentication,
+                        email: input.senderAuthentication.email.toLowerCase(),
+                    }
+                    : input.senderAuthentication,
+            }),
+        fromName: input.fromName ?? null,
+        subject: input.subject,
+        body: input.body,
+        format: input.format,
+        externalMessageId: input.externalMessageId ?? null,
+        inReplyTo: input.inReplyTo ?? null,
+        references: input.references,
+        replyRoutingToken: input.replyRoutingToken ?? null,
+        loopSignals: input.loopSignals,
+    };
+}
+function inboundSuppressionReason(input, supportAddresses) {
+    const signals = input.loopSignals;
+    const autoSubmitted = signals.autoSubmitted
+        ?.split(";")[0]
+        ?.trim()
+        .toLowerCase();
+    if (autoSubmitted !== undefined &&
+        autoSubmitted.length > 0 &&
+        autoSubmitted !== "no") {
+        return "auto_submitted";
+    }
+    const precedence = signals.precedence?.trim().toLowerCase();
+    if (precedence !== undefined &&
+        inboundSuppressingPrecedence.has(precedence)) {
+        return "precedence";
+    }
+    if (signals.autoReplyHeaderPresent === true) {
+        return "auto_reply_header";
+    }
+    if (signals.envelopeSender !== undefined) {
+        const envelope = signals.envelopeSender.trim();
+        if (envelope.length === 0 || envelope === "<>") {
+            return "bounce";
+        }
+    }
+    const localPart = input.from.slice(0, input.from.indexOf("@")).toLowerCase();
+    if (localPart === "mailer-daemon") {
+        return "bounce";
+    }
+    const contentType = signals.contentType?.trim().toLowerCase();
+    if (contentType !== undefined &&
+        (contentType.startsWith("multipart/report") ||
+            contentType.startsWith("message/delivery-status") ||
+            contentType.startsWith("message/disposition-notification"))) {
+        return "delivery_report";
+    }
+    if (supportAddresses.has(input.from.toLowerCase())) {
+        return "support_address_loop";
+    }
+    return undefined;
+}
+function inboundSenderAcknowledgementAllowed(input) {
+    const suppress = (input.loopSignals.autoResponseSuppress ?? "")
+        .split(",")
+        .map((value) => value.trim().toLowerCase());
+    if (suppress.some((value) => value === "all" || value === "oof" || value === "autoreply")) {
+        return false;
+    }
+    return (input.loopSignals.listId ?? "").trim().length === 0;
+}
+function subjectMarkerNumbers(subject, prefix) {
+    const pattern = new RegExp(`\\[${prefix}-([1-9][0-9]{0,15})\\]`, "g");
+    const found = [];
+    for (const match of subject.matchAll(pattern)) {
+        const value = Number(match[1]);
+        if (Number.isSafeInteger(value) && !found.includes(value)) {
+            found.push(value);
+        }
+    }
+    return found;
+}
+function threadingHeaderCandidates(input) {
+    const ordered = [
+        ...(input.inReplyTo === undefined ? [] : [input.inReplyTo]),
+        ...[...input.references].reverse(),
+    ];
+    const unique = [];
+    for (const candidate of ordered) {
+        if (candidate !== input.externalMessageId && !unique.includes(candidate)) {
+            unique.push(candidate);
+        }
+        if (unique.length >= maxThreadingLookups) {
+            break;
+        }
+    }
+    return unique;
+}
+function sameAddress(left, right) {
+    return left.toLowerCase() === right.toLowerCase();
+}
+/**
+ * A thread match with a recorded requester address requires both exact
+ * case-insensitive address equality and a passing host-evaluated sender result
+ * bound to that normalized address. Without a recorded address, only an
+ * opaque routing token can join; a `Message-ID` or subject marker alone is
+ * never enough.
+ */
+function threadJoinIsSafe(ticket, method, input) {
+    const email = ticket.requester.email;
+    if (email === undefined) {
+        return method === "routing_token";
+    }
+    const authentication = input.senderAuthentication;
+    if (authentication === undefined ||
+        authentication.result !== "pass" ||
+        !sameAddress(email, input.from) ||
+        !sameAddress(authentication.email, input.from)) {
+        return false;
+    }
+    return (authentication.method === "host_identity" ||
+        authentication.dkimAligned ||
+        authentication.spfAligned);
+}
+function snapshotSenderMatch(value) {
+    const source = boundaryObject(value, "account matcher result");
+    const matches = ownDataProperty(source, "matches", "account matcher result.matches");
+    if (matches === "none" || matches === "many") {
+        return Object.freeze({ matches });
+    }
+    if (matches === "one") {
+        const principalId = boundaryString(ownDataProperty(source, "principalId", "account matcher result.principalId"), "account matcher result.principalId");
+        requireIdentifier(principalId, "account matcher result.principalId");
+        return Object.freeze({ matches, principalId });
+    }
+    throw new TypeError("account matcher result.matches must be none, one, or many");
+}
+function snapshotRoutingDecision(value, allowedCategories) {
+    const source = boundaryObject(value, "inbound routing decision");
+    const priority = ownDataProperty(source, "priority", "inbound routing decision.priority");
+    if (priority !== "low" && priority !== "normal" && priority !== "high") {
+        throw new TypeError("inbound routing decision.priority must be low, normal, or high; inbound mail is never automatically urgent");
+    }
+    const category = snapshotCategory(ownDataProperty(source, "category", "inbound routing decision.category", true), "inbound routing decision.category");
+    if (category !== undefined &&
+        (allowedCategories === undefined || !allowedCategories.has(category))) {
+        throw new TypeError("inbound routing decision.category is not configured for this Support Desk instance");
+    }
+    return Object.freeze({
+        priority,
+        ...(category === undefined ? {} : { category }),
+    });
+}
+function inboundAuditAction(input) {
+    return supportAudit.action({
+        id: input.commandId,
+        occurredAt: input.occurredAt,
+        actor: { kind: "system", systemId: inboundEmailSystemActorId },
+        action: input.action,
+        subject: input.ticketId,
+        sequence: input.revision,
+        details: {
+            commandId: input.commandId,
+            correlationId: input.correlationId,
+            channel: "email",
+            matchMethod: input.matchMethod,
+            ...(input.association === undefined
+                ? {}
+                : { association: input.association }),
+        },
+    });
+}
+function inboundMessage(input, ticketId, messageId, now) {
+    // No authorPrincipalId: a sender address never authenticates authorship.
+    return {
+        id: messageId,
+        ticketId,
+        authorKind: "customer",
+        channel: "email",
+        visibility: "customer",
+        format: input.format,
+        body: input.body,
+        createdAt: now,
+        ...(input.externalMessageId === undefined
+            ? {}
+            : { externalMessageId: input.externalMessageId }),
+        ...(input.inReplyTo === undefined
+            ? {}
+            : { inReplyToExternalMessageId: input.inReplyTo }),
+    };
+}
+function inboundResult(receipt, duplicateDelivery) {
+    const route = receipt.route;
+    return Object.freeze({
+        duplicateDelivery,
+        outcome: receipt.outcome ?? "rejected",
+        ...(receipt.ticketId === undefined ? {} : { ticketId: receipt.ticketId }),
+        ...(receipt.messageId === undefined
+            ? {}
+            : { messageId: receipt.messageId }),
+        ...(route?.kind === "reply" || route?.kind === "new_conversation"
+            ? { matchMethod: route.matchMethod }
+            : {}),
+        ...(route?.kind === "new_conversation"
+            ? {
+                association: route.association,
+                ...(route.relatedTicketId === undefined
+                    ? {}
+                    : { relatedTicketId: route.relatedTicketId }),
+            }
+            : {}),
+        ...(receipt.diagnostic === undefined ? {} : { reason: receipt.diagnostic }),
+    });
+}
+function parseSupportAddresses(input) {
+    const field = "inbound mail processor options.supportAddresses";
+    if (input === undefined) {
+        return new Set();
+    }
+    if (!Array.isArray(input)) {
+        throw new TypeError(`${field} must be an array`);
+    }
+    if (input.length > maxSupportAddresses) {
+        throw new TypeError(`${field} may contain at most ${maxSupportAddresses} values`);
+    }
+    const addresses = new Set();
+    for (let position = 0; position < input.length; position += 1) {
+        const entry = `${field}[${position}]`;
+        const value = normalizeRequesterEmail(boundaryString(ownDataProperty(input, position, entry), entry), entry);
+        addresses.add(value.toLowerCase());
+    }
+    return addresses;
+}
+/**
+ * Create the inbound mail processor a host's mail worker calls after it has
+ * verified provider authenticity and normalized bounded MIME content.
+ *
+ * Processing order: reserve the provider-event receipt with `insertIfAbsent`
+ * before any ticket work; suppress bounce and auto-reply loops; persist one
+ * routing decision on the receipt (routing token, then `In-Reply-To` /
+ * `References`, then subject marker, each confirmed against authoritative
+ * records); then create or reply in one ticket-partition transaction with
+ * its Audit event, command receipt, and optional notification; finally mark
+ * the receipt terminal and refresh the queue and threading projections.
+ */
+export function createInboundMailProcessor(options) {
+    const field = "inbound mail processor options";
+    const source = boundaryObject(options, field);
+    const read = (key, optional = false) => ownDataProperty(source, key, `${field}.${key}`, optional);
+    const store = read("store");
+    const clock = read("clock");
+    const rawLogger = read("logger", true);
+    const logger = rawLogger === undefined ? noopLogger : rawLogger;
+    const accountMatcher = read("accountMatcher");
+    const routingPolicy = read("routingPolicy");
+    const notificationPolicy = read("notificationPolicy", true);
+    if (accountMatcher === undefined ||
+        accountMatcher === null ||
+        typeof accountMatcher.matchSenderEmail !== "function") {
+        throw new TypeError(`${field}.accountMatcher must provide matchSenderEmail()`);
+    }
+    if (routingPolicy === undefined ||
+        routingPolicy === null ||
+        typeof routingPolicy.routeNewConversation !== "function") {
+        throw new TypeError(`${field}.routingPolicy must provide routeNewConversation()`);
+    }
+    if (notificationPolicy !== undefined &&
+        (notificationPolicy === null ||
+            typeof notificationPolicy.notificationFor !== "function")) {
+        throw new TypeError(`${field}.notificationPolicy must provide notificationFor()`);
+    }
+    const limits = resolveSupportDeskLimits(read("limits", true), `${field}.limits`);
+    const rawAttempts = read("maxConflictAttempts", true);
+    if (rawAttempts !== undefined && typeof rawAttempts !== "number") {
+        throw new TypeError("maxConflictAttempts must be between 1 and 20");
+    }
+    const maxConflictAttempts = rawAttempts ?? 4;
+    if (!Number.isSafeInteger(maxConflictAttempts) ||
+        maxConflictAttempts <= 0 ||
+        maxConflictAttempts > 20) {
+        throw new TypeError("maxConflictAttempts must be between 1 and 20");
+    }
+    const rawTerminalRetention = read("queueTerminalRetentionMilliseconds", true);
+    if (rawTerminalRetention !== undefined &&
+        typeof rawTerminalRetention !== "number") {
+        throw new TypeError("queueTerminalRetentionMilliseconds must be a non-negative safe integer");
+    }
+    const terminalRetentionMilliseconds = rawTerminalRetention ??
+        defaultQueueTerminalRetentionMilliseconds;
+    if (!Number.isSafeInteger(terminalRetentionMilliseconds) ||
+        terminalRetentionMilliseconds < 0) {
+        throw new TypeError("queueTerminalRetentionMilliseconds must be a non-negative safe integer");
+    }
+    const rawThreadRetention = read("threadIndexRetentionMilliseconds", true);
+    const threadIndexRetentionMilliseconds = rawThreadRetention === undefined
+        ? defaultThreadIndexRetentionMilliseconds
+        : parseRetentionMilliseconds(rawThreadRetention, `${field}.threadIndexRetentionMilliseconds`);
+    const responseTargetPolicy = parseResponseTargetPolicy(read("responseTargetPolicy", true));
+    const allowedCategories = parseAllowedCategories(read("allowedCategories", true), `${field}.allowedCategories`);
+    const rawPrefix = read("subjectMarkerPrefix", true);
+    if (rawPrefix !== undefined &&
+        (typeof rawPrefix !== "string" ||
+            !subjectMarkerPrefixPattern.test(rawPrefix))) {
+        throw new TypeError(`${field}.subjectMarkerPrefix must match ${subjectMarkerPrefixPattern.source}`);
+    }
+    const subjectMarkerPrefix = rawPrefix;
+    const supportAddresses = parseSupportAddresses(read("supportAddresses", true));
+    const records = store.collection(supportRecords);
+    const receipts = store.collection(inboundReceipts);
+    const numbers = store.collection(ticketNumbers);
+    const index = store.collection(threadIndex);
+    async function bindInboundReplayFingerprint(key, stored, input, replayFingerprint) {
+        if (stored.replayFingerprint !== undefined) {
+            if (stored.replayFingerprint !== replayFingerprint) {
+                throw new SupportDeskConflictError("An inbound provider event ID was reused for different content");
+            }
+            return stored;
+        }
+        const compatibleFingerprints = new Set([replayFingerprint]);
+        if (!compatibleFingerprints.has(stored.payloadFingerprint)) {
+            const priorFingerprints = await Promise.all([
+                requestFingerprint(inboundFingerprintPayload(input, "case_preserving_sender")),
+                requestFingerprint(inboundFingerprintPayload(input, "pre_sender_result")),
+            ]);
+            for (const prior of priorFingerprints) {
+                compatibleFingerprints.add(prior);
+            }
+        }
+        if (!compatibleFingerprints.has(stored.payloadFingerprint)) {
+            throw new SupportDeskConflictError("An inbound provider event ID was reused for different content");
+        }
+        const bound = await receipts.update(key, (current) => {
+            if (current === null) {
+                throw new SupportDeskConflictError("Inbound receipt disappeared before replay binding");
+            }
+            if (current.replayFingerprint !== undefined) {
+                return { action: "keep" };
+            }
+            if (!compatibleFingerprints.has(current.payloadFingerprint)) {
+                return { action: "keep" };
+            }
+            return {
+                action: "write",
+                value: { ...current, replayFingerprint },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        if (bound.value === null) {
+            throw new SupportDeskConflictError("Inbound receipt disappeared before replay binding");
+        }
+        if (bound.value.replayFingerprint !== replayFingerprint ||
+            !compatibleFingerprints.has(bound.value.payloadFingerprint)) {
+            throw new SupportDeskConflictError("An inbound provider event ID was reused for different content");
+        }
+        return bound.value;
+    }
+    async function finishReceipt(work, terminal) {
+        const processedAt = clock.now();
+        canonicalTimestamp(processedAt, "clock.now()");
+        const result = await receipts.update(work.key, (current) => {
+            if (current === null) {
+                throw new SupportDeskConflictError("Inbound receipt disappeared before it was finalized");
+            }
+            if (current.status !== "processing" && current.status !== "rerouting") {
+                return { action: "keep" };
+            }
+            if (!sameInboundReceiptRoute(current.route, work.route)) {
+                throw new SupportDeskConflictError("Inbound route changed before the receipt was finalized");
+            }
+            return {
+                action: "write",
+                value: {
+                    ...current,
+                    status: terminal.status,
+                    outcome: terminal.outcome,
+                    processedAt,
+                    ...(terminal.ticketId === undefined
+                        ? {}
+                        : { ticketId: terminal.ticketId }),
+                    ...(terminal.messageId === undefined
+                        ? {}
+                        : { messageId: terminal.messageId }),
+                    ...(terminal.diagnostic === undefined
+                        ? {}
+                        : { diagnostic: terminal.diagnostic }),
+                },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        if (result.value === null) {
+            throw new SupportDeskConflictError("Inbound receipt disappeared before it was finalized");
+        }
+        return inboundResult(result.value, work.duplicateDelivery);
+    }
+    async function afterInboundCommit(ticketId, messageId, ticketNumber) {
+        try {
+            await projectTicketToQueue(ticketId, {
+                store,
+                clock,
+                terminalRetentionMilliseconds,
+                maxConflictAttempts,
+            });
+        }
+        catch (error) {
+            safeLog(logger, "error", "support-desk.queue.projection_failed", {
+                ticketId,
+                message: error instanceof Error ? error.message : "queue projection failed",
+            });
+        }
+        await indexThreadingAfterCommit(store, ticketId, { messageId, ticketNumber }, logger);
+    }
+    async function inboundNotification(context) {
+        if (notificationPolicy === undefined) {
+            return undefined;
+        }
+        const proposed = await notificationPolicy.notificationFor(Object.freeze({ ...context }));
+        if (proposed === undefined) {
+            return undefined;
+        }
+        return bindNotificationTicketNumber(snapshotNotification(proposed), context.ticketNumber);
+    }
+    async function proposeNewConversation(input, reservedTicketId, matchMethod, relatedTicketId, forceUnverified = false) {
+        const match = relatedTicketId === undefined && !forceUnverified
+            ? snapshotSenderMatch(await accountMatcher.matchSenderEmail(Object.freeze({ channelId: input.channelId, email: input.from })))
+            : { matches: "none" };
+        const association = match.matches === "one" ? "matched_email" : "unverified";
+        const decision = snapshotRoutingDecision(await routingPolicy.routeNewConversation(Object.freeze({
+            channelId: input.channelId,
+            association,
+            ...(match.matches === "one"
+                ? { principalId: match.principalId }
+                : {}),
+            ...(relatedTicketId === undefined ? {} : { relatedTicketId }),
+        })), allowedCategories);
+        return {
+            kind: "new_conversation",
+            ticketId: reservedTicketId,
+            matchMethod,
+            association,
+            ...(match.matches === "one" ? { principalId: match.principalId } : {}),
+            priority: decision.priority,
+            ...(decision.category === undefined
+                ? {}
+                : { category: decision.category }),
+            ...(relatedTicketId === undefined ? {} : { relatedTicketId }),
+        };
+    }
+    async function claimRouteForRerouting(key, expected) {
+        const claimed = await receipts.update(key, (current) => {
+            if (current === null) {
+                throw new SupportDeskConflictError("Inbound receipt disappeared before routing");
+            }
+            if (current.status !== "processing" ||
+                !sameInboundReceiptRoute(current.route, expected)) {
+                return { action: "keep" };
+            }
+            return {
+                action: "write",
+                value: { ...current, status: "rerouting" },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        if (claimed.value === null) {
+            throw new SupportDeskConflictError("Inbound receipt disappeared before routing");
+        }
+        return claimed.value;
+    }
+    async function replaceReroutingRoute(key, expected, proposed) {
+        const replaced = await receipts.update(key, (current) => {
+            if (current === null) {
+                throw new SupportDeskConflictError("Inbound receipt disappeared before routing");
+            }
+            if (current.status !== "rerouting" ||
+                !sameInboundReceiptRoute(current.route, expected)) {
+                return { action: "keep" };
+            }
+            return { action: "write", value: { ...current, route: proposed } };
+        }, { maxAttempts: maxConflictAttempts });
+        if (replaced.value === null) {
+            throw new SupportDeskConflictError("Inbound receipt disappeared before routing");
+        }
+        return replaced.value;
+    }
+    async function reserveReplyRerouteFence(input) {
+        const location = commandKey(input.ticketId, input.commandId);
+        for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+            const existing = await records.get(location);
+            if (inboundReplyRerouteFenceMatches(existing, input.commandId, input.messageId, input.fingerprint)) {
+                return true;
+            }
+            if (existing !== null) {
+                return false;
+            }
+            const ticket = await records.getVersioned(ticketKey(input.ticketId));
+            if (ticket?.value.kind !== "ticket") {
+                return false;
+            }
+            const quota = await records.getVersioned(ticketQuotaKey(input.ticketId));
+            if (quota?.value.kind !== "ticket_quota") {
+                throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+            }
+            const partitionRows = await records.list(input.ticketId);
+            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 1);
+            enforceManagedAdmission(ticket.value.ticket, partitionRows, limits, 1);
+            const outcome = await records.transact(input.ticketId, [
+                {
+                    action: "putIfUnchanged",
+                    version: ticket.version,
+                    value: ticket.value,
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: quota.version,
+                    value: quota.value,
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "inbound_reply_reroute_fence",
+                        partition: input.ticketId,
+                        id: location.id,
+                        commandId: input.commandId,
+                        messageId: input.messageId,
+                        requestFingerprint: input.fingerprint,
+                        recordedAt: input.recordedAt,
+                    },
+                },
+            ]);
+            if (outcome.committed) {
+                return true;
+            }
+        }
+        const existing = await records.get(location);
+        if (inboundReplyRerouteFenceMatches(existing, input.commandId, input.messageId, input.fingerprint)) {
+            return true;
+        }
+        if (existing !== null) {
+            return false;
+        }
+        throw new SupportDeskConflictError("Concurrent ticket updates exhausted retries; the provider may retry the same event. The inbound receipt remains processing and is safe to resume.");
+    }
+    async function reserveCreateRerouteFence(input) {
+        const location = commandKey(input.ticketId, input.commandId);
+        const existing = await records.get(location);
+        if (inboundCreateRerouteFenceMatches(existing, input.commandId, input.messageId, input.fingerprint)) {
+            return true;
+        }
+        if (existing !== null ||
+            (await records.get(ticketKey(input.ticketId))) !== null) {
+            return false;
+        }
+        enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, 1);
+        const inserted = await records.insertIfAbsent({
+            kind: "inbound_create_reroute_fence",
+            partition: input.ticketId,
+            id: location.id,
+            commandId: input.commandId,
+            messageId: input.messageId,
+            requestFingerprint: input.fingerprint,
+            recordedAt: input.recordedAt,
+        });
+        return (inserted.inserted ||
+            inboundCreateRerouteFenceMatches(inserted.value, input.commandId, input.messageId, input.fingerprint));
+    }
+    async function proposeRoute(input, reservedTicketId) {
+        const reason = inboundSuppressionReason(input, supportAddresses);
+        if (reason !== undefined) {
+            return { kind: "suppressed", reason };
+        }
+        const nowEpoch = canonicalTimestamp(clock.now(), "clock.now()");
+        const lookup = (kind, key) => lookupThreadEntry(records, index, kind, key, nowEpoch, threadIndexRetentionMilliseconds);
+        // The same Message-ID delivered under another provider event is the same
+        // message only when the sender satisfies the existing-ticket join rule.
+        let repeatedMessageTicket;
+        if (input.externalMessageId !== undefined) {
+            const own = await lookup("message_id", await messageIdIndexKey(input.externalMessageId));
+            if (own !== null &&
+                own.entry.source === "inbound" &&
+                own.entry.messageId !== undefined) {
+                if (threadJoinIsSafe(own.ticket, "message_id", input)) {
+                    return {
+                        kind: "duplicate_message",
+                        ticketId: own.ticket.id,
+                        messageId: own.entry.messageId,
+                    };
+                }
+                repeatedMessageTicket = own.ticket;
+            }
+        }
+        let candidate;
+        let ambiguous = false;
+        if (input.replyRoutingToken !== undefined) {
+            const hit = await lookup("reply_token", await replyTokenIndexKey(input.replyRoutingToken));
+            if (hit !== null) {
+                candidate = { ticket: hit.ticket, method: "routing_token" };
+            }
+        }
+        if (candidate === undefined) {
+            const found = [];
+            for (const header of threadingHeaderCandidates(input)) {
+                const hit = await lookup("message_id", await messageIdIndexKey(header));
+                if (hit !== null &&
+                    !found.some((ticket) => ticket.id === hit.ticket.id)) {
+                    found.push(hit.ticket);
+                }
+            }
+            const first = found[0];
+            if (first !== undefined) {
+                candidate = { ticket: first, method: "message_id" };
+                ambiguous = found.length > 1;
+            }
+        }
+        // Keep a repeated inbound Message-ID ahead of the display-only subject
+        // marker when a stronger token or threading-header locator did not match.
+        if (candidate === undefined && repeatedMessageTicket !== undefined) {
+            candidate = {
+                ticket: repeatedMessageTicket,
+                method: "message_id",
+            };
+        }
+        if (candidate === undefined && subjectMarkerPrefix !== undefined) {
+            const markers = subjectMarkerNumbers(input.subject, subjectMarkerPrefix);
+            ambiguous = markers.length > 1;
+            for (const marker of markers) {
+                const hit = await lookup("ticket_number", ticketNumberIndexKey(marker));
+                if (hit !== null && candidate === undefined) {
+                    candidate = { ticket: hit.ticket, method: "subject_marker" };
+                }
+            }
+        }
+        if (candidate !== undefined &&
+            !ambiguous &&
+            candidate.ticket.id !== reservedTicketId &&
+            threadJoinIsSafe(candidate.ticket, candidate.method, input)) {
+            return {
+                kind: "reply",
+                ticketId: candidate.ticket.id,
+                matchMethod: candidate.method,
+            };
+        }
+        const relatedTicketId = candidate !== undefined && candidate.ticket.id !== reservedTicketId
+            ? candidate.ticket.id
+            : undefined;
+        return proposeNewConversation(input, reservedTicketId, candidate?.method ?? "none", relatedTicketId, ambiguous);
+    }
+    async function decideRoute(key, stored, input, reservedTicketId, commandId, messageId, fingerprint) {
+        if (stored.status !== "processing" && stored.status !== "rerouting") {
+            return stored;
+        }
+        if (stored.route !== undefined) {
+            const route = stored.route;
+            if (route.kind === "suppressed") {
+                return stored;
+            }
+            if (route.kind === "duplicate_message") {
+                const target = await records.get(ticketKey(route.ticketId));
+                if (target?.kind === "ticket" &&
+                    threadJoinIsSafe(target.ticket, "message_id", input)) {
+                    return stored;
+                }
+                if (stored.status === "processing") {
+                    return decideRoute(key, await claimRouteForRerouting(key, route), input, reservedTicketId, commandId, messageId, fingerprint);
+                }
+                return replaceReroutingRoute(key, route, await proposeNewConversation(input, reservedTicketId, "message_id", route.ticketId, true));
+            }
+            if (route.kind === "new_conversation") {
+                if (route.relatedTicketId === undefined ||
+                    (route.association === "unverified" &&
+                        route.principalId === undefined)) {
+                    return stored;
+                }
+                const existing = await records.get(commandKey(route.ticketId, commandId));
+                const alreadyFenced = inboundCreateRerouteFenceMatches(existing, commandId, messageId, fingerprint);
+                // A committed create remains authoritative for receipt replay.
+                if (existing !== null && !alreadyFenced) {
+                    return stored;
+                }
+                if (stored.status === "processing") {
+                    return decideRoute(key, await claimRouteForRerouting(key, route), input, reservedTicketId, commandId, messageId, fingerprint);
+                }
+                if (!alreadyFenced &&
+                    !(await reserveCreateRerouteFence({
+                        ticketId: route.ticketId,
+                        commandId,
+                        messageId,
+                        fingerprint,
+                        recordedAt: stored.receivedAt,
+                    }))) {
+                    return stored;
+                }
+                return replaceReroutingRoute(key, route, await proposeNewConversation(input, reservedTicketId, route.matchMethod, route.relatedTicketId, true));
+            }
+            const commandLocation = commandKey(route.ticketId, commandId);
+            const existing = await records.get(commandLocation);
+            const alreadyFenced = inboundReplyRerouteFenceMatches(existing, commandId, messageId, fingerprint);
+            if (existing !== null && !alreadyFenced) {
+                return stored;
+            }
+            const target = await records.get(ticketKey(route.ticketId));
+            if (!alreadyFenced &&
+                (target?.kind !== "ticket" ||
+                    threadJoinIsSafe(target.ticket, route.matchMethod, input))) {
+                return stored;
+            }
+            if (stored.status === "processing") {
+                return decideRoute(key, await claimRouteForRerouting(key, route), input, reservedTicketId, commandId, messageId, fingerprint);
+            }
+            if (!alreadyFenced) {
+                const fenced = await reserveReplyRerouteFence({
+                    ticketId: route.ticketId,
+                    commandId,
+                    messageId,
+                    fingerprint,
+                    recordedAt: stored.receivedAt,
+                });
+                if (!fenced) {
+                    return stored;
+                }
+            }
+            return replaceReroutingRoute(key, route, await proposeNewConversation(input, reservedTicketId, route.matchMethod, route.ticketId, true));
+        }
+        const proposed = await proposeRoute(input, reservedTicketId);
+        const result = await receipts.update(key, (current) => {
+            if (current === null) {
+                throw new SupportDeskConflictError("Inbound receipt disappeared before routing");
+            }
+            if (current.status !== "processing" || current.route !== undefined) {
+                return { action: "keep" };
+            }
+            return { action: "write", value: { ...current, route: proposed } };
+        }, { maxAttempts: maxConflictAttempts });
+        if (result.value === null ||
+            ((result.value.status === "processing" ||
+                result.value.status === "rerouting") &&
+                result.value.route === undefined)) {
+            throw new SupportDeskConflictError("Inbound routing decision was not stored");
+        }
+        return result.value;
+    }
+    async function createConversation(work, route) {
+        const { input, messageId, commandId, fingerprint } = work;
+        const ticketId = route.ticketId;
+        const commandLocation = commandKey(ticketId, commandId);
+        const existingVersioned = await records.getVersioned(commandLocation);
+        const existing = existingVersioned?.value ?? null;
+        const createFence = existingVersioned !== null &&
+            inboundCreateRerouteFenceMatches(existingVersioned.value, commandId, messageId, fingerprint)
+            ? existingVersioned
+            : null;
+        if (existing !== null && createFence === null) {
+            if (!duplicateMatches(existing, "inbound_email_create", messageId, fingerprint)) {
+                throw new SupportDeskConflictError("An inbound ticket command ID was reused for different content");
+            }
+        }
+        else {
+            // ticket, quota, message, audit, command, and an optional delivery job.
+            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, 6);
+            // Reserved outside the ticket transaction; a failed create leaves a gap.
+            const ticketNumber = await reserveNextTicketNumber(numbers, maxConflictAttempts);
+            const now = clock.now();
+            const displayName = input.fromName === undefined ? {} : { displayName: input.fromName };
+            const ticket = await applyResponseTargets(createTicket({
+                id: ticketId,
+                number: ticketNumber,
+                subject: input.subject,
+                channel: "email",
+                priority: route.priority,
+                ...(route.category === undefined ? {} : { category: route.category }),
+                requester: route.association === "matched_email"
+                    ? {
+                        association: "matched_email",
+                        principalId: route.principalId,
+                        email: input.from,
+                        ...displayName,
+                    }
+                    : {
+                        association: "unverified",
+                        email: input.from,
+                        ...displayName,
+                    },
+                createdAt: now,
+                ...(route.relatedTicketId === undefined
+                    ? {}
+                    : { relatedTicketId: route.relatedTicketId }),
+            }), responseTargetPolicy, "created");
+            const notification = await inboundNotification({
+                outcome: "created",
+                channelId: input.channelId,
+                ticketId,
+                ticketNumber,
+                messageId,
+                association: route.association,
+                matchMethod: route.matchMethod,
+                senderAcknowledgementAllowed: inboundSenderAcknowledgementAllowed(input),
+            });
+            const notificationContent = deliveryContent(notification);
+            const commandRecord = {
+                kind: "command",
+                partition: ticketId,
+                id: commandLocation.id,
+                commandId,
+                commandType: "inbound_email_create",
+                messageId,
+                requestFingerprint: fingerprint,
+                completedAt: now,
+            };
+            const actions = [
+                {
+                    action: "insert",
+                    value: { kind: "ticket", partition: ticketId, id: "ticket", ticket },
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "ticket_quota",
+                        partition: ticketId,
+                        id: "quota",
+                        messageCount: 1,
+                    },
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "message",
+                        partition: ticketId,
+                        id: `message:${messageId}`,
+                        ordinal: ticket.revision,
+                        message: inboundMessage(input, ticketId, messageId, now),
+                        ...(notificationContent === undefined
+                            ? {}
+                            : { deliveryContent: notificationContent }),
+                    },
+                },
+                inboundAuditAction({
+                    commandId,
+                    correlationId: work.correlationId,
+                    ticketId,
+                    revision: ticket.revision,
+                    occurredAt: now,
+                    action: supportTicketAuditActions.created,
+                    matchMethod: route.matchMethod,
+                    association: route.association,
+                }),
+                ...(createFence === null
+                    ? [{ action: "insert", value: commandRecord }]
+                    : [
+                        {
+                            action: "putIfUnchanged",
+                            version: createFence.version,
+                            value: commandRecord,
+                        },
+                    ]),
+                ...(notification === undefined
+                    ? []
+                    : [deliveryJobAction(ticketId, messageId, now, notification)]),
+            ];
+            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, actions.length);
+            const outcome = await records.transact(ticketId, actions);
+            if (!outcome.committed) {
+                const raced = await records.get(commandKey(ticketId, commandId));
+                if (!duplicateMatches(raced, "inbound_email_create", messageId, fingerprint)) {
+                    if (raced !== null &&
+                        !inboundCreateRerouteFenceMatches(raced, commandId, messageId, fingerprint)) {
+                        throw new SupportDeskConflictError("An inbound ticket command ID was reused for different content");
+                    }
+                    throw new SupportDeskConflictError("Concurrent ticket updates exhausted retries; the provider may retry the same event. The inbound receipt remains processing and is safe to resume.");
+                }
+            }
+        }
+        const result = await finishReceipt(work, {
+            status: "processed",
+            outcome: "created",
+            ticketId,
+            messageId,
+        });
+        await afterInboundCommit(ticketId, messageId, true);
+        return result;
+    }
+    async function appendReply(work, route) {
+        const { input, messageId, commandId, fingerprint } = work;
+        const ticketId = route.ticketId;
+        const completed = async () => {
+            const result = await finishReceipt(work, {
+                status: "processed",
+                outcome: "replied",
+                ticketId,
+                messageId,
+            });
+            await afterInboundCommit(ticketId, messageId, false);
+            return result;
+        };
+        const rejected = (diagnostic) => finishReceipt(work, {
+            status: "rejected",
+            outcome: "rejected",
+            diagnostic,
+        });
+        for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+            const duplicate = await records.get(commandKey(ticketId, commandId));
+            if (duplicate !== null) {
+                if (!duplicateMatches(duplicate, "inbound_email_reply", messageId, fingerprint)) {
+                    throw new SupportDeskConflictError("An inbound ticket command ID was reused for different content");
+                }
+                return completed();
+            }
+            const versioned = await records.getVersioned(ticketKey(ticketId));
+            if (versioned?.value.kind !== "ticket") {
+                return rejected("ticket_unavailable");
+            }
+            const ticket = versioned.value.ticket;
+            const partitionRows = await records.list(ticketId);
+            if (input.externalMessageId !== undefined) {
+                const prior = partitionRows.find((row) => row.kind === "message" &&
+                    row.message.channel === "email" &&
+                    row.message.authorKind === "customer" &&
+                    row.message.externalMessageId === input.externalMessageId);
+                if (prior !== undefined) {
+                    return finishReceipt(work, {
+                        status: "processed",
+                        outcome: "duplicate_message",
+                        ticketId,
+                        messageId: prior.message.id,
+                    });
+                }
+            }
+            const quota = await records.getVersioned(ticketQuotaKey(ticketId));
+            if (quota?.value.kind !== "ticket_quota") {
+                throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+            }
+            if (quota.value.messageCount >= limits.maxMessagesPerTicket) {
+                return rejected("ticket_messages_limit");
+            }
+            const notification = await inboundNotification({
+                outcome: "replied",
+                channelId: input.channelId,
+                ticketId,
+                ticketNumber: ticket.number,
+                messageId,
+                association: ticket.requester.association,
+                matchMethod: route.matchMethod,
+                ...(ticket.assignedTo === undefined
+                    ? {}
+                    : { assignedTo: ticket.assignedTo }),
+                senderAcknowledgementAllowed: inboundSenderAcknowledgementAllowed(input),
+            });
+            const requiresHandoff = effectiveTicketHandling(ticket).state === "assistant";
+            const now = clampTicketTime(clock.now(), ticket.updatedAt);
+            // Customer-reply semantics: any status, including resolved or closed,
+            // moves to waiting_on_support. No actor: email is not authentication.
+            const updated = await applyResponseTargets(applyTicketEvent(ticket, {
+                type: "customer_replied",
+                occurredAt: now,
+                channel: "email",
+            }), responseTargetPolicy, "customer_replied");
+            const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, true);
+            try {
+                enforceManagedAdmission(ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, (notification === undefined ? 3 : 4) +
+                    (requiresHandoff ? 1 : 0) +
+                    learningMutation.additionalRows, true);
+            }
+            catch (error) {
+                if (!(error instanceof SupportDeskLimitError))
+                    throw error;
+                return rejected(error.field === "ticket_messages"
+                    ? "ticket_messages_limit"
+                    : "ticket_partition_limit");
+            }
+            const notificationContent = deliveryContent(notification);
+            const outcome = await records.transact(ticketId, [
+                ...learningMutation.actions,
+                {
+                    action: "putIfUnchanged",
+                    version: quota.version,
+                    value: {
+                        ...quota.value,
+                        messageCount: quota.value.messageCount + 1,
+                    },
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "message",
+                        partition: ticketId,
+                        id: `message:${messageId}`,
+                        ordinal: updated.revision,
+                        message: inboundMessage(input, ticketId, messageId, now),
+                        ...(notificationContent === undefined
+                            ? {}
+                            : { deliveryContent: notificationContent }),
+                    },
+                },
+                inboundAuditAction({
+                    commandId,
+                    correlationId: work.correlationId,
+                    ticketId,
+                    revision: updated.revision,
+                    occurredAt: now,
+                    action: supportTicketAuditActions.customerReplied,
+                    matchMethod: route.matchMethod,
+                }),
+                {
+                    action: "insert",
+                    value: {
+                        kind: "command",
+                        partition: ticketId,
+                        id: `command:${commandId}`,
+                        commandId,
+                        commandType: "inbound_email_reply",
+                        messageId,
+                        requestFingerprint: fingerprint,
+                        completedAt: now,
+                    },
+                },
+                ...(notification === undefined
+                    ? []
+                    : [deliveryJobAction(ticketId, messageId, now, notification)]),
+                ...(requiresHandoff
+                    ? [
+                        {
+                            action: "insert",
+                            value: handoffWork({
+                                ticket: updated,
+                                commandId,
+                                occurredAt: now,
+                                lastVisibleMessageId: messageId,
+                                reason: "email_reply",
+                            }),
+                        },
+                    ]
+                    : []),
+            ]);
+            if (outcome.committed) {
+                return completed();
+            }
+        }
+        const last = await records.get(commandKey(ticketId, commandId));
+        if (duplicateMatches(last, "inbound_email_reply", messageId, fingerprint)) {
+            return completed();
+        }
+        if (last !== null) {
+            throw new SupportDeskConflictError("An inbound ticket command ID was reused for different content");
+        }
+        throw new SupportDeskConflictError("Concurrent ticket updates exhausted retries; the provider may retry the same event. The inbound receipt remains processing and is safe to resume.");
+    }
+    return Object.freeze({
+        async processInboundEmail(rawInput) {
+            const input = snapshotInboundEmailInput(rawInput, limits);
+            const replayFingerprint = await requestFingerprint(inboundFingerprintPayload(input));
+            const location = await inboundReceiptLocation(input.channelId, input.providerEventId);
+            const key = {
+                partition: location.bucket,
+                id: receiptSlotId(location.slot, "inbound receipt slot"),
+            };
+            const receivedAt = new Date(canonicalTimestamp(clock.now(), "clock.now()")).toISOString();
+            const inserted = await receipts.insertIfAbsent({
+                bucket: location.bucket,
+                slot: location.slot,
+                channelId: input.channelId,
+                providerEventId: input.providerEventId,
+                ...(input.externalMessageId === undefined
+                    ? {}
+                    : { externalMessageId: input.externalMessageId }),
+                payloadFingerprint: replayFingerprint,
+                replayFingerprint,
+                status: "processing",
+                receivedAt,
+                reservedTicketId: input.ticketId,
+                reservedMessageId: input.messageId,
+                correlationId: input.correlationId,
+            });
+            let stored = inserted.value;
+            if (stored.channelId !== input.channelId ||
+                stored.providerEventId !== input.providerEventId) {
+                throw new SupportDeskConflictError("An inbound receipt hash slot collided with a different provider event");
+            }
+            stored = await bindInboundReplayFingerprint(key, stored, input, replayFingerprint);
+            const fingerprint = stored.payloadFingerprint;
+            const duplicateDelivery = !inserted.inserted;
+            if (stored.status !== "processing" && stored.status !== "rerouting") {
+                return inboundResult(stored, duplicateDelivery);
+            }
+            const reservedTicketId = stored.reservedTicketId;
+            const reservedMessageId = stored.reservedMessageId;
+            const correlationId = stored.correlationId;
+            if (reservedTicketId === undefined ||
+                reservedMessageId === undefined ||
+                correlationId === undefined) {
+                throw new SupportDeskConflictError("Inbound receipt is missing its reserved identifiers");
+            }
+            // Stable per provider event and independent of retry identifiers.
+            const commandId = `inbound:${location.bucket.slice(-30)}${location.slot}`;
+            const decided = await decideRoute(key, stored, input, reservedTicketId, commandId, reservedMessageId, fingerprint);
+            if (decided.status !== "processing" && decided.status !== "rerouting") {
+                return inboundResult(decided, duplicateDelivery);
+            }
+            const route = decided.route;
+            const work = {
+                key,
+                input,
+                route,
+                messageId: reservedMessageId,
+                correlationId,
+                commandId,
+                fingerprint,
+                duplicateDelivery,
+            };
+            switch (route.kind) {
+                case "suppressed":
+                    return finishReceipt(work, {
+                        status: "rejected",
+                        outcome: "suppressed",
+                        diagnostic: route.reason,
+                    });
+                case "duplicate_message":
+                    return finishReceipt(work, {
+                        status: "processed",
+                        outcome: "duplicate_message",
+                        ticketId: route.ticketId,
+                        messageId: route.messageId,
+                    });
+                case "new_conversation":
+                    return createConversation(work, route);
+                case "reply":
+                    return appendReply(work, route);
+            }
+        },
+    });
+}
 //# sourceMappingURL=index.js.map