pipework 0.254.0 → 0.256.0

package/src/infra/alerts/handle.ts

@@ -9,7 +9,7 @@ import { __flowStep } from '../../trace/runtime/flow-step.js'
 import { auditAlert } from './audit.js'
 import { ALERT_SEVERITIES, ALERT_STATUSES } from './schema.js'
 import { encodeCursor, decodeCursor } from '../../request/fixture/paginate.js'
-import { createOutbox } from '../outbox/core.js'
+import { checkRetention, createOutbox, hourlySweep } from '../outbox/core.js'
 import type { AlertDelivery, AlertPayload, AlertSink } from './sinks.js'
 import type { AlertSource } from './sources.js'
 import { redactJson, redactText } from './redact.js'
@@ -42,6 +42,10 @@ export interface AlertsConfig {
   readonly backoffMs?: number
   /** How long an occurrence is kept; the tick deletes older ones. Default 30 days. */
   readonly occurrenceRetentionMs?: number
+  /** Days a delivered delivery row, with its payload, is kept before the tick's sweep deletes it (at most once an hour per process). Unset: kept. */
+  readonly deliveredRetentionDays?: number
+  /** Days a delivery row that was given up on (never delivered) is kept. Needs `deliveredRetentionDays`. Unset: kept. */
+  readonly failedRetentionDays?: number
   /**
    * Send alerts of these severities in one periodic `digest` delivery per sink instead of one at a time. A raise or
    * resolve of such an alert queues nothing (so `resendAfterMs` has no effect on it); each tick at least `everyMs`
@@ -208,6 +212,8 @@ export interface Alerts {
   readonly job: Handler<Record<string, unknown>, unknown>
   /** What one run of `job` does; callable from a test. Needs a Flow. */
   tick(): Promise<TickResult>
+  /** Deletes delivery rows past `deliveredRetentionDays` / `failedRetentionDays` now, up to `limit` (default 10 000); `deleted: 0` when neither is set. */
+  sweep(options?: { limit?: number }): Promise<{ deleted: number }>
   open(): Promise<Alert[]>
   get(key: string): Promise<Alert | null>
   deliveries(options?: { key?: string }): Promise<DeliveryRow[]>
@@ -338,6 +344,7 @@ export function createAlerts(config: AlertsConfig): Alerts {
     if (config.digest.severities?.length === 0) throw new Error('[pipework] alerts.create: digest.severities needs at least one severity, or leave it out for warning.')
   }
   const digestSeverities = pgTextArray(config.digest === undefined ? [] : [...new Set(config.digest.severities ?? ['warning'])])
+  const retention = checkRetention('alerts.create', config)
   const jobType = config.jobType ?? 'pipework.alerts'
   const maxAttempts = config.maxAttempts ?? 10
   const backoffMs = config.backoffMs ?? 5000
@@ -718,12 +725,18 @@ export function createAlerts(config: AlertsConfig): Alerts {
     onGivenUp: (row, attempt, error) => auditAlert('deliver-failed', row['alert_key'] as string, { sink: row['sink'], kind: row['kind'], attempt, error }, database),
   })
 
+  const sweepIfDue = hourlySweep(outbox, retention, (err) => {
+    log.error({ err }, 'alert delivery sweep failed')
+  })
+
   async function runTick(): Promise<TickResult> {
     let resolved = await autoResolve()
     resolved += await runSources()
     await pruneOccurrences()
     await sendDigest()
-    return { resolved, ...await outbox.drain() }
+    const totals = await outbox.drain()
+    await sweepIfDue()
+    return { resolved, ...totals }
   }
 
   const flowTick = __flowStep({ ref: 'pipework/alerts:tick' }, runTick)
@@ -751,6 +764,7 @@ export function createAlerts(config: AlertsConfig): Alerts {
     health,
     job: job as unknown as Handler<Record<string, unknown>, unknown>,
     tick: () => tickStep(),
+    sweep: async (options = {}) => retention === undefined ? { deleted: 0 } : outbox.sweep({ ...retention, ...(options.limit !== undefined ? { limit: options.limit } : {}) }),
     async requeueFailed(options) {
       if (typeof options.by !== 'string' || options.by.trim() === '') throw new ValidationError({ by: ['must be a non-empty string'] }, 'alerts.requeueFailed needs by, who is requeueing.')
       const by = options.by.trim()

package/src/infra/email/inbound.ts

@@ -116,6 +116,8 @@ export interface InboundRecord {
   readonly processedAt: Date | null
   readonly rawExpiresAt: Date
   readonly rawDeletedAt: Date | null
+  /** When `sweep` nulled the address, subject, recipients and Message-ID; null until then. */
+  readonly metadataScrubbedAt: Date | null
 }
 
 export interface InboundSweepResult {
@@ -123,6 +125,8 @@ export interface InboundSweepResult {
   readonly deleted: number
   /** Raw copies that could not be deleted (left for the next sweep). */
   readonly failed: number
+  /** Rows whose address, subject, recipients and Message-ID were nulled (`metadataRetentionDays`). */
+  readonly scrubbed: number
 }
 
 export interface InboundScanResult {
@@ -253,6 +257,13 @@ export interface InboundConfig {
   readonly resolveTenant?: (email: UnthreadedEmail) => Promise<string | null>
   /** Days the raw copy is kept before `sweep` deletes it. Default 30. */
   readonly rawRetentionDays?: number
+  /**
+   * Days after receipt that `sweep` nulls a message's `from_address`, `subject`, `recipients` and `message_id_header`
+   * (only once its raw copy is deleted). At least `rawRetentionDays`. Unset: kept. The conversation, tenant, status,
+   * verdicts and id stay. A later reply to a scrubbed message no longer matches it by Message-ID, so it starts a new
+   * conversation, and `mail.send` with that `inReplyTo` sends without reply headers.
+   */
+  readonly metadataRetentionDays?: number
   /** Days each stored attachment is kept, from receipt, before the storage sweep deletes it. Unset: no expiry. */
   readonly attachmentRetentionDays?: number
   /** Raw messages larger than this are marked `failed` and not handled. Default 40 MiB. */
@@ -268,7 +279,7 @@ export interface Inbound {
   readonly jobs: readonly Handler<Record<string, unknown>, unknown>[]
   /** Folder source only: receives every `.eml` file in the folder. Needs a Flow (a job or schedule run). */
   scan(): Promise<InboundScanResult>
-  /** Deletes raw copies past their retention. Needs a Flow (a job or schedule run). */
+  /** Deletes raw copies past their retention and scrubs metadata past `metadataRetentionDays`. `limit` bounds each. Needs a Flow (a job or schedule run). */
   sweep(options?: { readonly limit?: number }): Promise<InboundSweepResult>
   /** The row of a received message, or `null`. Needs a Flow (a job, request or test context). */
   get(id: string): Promise<InboundRecord | null>
@@ -336,6 +347,13 @@ export function createInbound(config: InboundConfig): Inbound {
   const retentionDays = Math.floor(config.rawRetentionDays ?? DEFAULT_RETENTION_DAYS)
   const maxRawBytes = config.maxRawBytes ?? DEFAULT_MAX_RAW_BYTES
   if (!(retentionDays >= 0)) throw new Error('[pipework] inbound rawRetentionDays must be zero or more.')
+  const metadataDays = config.metadataRetentionDays
+  if (metadataDays !== undefined && !(Number.isInteger(metadataDays) && metadataDays >= 0)) {
+    throw new Error('[pipework] inbound metadataRetentionDays must be a whole number of zero or more.')
+  }
+  if (metadataDays !== undefined && metadataDays < retentionDays) {
+    throw new Error(`[pipework] inbound metadataRetentionDays (${String(metadataDays)}) must be at least rawRetentionDays (${String(retentionDays)}).`)
+  }
   const attachmentDays = config.attachmentRetentionDays === undefined ? undefined : Math.floor(config.attachmentRetentionDays)
   if (attachmentDays !== undefined && !(attachmentDays >= 1)) throw new Error('[pipework] inbound attachmentRetentionDays must be one or more.')
   if (!(maxRawBytes > 0)) throw new Error('[pipework] inbound maxRawBytes must be positive.')
@@ -602,7 +620,20 @@ export function createInbound(config: InboundConfig): Inbound {
           void recordFault('inbound-raw-delete', faultMessage(err), { inboundId: String(row['id']) })
         }
       }
-      return { deleted, failed }
+      let scrubbed = 0
+      if (metadataDays !== undefined) {
+        const rows = await db.execute(sql`
+          UPDATE pipework_email_inbound
+          SET from_address = NULL, subject = NULL, recipients = NULL, message_id_header = NULL, metadata_scrubbed_at = now()
+          WHERE id IN (
+            SELECT id FROM pipework_email_inbound
+            WHERE metadata_scrubbed_at IS NULL AND raw_deleted_at IS NOT NULL
+              AND received_at < now() - ${metadataDays} * interval '1 day'
+            ORDER BY received_at LIMIT ${limit})
+          RETURNING id`)
+        scrubbed = rows.length
+      }
+      return { deleted, failed, scrubbed }
     },
 
     async get(id) {
@@ -625,6 +656,7 @@ export function createInbound(config: InboundConfig): Inbound {
         processedAt: date(row['processed_at']),
         rawExpiresAt: toDate(row['raw_expires_at']),
         rawDeletedAt: date(row['raw_deleted_at']),
+        metadataScrubbedAt: date(row['metadata_scrubbed_at']),
       }
     },
   }

package/src/infra/email/schema.ts

@@ -9,6 +9,7 @@ import { define } from '../../data/domain/index.js'
 import { field } from '../../data/domain/field.js'
 import { schema } from '../../data/schema/namespace.js'
 import { index, unique } from '../../data/db/idx/index.js'
+import { sql } from '../../data/db/sql.js'
 
 export const EMAIL_TABLE_NAMES: ReadonlySet<string> = new Set([
   'pipework_email_messages', 'pipework_email_suppressions', 'pipework_email_inbound', 'pipework_email_unsubscribes',
@@ -71,6 +72,8 @@ export const emailInbound = define('pipework_email_inbound', {
   rawLocation: field.jsonb(schema.check.json()),
   rawExpiresAt: field.timestamp(),
   rawDeletedAt: field.timestamp().nullable(),
+  // Set when `sweep` nulls the address, subject, recipients and Message-ID after `metadataRetentionDays`.
+  metadataScrubbedAt: field.timestamp().nullable(),
   status: field.enum(INBOUND_STATUSES).default('received'),
   error: field.text().nullable(),
   messageIdHeader: field.text().nullable(),
@@ -92,5 +95,6 @@ export const emailInbound = define('pipework_email_inbound', {
     bySource: unique('pipework_email_inbound_source_id_key').on(t['sourceId']),
     byMessageId: index('idx_pipework_email_inbound_message_id').on(t['messageIdHeader']),
     byExpiry: index('idx_pipework_email_inbound_raw_expires').on(t['rawExpiresAt']),
+    unscrubbed: index('idx_pipework_email_inbound_unscrubbed').on(t['receivedAt']).where(sql.raw('metadata_scrubbed_at IS NULL')),
   }),
 })

package/src/infra/email/sns.ts

@@ -94,7 +94,7 @@ const processEvent = __flowStep({ ref: 'pipework/email:notification' }, async (e
     } else {
       getBaseLogger().info({ event: 'email bounce not suppressed', address, bounceType: r.bounceType }, 'transient bounce: address kept')
     }
-    await auditEmail(r.kind, messageId, { address, bounceType: r.bounceType, suppressed: permanent, messageTraceId })
+    await auditEmail(r.kind, messageId, { bounceType: r.bounceType, suppressed: permanent, messageTraceId })
   }
 })
 

package/src/infra/outbox/core.ts

@@ -13,6 +13,9 @@ const LEASE_MS = 30_000
 const BATCH = 50
 const MAX_BATCHES = 20
 const MAX_BACKOFF_MS = 3_600_000
+const SWEEP_BATCH = 500
+const DEFAULT_SWEEP_LIMIT = 10_000
+const SWEEP_EVERY_MS = 3_600_000
 
 export interface OutboxTotals {
   delivered: number
@@ -61,6 +64,27 @@ export interface OutboxOptions<D> {
   readonly onGivenUp: (row: Record<string, unknown>, attempt: number, error: string) => Promise<void>
 }
 
+/** Retention for an outbox's rows, in days. Unset: kept. */
+export interface OutboxRetention {
+  /** Delivered rows (and their payloads) older than this are deleted. */
+  readonly deliveredRetentionDays: number
+  /** Given-up rows (`failed_at` set, never delivered) older than this are deleted. Unset: kept. */
+  readonly failedRetentionDays?: number
+}
+
+/** Refuses a retention that is not whole days of zero or more, naming `who` and the option. */
+export function checkRetention(who: string, config: { readonly deliveredRetentionDays?: number; readonly failedRetentionDays?: number }): OutboxRetention | undefined {
+  for (const name of ['deliveredRetentionDays', 'failedRetentionDays'] as const) {
+    const v = config[name]
+    if (v !== undefined && !(Number.isInteger(v) && v >= 0)) throw new Error(`[pipework] ${who}: ${name} must be an integer of zero or more, got ${String(v)}.`)
+  }
+  if (config.failedRetentionDays !== undefined && config.deliveredRetentionDays === undefined) {
+    throw new Error(`[pipework] ${who}: failedRetentionDays needs deliveredRetentionDays too.`)
+  }
+  if (config.deliveredRetentionDays === undefined) return undefined
+  return { deliveredRetentionDays: config.deliveredRetentionDays, ...(config.failedRetentionDays !== undefined ? { failedRetentionDays: config.failedRetentionDays } : {}) }
+}
+
 export interface Outbox {
   /** Delivers what is due now, up to 20 batches; rows that fail wait for the next call. */
   drain(): Promise<OutboxTotals>
@@ -70,6 +94,26 @@ export interface Outbox {
    * `prev_attempts`, the attempts it had when given up.
    */
   requeue(options: { sink?: string; failedSince?: Date }): Promise<Record<string, unknown>[]>
+  /**
+   * Deletes delivered rows whose `delivered_at` is older than `deliveredRetentionDays` and, with `failedRetentionDays`,
+   * given-up rows whose `failed_at` is older than that. A row still queued or being retried is never deleted.
+   * Deletes in batches of 500, at most `limit` rows per call (default 10 000).
+   */
+  sweep(options: OutboxRetention & { limit?: number }): Promise<{ deleted: number }>
+}
+
+/** A function that runs `outbox.sweep` with `retention` at most once an hour per process, and never throws; `onError` gets a failure. No retention: does nothing. */
+export function hourlySweep(outbox: Outbox, retention: OutboxRetention | undefined, onError: (err: unknown) => void): () => Promise<void> {
+  let last = 0
+  return async () => {
+    if (retention === undefined || Date.now() - last < SWEEP_EVERY_MS) return
+    last = Date.now()
+    try {
+      await outbox.sweep(retention)
+    } catch (err) {
+      onError(err)
+    }
+  }
 }
 
 function withTimeout(promise: Promise<void>, ms: number): Promise<void> {
@@ -136,7 +180,33 @@ export function createOutbox<D>(options: OutboxOptions<D>): Outbox {
     }))
   }
 
+  async function deleteBatch(predicate: ReturnType<typeof sql>, size: number): Promise<number> {
+    const rows = await db().execute(sql`
+      DELETE FROM ${table} WHERE id IN (SELECT id FROM ${table} WHERE ${predicate} LIMIT ${size}) RETURNING id`)
+    return rows.length
+  }
+
   return {
+    async sweep(opts) {
+      const days = [['deliveredRetentionDays', opts.deliveredRetentionDays], ['failedRetentionDays', opts.failedRetentionDays], ['limit', opts.limit]] as const
+      for (const [name, v] of days) {
+        if (v !== undefined && !(Number.isInteger(v) && v >= (name === 'limit' ? 1 : 0))) {
+          throw new ValidationError({ [name]: ['must be a whole number' + (name === 'limit' ? ' of one or more' : ' of zero or more')] }, `Outbox sweep ${name} is invalid.`)
+        }
+      }
+      const delivered = sql`delivered_at IS NOT NULL AND delivered_at < clock_timestamp() - ${opts.deliveredRetentionDays} * interval '1 day'`
+      const failed = opts.failedRetentionDays === undefined ? null
+        : sql`delivered_at IS NULL AND failed_at IS NOT NULL AND failed_at < clock_timestamp() - ${opts.failedRetentionDays} * interval '1 day'`
+      const predicate = failed === null ? delivered : sql`((${delivered}) OR (${failed}))`
+      const limit = opts.limit ?? DEFAULT_SWEEP_LIMIT
+      let deleted = 0
+      while (deleted < limit) {
+        const n = await deleteBatch(predicate, Math.min(SWEEP_BATCH, limit - deleted))
+        deleted += n
+        if (n === 0) break
+      }
+      return { deleted }
+    },
     async requeue(opts) {
       if (opts.failedSince !== undefined && !(opts.failedSince instanceof Date && !Number.isNaN(opts.failedSince.getTime()))) {
         throw new ValidationError({ failedSince: ['must be a valid Date'] }, 'Outbox failedSince must be a Date.')

package/src/infra/support/handle.ts

@@ -17,7 +17,7 @@ import { recordBeat, beatsEnabled } from '../alerts/beat.js'
 import type { Mail } from '../email/mail.js'
 import { sanitizeHtml, htmlToText } from '../email/sanitize.js'
 import type { ReceivedEmail } from '../email/inbound.js'
-import { createOutbox, type Sink, type SinkDelivery } from '../outbox/core.js'
+import { checkRetention, createOutbox, hourlySweep, type Sink, type SinkDelivery } from '../outbox/core.js'
 import { TICKET_STATES } from './schema.js'
 import { describeError } from '../../core/logging/error-chain.js'
 
@@ -87,18 +87,35 @@ export interface SupportConfig {
   /**
    * Who may join a ticket by thread. `'contact'` (default): only the ticket's contact; a message from anyone else in the
    * thread opens its own ticket, and `receive` with a `ticketId` refuses a sender who is not the contact. `'conversation'`:
-   * a message threaded into the ticket's conversation, or sent to it with `ticketId`, joins it and reopens it whoever sent
-   * it; the message keeps its own sender, and the ticket's contact and user do not change. Risk: with `'conversation'`,
-   * anyone who holds a reply's Message-ID can add to the ticket, so pair it with a strict `screen` (for example, require
-   * a DMARC pass). A message `screen` separates still never joins.
+   * a message threaded into the ticket's conversation, or sent to it with `ticketId`, joins it and reopens it; the
+   * message keeps its own sender, and the ticket's contact and user do not change. Whether a sender other than the
+   * contact may join is `joinOthers`. A message `screen` separates never joins.
    */
   readonly joinThread?: 'contact' | 'conversation'
+  /**
+   * With `joinThread: 'conversation'` (setting it with `'contact'` throws at create): whether a message from a sender
+   * other than the ticket's contact joins the ticket found. The contact's own message always joins. `'authentic'`
+   * (default): an email joins only when its DMARC verdict is `PASS`, or when it has no verdicts (the folder stand-in);
+   * `receive` (chat/api) joins, since the app vouched for the caller. `'any'`: joins. A function decides itself, with
+   * `email: null` for `receive`. A refused message is handled like one `screen` separates: it opens its own ticket,
+   * names no user, and its `receive` audit has `separated: true` and `reason: 'not-authentic'`. It never touches the
+   * found ticket (no drafts discarded, no reopen). `receive` with a refused `ticketId` throws ForbiddenError.
+   */
+  readonly joinOthers?: 'authentic' | 'any' | ((who: { email: ReceivedEmail | null; ticket: Ticket }) => boolean)
   /** Job type of `support.job`; default `'pipework.support.events'`. */
   readonly jobType?: string
   /** Delivery attempts before an event is given up on; default 10. */
   readonly maxAttempts?: number
   /** First retry delay, doubling per attempt up to one hour; default 5000. */
   readonly backoffMs?: number
+  /**
+   * Days a delivered event row, with its payload (the ticket subject), is kept before the sweep deletes it. Unset: kept.
+   * `tick` (so `support.job`) runs the sweep at most once an hour per process; `sweep()` runs it on demand.
+   * The ticket audit rows carry ids only; they expire with the trace partitions (`auditRetentionDays`).
+   */
+  readonly deliveredRetentionDays?: number
+  /** Days an event row that was given up on (never delivered) is kept. Needs `deliveredRetentionDays`. Unset: kept. */
+  readonly failedRetentionDays?: number
 }
 
 export interface Ticket {
@@ -256,6 +273,8 @@ export interface Support extends WithFor<TicketApi> {
   readonly job: Handler<Record<string, unknown>, unknown>
   /** What one run of `job` does; callable from a test. Needs a Flow. */
   tick(): Promise<{ delivered: number; retried: number; failed: number }>
+  /** Deletes event rows past `deliveredRetentionDays` / `failedRetentionDays` now, up to `limit` (default 10 000); `deleted: 0` when neither is set. Needs a Flow. */
+  sweep(options?: { limit?: number }): Promise<{ deleted: number }>
   /**
    * Puts the event deliveries that were given up (and never delivered) back on the queue, for every tenant, optionally
    * only those of `sink` and/or that failed at or after `failedSince`; the next `tick` sends them. Delivery ids stay the
@@ -358,6 +377,14 @@ export function createSupport(config: SupportConfig): Support {
   if ((joinThread as string) !== 'contact' && (joinThread as string) !== 'conversation') {
     throw new Error(`[pipework] support.create: joinThread must be 'contact' or 'conversation', got ${JSON.stringify(joinThread)}.`)
   }
+  const joinOthers = config.joinOthers ?? 'authentic'
+  if (config.joinOthers !== undefined && joinThread !== 'conversation') {
+    throw new Error(`[pipework] support.create: joinOthers applies only with joinThread: 'conversation'; remove it or set joinThread.`)
+  }
+  if (joinOthers !== 'authentic' && joinOthers !== 'any' && typeof joinOthers !== 'function') {
+    throw new Error(`[pipework] support.create: joinOthers must be 'authentic', 'any' or a function, got ${JSON.stringify(joinOthers)}.`)
+  }
+  const retention = checkRetention('support.create', config)
   const jobType = config.jobType ?? 'pipework.support.events'
   const replyTemplate = config.replyTemplate ?? 'pipework.support.reply'
   const distinctApprover = config.distinctApprover ?? true
@@ -503,12 +530,21 @@ export function createSupport(config: SupportConfig): Support {
       if (seen[0] !== undefined) return { status: 'duplicate', ticketId: seen[0]['ticket_id'] as string, created: false }
     }
 
+    let separate = m.separate === true
+    let reason: string | null = null
+    const mayJoin = (t: Ticket): boolean => {
+      if (t.contactEmail === m.contactEmail || joinOthers === 'any') return true
+      if (typeof joinOthers === 'function') return joinOthers({ email: m.email ?? null, ticket: t })
+      const v = m.email?.verdicts
+      return m.email == null || v == null || v.dmarc === 'PASS'
+    }
     let ticket: Ticket | null = null
     if (m.ticketId !== null) {
       ticket = await loadTicket(tx, tenantId, m.ticketId, true)
       if (joinThread === 'contact' && ticket.contactEmail !== m.contactEmail) {
         throw new ForbiddenError('The sender is not the ticket\'s contact.', { ticketId: m.ticketId })
       }
+      if (!mayJoin(ticket)) throw new ForbiddenError('The sender may not join the ticket (joinOthers).', { ticketId: m.ticketId })
     } else if (m.conversationId !== null && m.separate !== true) {
       const contactOnly = joinThread === 'contact' ? sql`AND t.contact_email = ${m.contactEmail}` : sql``
       const found = await tx.execute(sql`
@@ -518,12 +554,19 @@ export function createSupport(config: SupportConfig): Support {
             SELECT 1 FROM support_message sm JOIN pipework_email_inbound i ON i.id = sm.inbound_email_id
             WHERE sm.ticket_id = t.id AND i.conversation_id = ${m.conversationId}::uuid))
         ORDER BY (t.conversation_id = ${m.conversationId}::uuid) DESC NULLS LAST, t.created_at DESC, t.id LIMIT 1`)
-      if (found[0] !== undefined) ticket = await loadTicket(tx, tenantId, found[0]['id'] as string, true)
+      if (found[0] !== undefined) {
+        const t = await loadTicket(tx, tenantId, found[0]['id'] as string, true)
+        if (mayJoin(t)) ticket = t
+        else {
+          separate = true
+          reason = 'not-authentic'
+        }
+      }
     }
 
     const resolve = async (): Promise<string | null> => {
       if (m.userId !== null) return m.userId
-      if (m.separate === true) return null
+      if (separate) return null
       const found = await config.resolveContact?.({ address: m.contactEmail, name: m.contactName, tenantId, email: m.email ?? null }, tx)
       return found?.userId ?? null
     }
@@ -534,7 +577,7 @@ export function createSupport(config: SupportConfig): Support {
     if (ticket === null) {
       const userId = await resolve()
       let conversationId = m.conversationId
-      if (m.separate === true) conversationId = null
+      if (separate) conversationId = null
       if (conversationId !== null) {
         const held = await tx.execute(sql`SELECT 1 FROM support_ticket WHERE tenant_id = ${tenantId}::uuid AND conversation_id = ${conversationId}::uuid`)
         if (held.length > 0) conversationId = null
@@ -545,7 +588,7 @@ export function createSupport(config: SupportConfig): Support {
         RETURNING *`)
       ticket = toTicket(rows[0]!)
       created = true
-      await audit(flow, tx, tenantId, 'create', ticket.id, { subject: ticket.subject, contact: ticket.contactEmail, channel: m.channel, userId: ticket.userId })
+      await audit(flow, tx, tenantId, 'create', ticket.id, { channel: m.channel, userId: ticket.userId })
     } else {
       await discardLive(flow, tx, ticket, 'customer-replied')
       if (ticket.state !== 'open') ticket = await moveTo(flow, tx, ticket, 'open', true)
@@ -562,7 +605,7 @@ export function createSupport(config: SupportConfig): Support {
       INSERT INTO support_message (tenant_id, ticket_id, kind, channel, text, html, from_address, inbound_email_id, attachments)
       VALUES (${tenantId}::uuid, ${ticket.id}::uuid, 'inbound', ${m.channel}, ${text}, ${html}, ${m.fromAddress},
         ${m.inboundEmailId}::uuid, ${m.attachments === null ? null : JSON.stringify(m.attachments)}::jsonb)`)
-    await audit(flow, tx, tenantId, 'receive', ticket.id, { channel: m.channel, emailId: m.inboundEmailId, created, separated: m.separate === true, ...(joinedBy === null ? {} : { joinedBy }), ...(userIdSet === null ? {} : { userIdSet }) })
+    await audit(flow, tx, tenantId, 'receive', ticket.id, { channel: m.channel, emailId: m.inboundEmailId, created, separated: separate, ...(reason === null ? {} : { reason }), ...(joinedBy === null ? {} : { joinedBy }), ...(userIdSet === null ? {} : { userIdSet }) })
     await emit(tx, created ? 'ticket.created' : 'ticket.customer-replied', ticket)
     return { status: 'received', ticketId: ticket.id, created }
   }
@@ -802,7 +845,15 @@ export function createSupport(config: SupportConfig): Support {
     await audit(flow, null, payload.tenantId, verb, row['ticket_id'] as string, { sink: row['sink'], kind: row['kind'], ...extra })
   }
 
-  const drainStep = __flowStep({ ref: 'pipework/support:tick' }, () => outbox.drain())
+  const sweepIfDue = hourlySweep(outbox, retention, (err) => {
+    getBaseLogger().error({ err }, 'support event sweep failed')
+    void recordFault('support-event-sweep', faultMessage(err), {})
+  })
+  const drainStep = __flowStep({ ref: 'pipework/support:tick' }, async () => {
+    const totals = await outbox.drain()
+    await sweepIfDue()
+    return totals
+  })
   // A beat for `alerts.source.loopStalled`, written only where the blueprint has `alerts`.
   const beat = async (outcome: { ok: boolean; error?: string }): Promise<void> => {
     const ctx = getContext()
@@ -855,6 +906,10 @@ export function createSupport(config: SupportConfig): Support {
     },
     job: job as unknown as Handler<Record<string, unknown>, unknown>,
     tick: () => tickStep(),
+    async sweep(options = {}) {
+      requireContext()
+      return retention === undefined ? { deleted: 0 } : outbox.sweep({ ...retention, ...(options.limit !== undefined ? { limit: options.limit } : {}) })
+    },
     async requeueFailed(options) {
       requireContext()
       nonEmpty('by', options.by)