Email ticketing fixes, comms polish, and .env cleanup

Inbound: - Gmail poll query is:unread in:inbox (was category:primary, which matched nothing on a no-tabs Workspace inbox) Outbound email: - Closed/escalation auto-emails editable via TICKET_CLOSE_MESSAGE and new TICKET_ESCALATION_EMAIL_MESSAGE; drop the staff signature from closing emails - Replies quote the customer's latest message (gmail_quote markup so clients collapse it), embed custom emoji inline via CID attachment, and strip Discord role mentions - Tagline spacing fix in the company signature Discord side: - Suppress all mentions in log + transcript posts (no more pinging on close) - Drop the staff-role ping from new-ticket and follow-up notifications - Ticket channels inherit category permissions instead of setting per-channel overwrites (removes the Manage Roles requirement) Gmail folders: - Folder/label routing (gmailLabels.js) with /folder; close files to Complete Config: - Remove ~56 stale .env keys for long-removed features; refresh stale copy Docs: - Design specs for folder routing, email-flow toggle, and per-staff metrics
2026-06-04 22:05:20 +00:00
parent 3e20f9cf86
commit 2ccdbf72aa
19 changed files with 1224 additions and 83 deletions
--- a/.env.example
+++ b/.env.example
@@ -60,8 +60,10 @@ SUPPORT_NAME=Support
 LOGO_URL=                         # URL of logo shown in embeds (optional)
 EMAIL_SIGNATURE=                  # HTML signature for outgoing emails (use \n for line breaks)
 TICKET_CLOSE_SUBJECT_PREFIX=[Resolved]
-# Email tickets only (closure email body):
+# Email tickets only (closure email body). Placeholders: {closer_name}; \n for line breaks.
 TICKET_CLOSE_MESSAGE=             # Body of closure email to customer
 # Email tickets only (escalation notification email body). Placeholders: {escalator_name}, {tier}; \n for line breaks.
 TICKET_ESCALATION_EMAIL_MESSAGE= # Body of escalation email to customer
 TICKET_CLOSE_SIGNATURE=           # Signature on closure email
 # Discord ticket closure (in-channel before transcript, transcript post, and auto-close):
 DISCORD_CLOSE_MESSAGE=            # Message in ticket channel before transcript (e.g. ... If you still need assistance, please open a new ticket.)
@@ -103,6 +105,13 @@ ALLOW_CLAIM_OVERWRITE=false
 ADMIN_ID=                                 # Discord user ID of the bot admin (for Gmail OAuth failure DMs)
 FORCE_CLOSE_TIMER_SECONDS=60              # Seconds to wait before force-closing a ticket (default 60)
 GMAIL_POLL_INTERVAL_SECONDS=30            # Gmail poll interval in seconds (default 30)
 GMAIL_POLL_ENABLED=                       # Inbound email flow master switch; "false" disables polling (default on). Toggle at runtime with /email on|off
 GMAIL_LABEL_TRIAGE=                        # Gmail label for newly created tickets (default "Triage"); auto-created if missing
 GMAIL_LABEL_ESCALATED=                     # Gmail label for escalated tickets (default "Escalated")
 GMAIL_LABEL_RESOLVED=                      # Gmail label for resolved/closed tickets (default "Resolved")
 GMAIL_LABEL_FOR_JAKE=                      # /folder option (default "For Jake")
 GMAIL_LABEL_DASHBOARD_ERRORS=              # /folder option (default "Dashboard Errors")
 GMAIL_LABEL_PARTNERSHIP_OFFERS=            # /folder option (default "Partnership Offers")
 GMAIL_LOG_CHANNEL_ID=                     # Channel for Gmail poll activity logs
 AUTOMATION_LOG_CHANNEL_ID=                # Channel for auto-close/auto-unclaim/reminder logs
 RENAME_LOG_CHANNEL_ID=                    # Channel for channel rename queue logs
--- a/HOWITWORKS.md
+++ b/HOWITWORKS.md
@@ -3,7 +3,7 @@
 Broccolini Bot is a single Node.js process. It does three things at once:
 1. **Listens to Discord** — slash commands, button clicks, modals, ticket-channel messages.
-2. **Polls Gmail** — every N seconds, pulls unread `category:primary` mail and turns each thread into a Discord ticket channel.
+2. **Polls Gmail** — every N seconds, pulls unread `in:inbox` mail and turns each thread into a Discord ticket channel.
 3. **Serves a couple of HTTP endpoints** — a public healthcheck and an internal config/control API.
 State lives in MongoDB via Mongoose. There is no queue/worker tier and no public REST API.
@@ -27,7 +27,7 @@ Every `setInterval` in the `ready` block is wrapped through `trackInterval(...)`
 `gmail-poll.js`:
-1. Lists unread messages in `category:primary`.
+1. Lists unread messages in `in:inbox` (excludes Spam, Trash, and anything filter-skipped from the inbox).
 2. For each thread, looks up an existing `Ticket` by `gmailThreadId`. If none, creates a Discord channel under `TICKET_CATEGORY_ID` (or an overflow category if the main is full at Discord's 50-channel limit) and inserts a `Ticket` document.
 3. Posts a welcome embed + action row (Close / Claim / Escalate) into the channel and pings `ROLE_ID_TO_PING`.
 4. On subsequent emails in the same thread, just appends the new message to the existing channel.
--- a/broccolini-discord.js
+++ b/broccolini-discord.js
@@ -207,8 +207,12 @@ client.once('ready', async () => {
  registerCommands().catch(console.error);
-  gmailPollInterval = trackInterval(setInterval(() => poll(client), CONFIG.GMAIL_POLL_INTERVAL_MS));
+  if (CONFIG.GMAIL_POLL_ENABLED) {
-  poll(client);
+    gmailPollInterval = trackInterval(setInterval(() => poll(client), CONFIG.GMAIL_POLL_INTERVAL_MS));
    poll(client);
  } else {
    console.log('Gmail poll disabled by config (GMAIL_POLL_ENABLED=false) — inbox will not be polled. Enable with /email on.');
  }
  if (CONFIG.AUTO_CLOSE_ENABLED) {
    trackInterval(setInterval(() => checkAutoClose(client, sendTicketClosedEmail), 60 * 60 * 1000));
--- a/commands/register.js
+++ b/commands/register.js
@@ -368,6 +368,41 @@ async function registerCommands() {
          )
      ),
    new SlashCommandBuilder()
      .setName('email')
      .setDescription('Turn the inbound email flow (Gmail polling) on or off, or check its status')
      .setContexts([InteractionContextType.Guild])
      .setIntegrationTypes([ApplicationIntegrationType.GuildInstall])
      .setDefaultMemberPermissions(PermissionFlagsBits.ManageGuild)
      .addSubcommand(sub =>
        sub.setName('on').setDescription('Start polling the inbox and creating tickets from email')
      )
      .addSubcommand(sub =>
        sub.setName('off').setDescription('Stop polling the inbox (outbound emails still send)')
      )
      .addSubcommand(sub =>
        sub.setName('status').setDescription('Show whether the inbound email flow is on or off')
      ),
    new SlashCommandBuilder()
      .setName('folder')
      .setDescription("Move this ticket's email thread into a Gmail folder")
      .setContexts([InteractionContextType.Guild])
      .setIntegrationTypes([ApplicationIntegrationType.GuildInstall])
      .setDefaultMemberPermissions(PermissionFlagsBits.ManageMessages)
      .addStringOption(opt =>
        opt
          .setName('destination')
          .setDescription('Target folder')
          .setRequired(true)
          .addChoices(
            { name: 'For Jake', value: 'FOR_JAKE' },
            { name: 'Spam', value: 'SPAM' },
            { name: 'Dashboard Errors', value: 'DASHBOARD_ERRORS' },
            { name: 'Partnership Offers', value: 'PARTNERSHIP_OFFERS' }
          )
      ),
    new SlashCommandBuilder()
      .setName('cancel-close')
      .setDescription('Cancel a pending force-close countdown')
--- a/config.js
+++ b/config.js
@@ -36,9 +36,11 @@ const CONFIG = {
  EMAIL_ESCALATED3_CHANNEL_ID: process.env.EMAIL_ESCALATED3_CHANNEL_ID || null,
  DISCORD_ESCALATED3_CHANNEL_ID: process.env.DISCORD_ESCALATED3_CHANNEL_ID || null,
  ESCALATION_MESSAGE: process.env.ESCALATION_MESSAGE || 'Your ticket has been escalated.\n\nA senior {support_name} will be here to assist as soon as possible.',
  // Email tickets only (escalation notification email body). Placeholders: {escalator_name}, {tier}.
  TICKET_ESCALATION_EMAIL_MESSAGE: process.env.TICKET_ESCALATION_EMAIL_MESSAGE || '{escalator_name} escalated this ticket to {tier}.',
  TICKET_CLOSE_SUBJECT_PREFIX: process.env.TICKET_CLOSE_SUBJECT_PREFIX || '[Resolved]',
  // Email tickets only (closure email body):
-  TICKET_CLOSE_MESSAGE: process.env.TICKET_CLOSE_MESSAGE || 'This ticket has been marked as resolved. If you would like to re-open this issue, please reply to this email.',
+  TICKET_CLOSE_MESSAGE: process.env.TICKET_CLOSE_MESSAGE || '{closer_name} has marked this ticket as resolved. If you would like to re-open this issue, please reply to this email.',
  TICKET_CLOSE_SIGNATURE: process.env.TICKET_CLOSE_SIGNATURE || 'Thank you for using Indifferent Broccoli.',
  // Discord ticket closure (in-channel and transcript):
  DISCORD_CLOSE_MESSAGE: process.env.DISCORD_CLOSE_MESSAGE || 'This ticket has been closed. A transcript has been saved. If you still need assistance, please open a new ticket.',
@@ -75,6 +77,16 @@ const CONFIG = {
  ADMIN_ID: process.env.ADMIN_ID || null,
  FORCE_CLOSE_TIMER: toInt(process.env.FORCE_CLOSE_TIMER_SECONDS, 60),
  GMAIL_POLL_INTERVAL_MS: toInt(process.env.GMAIL_POLL_INTERVAL_SECONDS, 30) * 1000,
  // Inbound email flow master switch. Absent/anything-but-"false" => on, so
  // existing deployments keep polling with no .env change. Toggle via /email.
  GMAIL_POLL_ENABLED: process.env.GMAIL_POLL_ENABLED !== 'false',
  // Gmail "folder" (label) names for ticket-lifecycle routing — see services/gmailLabels.js.
  GMAIL_LABEL_TRIAGE: process.env.GMAIL_LABEL_TRIAGE || 'Triage',
  GMAIL_LABEL_ESCALATED: process.env.GMAIL_LABEL_ESCALATED || 'Escalated',
  GMAIL_LABEL_RESOLVED: process.env.GMAIL_LABEL_RESOLVED || 'Resolved',
  GMAIL_LABEL_FOR_JAKE: process.env.GMAIL_LABEL_FOR_JAKE || 'For Jake',
  GMAIL_LABEL_DASHBOARD_ERRORS: process.env.GMAIL_LABEL_DASHBOARD_ERRORS || 'Dashboard Errors',
  GMAIL_LABEL_PARTNERSHIP_OFFERS: process.env.GMAIL_LABEL_PARTNERSHIP_OFFERS || 'Partnership Offers',
  STAFF_THREAD_ENABLED: process.env.STAFF_THREAD_ENABLED === 'true',
  STAFF_THREAD_NAME: process.env.STAFF_THREAD_NAME || 'Staff Discussion',
  STAFF_THREAD_AUTO_ADD_ROLE: process.env.STAFF_THREAD_AUTO_ADD_ROLE === 'true',
--- a/docs/superpowers/specs/2026-06-03-email-flow-toggle-design.md
+++ b/docs/superpowers/specs/2026-06-03-email-flow-toggle-design.md
@@ -0,0 +1,124 @@
 # Email Flow Toggle — Design
 **Date:** 2026-06-03
 **Status:** Approved (design); pending implementation plan
 ## Goal
 A staff slash command to turn the **inbound** email flow on and off at runtime, with the state surviving container restarts.
 - **ON** — Gmail polling runs as today: reads the inbox, creates/append ticket channels, runs all downstream features.
 - **OFF** — Polling stops entirely. The mailbox is **never read** (inbox untouched). No new tickets are created from email.
 - **Outbound is unaffected** in both states — ticket-close emails, Gmail replies, and notification emails still send when staff act on existing tickets. (Decision: "off" scopes to inbound polling only.)
 - **Persists across restarts** — the off-state is honored on the next boot. (Decision: persisted, not runtime-only.)
 Discord-originated tickets are independent of email polling and are unaffected by this toggle.
 ## Decisions (locked)
 | Decision | Choice |
 |----------|--------|
 | Scope of OFF | Inbound polling only; outbound email still sends |
 | Persistence | Persist to `.env` via existing config-persistence path; honored on boot |
 | Command shape | New dedicated `/email on\|off\|status` command (Approach A) |
 | Existing `/gmailpoll` | Guarded so it cannot silently re-enable polling while flow is OFF |
 Rejected: folding into `/gmailpoll` subcommands (needless churn to a working command); sentinel interval `/gmailpoll 0` (poor discoverability).
 ## Architecture
 Single source of truth: a new boolean config flag `GMAIL_POLL_ENABLED` (default **true**). The live poll timer (`gmailPollInterval` in `broccolini-discord.js`) is started/stopped to match the flag.
 ### 1. Config flag — `GMAIL_POLL_ENABLED`
 - **`config.js`** — add:
  ```js
  GMAIL_POLL_ENABLED: process.env.GMAIL_POLL_ENABLED !== 'false',
  ```
  Undefined/absent → `true`, so existing deployments keep polling with no `.env` change required.
 - **`services/configSchema.js`** — add `'GMAIL_POLL_ENABLED'` to `ALLOWED_CONFIG_KEYS`. The existing `/ENABLED$/` rule in `inferType()` already classifies it as a boolean validator, so the settings site can also toggle it (bonus, no extra work).
 ### 2. Boot gate
 In `broccolini-discord.js` (`client.once('ready')`, currently ~lines 210-211), only start the poll when enabled:
 ```js
 if (CONFIG.GMAIL_POLL_ENABLED) {
  gmailPollInterval = trackInterval(setInterval(() => poll(client), CONFIG.GMAIL_POLL_INTERVAL_MS));
  poll(client);
 } else {
  console.log('Gmail poll disabled by config (GMAIL_POLL_ENABLED=false)');
 }
 ```
 When disabled, `gmailPollInterval` stays `null` — no timer is registered in `activeIntervals`, nothing reads the inbox.
 ### 3. `/email` command
 - **Registration** — `commands/register.js`: a `SlashCommandBuilder` named `email` with three subcommands (`on`, `off`, `status`), `setDefaultMemberPermissions(PermissionFlagsBits.ManageMessages)` to match sibling commands.
 - **Dispatch** — add `email: handleEmail` to `COMMAND_HANDLERS` in `handlers/commands/index.js`. Staff-gated automatically via `requireStaffRole()` at the dispatcher entry.
 - **Handler** — `handleEmail(interaction)`:
  - `on`:
    1. `applyConfigUpdates({ GMAIL_POLL_ENABLED: true })` (updates runtime `CONFIG` **and** writes `.env`).
    2. Clear the auth-suspend latch via `require('../../gmail-poll').setPollSuspended(false)` so a prior `invalid_grant` suspend doesn't keep polling dead. If auth is still broken, the next cycle re-suspends and DMs admin, exactly as today.
    3. `setGmailPollInterval(CONFIG.GMAIL_POLL_INTERVAL_MS)` to start the live timer.
    4. Reply (ephemeral): "Email flow is now **on**."
  - `off`:
    1. `applyConfigUpdates({ GMAIL_POLL_ENABLED: false })`.
    2. `clearGmailPollInterval()`.
    3. Reply (ephemeral): "Email flow is now **off** — the inbox will not be polled. Outbound emails still send."
  - `status`:
    - Report `CONFIG.GMAIL_POLL_ENABLED`, the current interval (`CONFIG.GMAIL_POLL_INTERVAL_MS / 1000`s), and whether polling is currently suspended by an auth error.
  - On `on`/`off`, fire `logTicketEvent('Email flow toggled', [...], interaction).catch(() => {})` — fire-and-forget, matching `/gmailpoll`.
 `applyConfigUpdates` is called in-process (the command runs inside the bot), reusing the same path the internal API uses — no HTTP round-trip.
 ### 4. Guard `/gmailpoll` against silent re-enable
 `handleGmailPoll` currently calls `setGmailPollInterval(ms)`, which *starts* the timer. While flow is OFF that would silently re-enable polling. Change it so that when `CONFIG.GMAIL_POLL_ENABLED` is false:
 - update the interval in memory only (`CONFIG.GMAIL_POLL_INTERVAL_MS = ms`) — matching `/gmailpoll`'s existing runtime-only model (it has never persisted to `.env`), but
 - do **not** start the live timer, and
 - reply: "Interval saved (`<n>`s), but the inbound email flow is currently **off** — it will apply when you run `/email on`."
 When flow is ON, `/gmailpoll` behaves exactly as today.
 ## Data flow
 ```
 /email off ──> applyConfigUpdates({GMAIL_POLL_ENABLED:false})  ──> CONFIG updated + .env written
           └─> clearGmailPollInterval()                        ──> live timer stopped, gmailPollInterval=null
                                                                    (no inbox reads)
 restart ──> config.js reads GMAIL_POLL_ENABLED=false ──> ready gate skips poll start ──> stays off
 /email on  ──> applyConfigUpdates({GMAIL_POLL_ENABLED:true})   ──> CONFIG updated + .env written
           ├─> setPollSuspended(false)                         ──> clear prior auth-suspend latch
           └─> setGmailPollInterval(interval)                  ──> live timer started, immediate poll
 ```
 ## Error handling
 - Command runs through `runHandler`, so any throw is logged and the user gets an ephemeral "Something went wrong."
 - `applyConfigUpdates` returns `{ applied, errors }`; if `GMAIL_POLL_ENABLED` lands in `errors` (should not, given the boolean validator), reply with the error rather than claiming success, and do not flip the live timer.
 - Logging stays fire-and-forget (`.catch(() => {})`), per Hard Rule 4.
 ## Files touched
 | File | Change |
 |------|--------|
 | `config.js` | Add `GMAIL_POLL_ENABLED` (default true) |
 | `services/configSchema.js` | Add `'GMAIL_POLL_ENABLED'` to `ALLOWED_CONFIG_KEYS` |
 | `broccolini-discord.js` | Gate poll start in `ready` on the flag |
 | `commands/register.js` | Register `/email on\|off\|status` |
 | `handlers/commands/index.js` | Add `handleEmail`; guard `handleGmailPoll` |
 | `.env.example` | Document `GMAIL_POLL_ENABLED` (optional, default true) |
 No DB schema changes. No destructive data ops. The mailbox is never read while OFF and is never written by this feature.
 ## Verification
 - `/email off` → logs show no further poll cycles; `.env` contains `GMAIL_POLL_ENABLED=false`.
 - Restart container → no polling on boot; `/email status` reports off.
 - `/email on` → poll resumes (immediate cycle), `.env` flips to `true`.
 - While OFF, `/gmailpoll 60` → interval saved, no polling starts.
 - `npm test` (covers `services/configSchema.js`); `node --check` on every edited file.
--- a/docs/superpowers/specs/2026-06-03-gmail-folder-routing-design.md
+++ b/docs/superpowers/specs/2026-06-03-gmail-folder-routing-design.md
@@ -0,0 +1,217 @@
 # Gmail Folder Routing — Design
 **Date:** 2026-06-03
 **Status:** Approved (design); pending implementation
 ## Goal
 Route a ticket's Gmail thread into Gmail "folders" (labels) as the ticket moves
 through its lifecycle, plus a manual `/folder` command for ad-hoc filing.
 - On **ticket creation**, the source email thread goes into a **Triage** folder
  (instead of the current plain archive).
 - On **escalation**, the thread moves to an **Escalated** folder.
 - On **resolution** (close), the thread moves to a **Resolved** folder.
 - A **`/folder`** slash command lets staff move the current ticket's thread to one
  of four manual folders: **For Jake**, **Spam**, **Dashboard Errors**,
  **Partnership Offers**.
 Discord-originated tickets (`gmailThreadId` prefixed `discord-`) have no Gmail
 thread and are untouched by all of the above.
 ## Decisions (locked)
 | Decision | Choice |
 |----------|--------|
 | Folder semantics | **Exclusive** — moving to a folder removes every other managed label and drops the thread out of the Inbox. A thread lives in exactly one managed folder. |
 | "Spam" target | Gmail's **built-in system `SPAM`** label (trains the filter, hides from normal views). |
 | Label names | **Configurable via `.env`**, defaulting to the names above. |
 | Missing labels | **Auto-created** on first use (idempotent, cached). The system `SPAM` label is never created. |
 | `/folder` options | Exactly the **4 manual folders**. Triage/Escalated/Resolved are lifecycle-driven only, not manually selectable. |
 | De-escalation | **Leaves the folder as Escalated** — no auto-move back. |
 Gmail labels are additive by nature; "exclusive folder" behavior is synthesized by
 always removing the other managed labels on every move (removing an absent label is
 a no-op, so this is safe and idempotent).
 ## Architecture
 ### 1. New module — `services/gmailLabels.js`
 Single home for all label logic. Folders defined by logical key:
 | Key | Source | Default name |
 |-----|--------|--------------|
 | `TRIAGE` | `CONFIG.GMAIL_LABEL_TRIAGE` (`.env GMAIL_LABEL_TRIAGE`) | `Triage` |
 | `ESCALATED` | `CONFIG.GMAIL_LABEL_ESCALATED` | `Escalated` |
 | `RESOLVED` | `CONFIG.GMAIL_LABEL_RESOLVED` | `Resolved` |
 | `FOR_JAKE` | `CONFIG.GMAIL_LABEL_FOR_JAKE` | `For Jake` |
 | `DASHBOARD_ERRORS` | `CONFIG.GMAIL_LABEL_DASHBOARD_ERRORS` | `Dashboard Errors` |
 | `PARTNERSHIP_OFFERS` | `CONFIG.GMAIL_LABEL_PARTNERSHIP_OFFERS` | `Partnership Offers` |
 | `SPAM` | built-in system label `SPAM` | (not configurable) |
 `MANAGED_USER_KEYS` = all keys except `SPAM` (these are the user labels whose IDs
 get resolved/created and which participate in the remove-others set).
 **Exports:**
 - `moveThreadToFolder(threadId, folderKey, gmail = getGmailClient())` — the one
  operation everything calls.
  1. Resolve the target label ID (`resolveLabelId`), and the IDs of all managed
     user labels (to build the remove set).
  2. `addLabelIds = [targetId]`.
  3. `removeLabelIds = [all managed user-label IDs except target] + ['INBOX', 'UNREAD']`
     (computed by `computeLabelMutation`). For `SPAM` target, the user labels are
     all removed and `SPAM` is added; `INBOX`/`UNREAD` removed as usual.
  4. `await gmail.users.threads.modify({ userId: 'me', id: threadId, requestBody: { addLabelIds, removeLabelIds } })`.
  - On a `400` "invalid label" (stale cached ID for a label deleted in Gmail),
    clear the cache and retry once.
 - `resolveLabelId(gmail, key)` — returns the Gmail label ID for a key.
  - `SPAM` short-circuits to `'SPAM'`.
  - Otherwise: check the module-scoped name→ID cache; on miss, `users.labels.list`
    and match by name (case-sensitive, Gmail's behavior); if still absent,
    `users.labels.create` it (`labelListVisibility: 'labelShow'`,
    `messageListVisibility: 'show'`) and cache the new ID.
 - `computeLabelMutation(targetKey, idByKey)` — **pure** function returning
  `{ addLabelIds, removeLabelIds }`. Split out for unit testing without the network.
 **Caching:** module-scoped `Map` of label-name → ID, populated lazily. Cleared and
 re-fetched on a stale-label error.
 **Client:** `getGmailClient` is required from `services/gmail.js` (acyclic —
 `gmail.js` does not depend on `gmailLabels.js`). Callers that already hold a client
 (the poll loop) pass it in; others let the default create one.
 ### 2. Triage on ticket creation — `gmail-poll.js`
 Today every processed message hits `markGmailMessageRead` (strips `INBOX`+`UNREAD`)
 at the shared bottom of the per-message loop (~line 397). Restructure so the
 archive action is branch-specific:
 - **New ticket created** (and the **reopened** closed→open case, which runs in the
  create branch) → `await moveThreadToFolder(parsed.threadId, 'TRIAGE', gmail)`.
 - **Follow-up to an existing open ticket** (the `if (ticketChan)` append branch) →
  keep `markGmailMessageRead(gmail, msgRef)`. A reply on a thread already filed
  under "For Jake"/"Resolved" should not be dragged back to Triage automatically.
 - **Self / limit-exceeded / create-failure** early-`continue` paths → unchanged
  plain archive (they already call `markGmailMessageRead` before `continue`).
 The shared bottom `markGmailMessageRead` call is removed; the two surviving paths
 (append, create) each archive/move explicitly.
 `moveThreadToFolder` on creation is awaited inside the existing try/catch; a failure
 is logged via the poll's existing error handling and does not abort the loop.
 ### 3. Escalated hook — `handlers/commands/escalation.js`
 `runEscalation` is shared by the `/escalate` slash command and the tier-pick
 buttons (single hook site). Inside the existing
 `if (!isDiscordTicket && ticket.gmailThreadId)` block (where the escalation
 notification email is already sent), add:
 ```js
 moveThreadToFolder(ticket.gmailThreadId, 'ESCALATED')
  .catch(err => logError('gmailLabels: escalate move', err).catch(() => {}));
 ```
 Non-fatal — a label failure never blocks the escalation. De-escalation
 (`runDeescalation`) is **not** modified.
 ### 4. Resolved hook — two close finalizers
 Both finalizers set `status: 'closed'` and remain separate:
 - `handlers/commands/close.js` → `finalizeForceClose`
 - `handlers/buttons.js` → `runFinalClose`
 In each, for non-Discord tickets (`!ticket.gmailThreadId.startsWith('discord-')`),
 after the status update, add a non-fatal:
 ```js
 moveThreadToFolder(ticket.gmailThreadId, 'RESOLVED')
  .catch(err => logError('gmailLabels: resolved move', err).catch(() => {}));
 ```
 One added line per finalizer. The move runs regardless of whether a close email is
 sent (so close-without-email still files the thread under Resolved).
 ### 5. `/folder` command
 - **Registration** (`commands/register.js`): `SlashCommandBuilder` named `folder`,
  `setDefaultMemberPermissions(ManageMessages)`, Guild context / GuildInstall, with
  a required string option `destination` and choices:
  - `For Jake` → `FOR_JAKE`
  - `Spam` → `SPAM`
  - `Dashboard Errors` → `DASHBOARD_ERRORS`
  - `Partnership Offers` → `PARTNERSHIP_OFFERS`
 - **Dispatch** (`handlers/commands/index.js`): add `folder: handleFolder` to
  `COMMAND_HANDLERS`; add a `/folder` line to `/help`.
 - **Handler** `handleFolder(interaction)`:
  1. `findTicketForChannel(interaction)`; bail if none.
  2. If `ticket.gmailThreadId.startsWith('discord-')` → ephemeral
     "This ticket has no email thread, so it can't be moved to a Gmail folder."
  3. Otherwise `await moveThreadToFolder(ticket.gmailThreadId, folderKey)`.
  4. Ephemeral reply: "Moved this ticket's email thread to **<label>**."
  5. `logTicketEvent('Email thread filed', [...], interaction).catch(() => {})`.
  6. On error, ephemeral "Failed to move the email thread: <reason>."
 ### 6. Config & docs
 - `config.js`: add the six `GMAIL_LABEL_*` keys with the default names above.
 - `.env.example`: document the six vars (default-on naming).
 - Not added to `ALLOWED_CONFIG_KEYS` — settings-site contract unchanged.
 ## Data flow
 ```
 inbound email (poll, flow ON)
  └─ new ticket  ──> moveThreadToFolder(thread, TRIAGE)   [add Triage; remove others+INBOX+UNREAD]
  └─ follow-up   ──> markGmailMessageRead(msg)            [remove INBOX+UNREAD on the new msg only]
 /escalate or tier button ──> runEscalation ──> moveThreadToFolder(thread, ESCALATED)
 close (slash or button)  ──> finalize       ──> moveThreadToFolder(thread, RESOLVED)
 /folder <dest>           ──> handleFolder    ──> moveThreadToFolder(thread, <dest|SPAM>)
 ```
 Every `moveThreadToFolder` resolves IDs (creating missing user labels), then one
 `threads.modify` enforcing exclusive-folder semantics.
 ## Error handling
 - Lifecycle hooks (Triage/Escalated/Resolved) are non-fatal `.catch` — Gmail
  problems never block ticket flow. Errors logged via `logError`.
 - `/folder` surfaces failures to the invoking staffer ephemerally.
 - Stale cached label ID → one cache-clear + retry inside `moveThreadToFolder`.
 - Label operations are independent of `CONFIG.GMAIL_POLL_ENABLED` (the `/email`
  toggle): they are explicit staff/lifecycle actions, not polling. Triage-on-create
  only fires during polling, so it is naturally inert while the flow is off.
 ## Files touched
 | File | Change |
 |------|--------|
 | `services/gmailLabels.js` | **New** — folder defs, `moveThreadToFolder`, `resolveLabelId`, `computeLabelMutation`, cache |
 | `tests/gmailLabels.test.js` | **New** — unit tests for mutation logic + label resolution |
 | `config.js` | Add six `GMAIL_LABEL_*` config keys (defaults) |
 | `.env.example` | Document the six label-name vars |
 | `gmail-poll.js` | Triage on create/reopen; keep plain archive for follow-ups & non-ticket paths |
 | `handlers/commands/escalation.js` | `runEscalation`: move thread to Escalated (non-fatal) |
 | `handlers/commands/close.js` | `finalizeForceClose`: move thread to Resolved (non-fatal) |
 | `handlers/buttons.js` | `runFinalClose`: move thread to Resolved (non-fatal) |
 | `commands/register.js` | Register `/folder` with 4 choices |
 | `handlers/commands/index.js` | `handleFolder` + dispatch entry + `/help` line |
 No DB schema changes. No destructive data ops — `threads.modify` only relabels;
 nothing is deleted or trashed. (Moving to `SPAM` is reversible from Gmail.)
 ## Verification
 - `npm test` — existing suite plus new `tests/gmailLabels.test.js`
  (`computeLabelMutation` exclusivity; `resolveLabelId` cache-hit / create-on-miss /
  SPAM short-circuit, with a fake gmail client).
 - `node --check` on every edited file.
 - Manual (post-deploy): create an email ticket → its thread lands in Triage and
  leaves the inbox; `/escalate` → Escalated; `/folder For Jake` → For Jake (and out
  of Escalated); close → Resolved. Discord ticket → `/folder` reports no email
  thread.
--- a/docs/superpowers/specs/2026-06-04-per-staff-metrics-design.md
+++ b/docs/superpowers/specs/2026-06-04-per-staff-metrics-design.md
@@ -0,0 +1,176 @@
 # Per-Staff Metrics & Ticket Analytics — Design
 **Date:** 2026-06-04
 **Status:** Approved (design); implementation pending
 **Component:** broccolini-bot
 ## Goal
 Capture per-staff and per-ticket activity as a durable, event-sourced log, and
 expose a useful subset via a `/stats` command. The event log is the foundation
 for a future analytics dashboard on the tickets website (graphs, timing
 analyses, busiest-time heatmaps, per-game and per-emailer reporting).
 **Principle: collect rich data now** (history cannot be backfilled); `/stats` v1
 surfaces the count metrics; timing/temporal metrics are collected but displayed
 on the website later.
 Because it is event-sourced, interpretation questions (does a reopen revoke
 resolution credit? does time-open reset?) do **not** need a single baked-in
 answer — events are recorded with timestamps and the query layer decides.
 ## Metrics
 ### Counts (shown in `/stats` v1, per staff member)
 - **Claims**; **claims while escalated, by tier** (`claim` events with `tier > 0`)
 - **Closes** performed by the staff member
 - **Resolved (credit)** — closes where the staff member was the **claimer**
 - **Escalations** / **De-escalations**, by tier
 - **Unclaimed-at-close** — closes where the ticket had no claimer
 - **Transfers** (initiated / received); **Reopens** (rate)
 - Every count sliceable **email vs discord** and by **priority**
 ### Ticket volume & temporal (derived from `Ticket` collection)
 - Total tickets, **email vs discord**, over a window.
 - **Busiest times** — distribution of `createdAt` by hour-of-day and day-of-week
  (and `closedAt` similarly). Stored as full UTC datetimes; website buckets/TZ-adjusts.
 ### Timing (collected now; website-only display in v1)
 Derived from event timestamps + `ticket.createdAt` / `closedAt`:
 - time to first staff response; time to claim; time open (created → closed)
 - time to escalation; time to first response & to claim after escalation
 - time to close after escalation; total time open across reopen cycles
 ## Ticket source & tier
 - **Source:** `discord` if `gmailThreadId` starts with `discord-`/`discord-msg-`, else `email`. Denormalized as `ticketType` on every event.
 - **Requester:** email tickets are attributed to `senderEmail`; discord tickets to the creator's `creatorId`. Both denormalized onto events so per-emailer (email) and per-user (discord) reporting work, sliceable by source.
 - **Tier** (existing convention): `0` normal, `1` → "Tier 2 Support", `2` → "Tier 3 Support". Events store raw numeric `tier`; `/stats` mirrors the labels.
 ## Data model
 ### New model `StaffAction` (event log, in `models.js`)
 ```
 {
  staffId:       String,   // actor's Discord user ID ('system' for automated)
  type:          String,   // 'claim'|'response'|'escalate'|'deescalate'|'close'|'reopen'|'transfer'
  tier:          Number,   // ticket escalationTier at the moment (0 if none)
  ticketType:    String,   // 'email' | 'discord'
  priority:      String,   // ticket priority at the moment
  game:          String,   // detected game (denormalized)
  senderEmail:   String,   // requester for EMAIL tickets (denormalized)
  creatorId:     String,   // requester for DISCORD tickets — creator's user ID (denormalized)
  gmailThreadId: String,   // ticket linkage / per-ticket timeline join key
  guildId:       String,
  createdAt:     Date,      // default: Date.now (function reference)
  // close-only:
  closerType:    String,   // 'staff' | 'user' | 'system'
  resolverId:    String,   // ticket.claimerId at close (credit); null if unclaimed
  wasClaimed:    Boolean,   // false → unclaimed-at-close
  // transfer-only:
  fromId:        String,    // previous claimer
  toId:          String     // new claimer
 }
 ```
 For `close`, `staffId` = the closer, `resolverId` = the claimer credited.
 For `transfer`, `staffId` = who ran `/transfer`.
 For `reopen`, `staffId` = `'system'` (customer email reply re-opens the thread).
 Indexes: `{ staffId: 1, createdAt: -1 }` and `{ gmailThreadId: 1, createdAt: 1 }`.
 ### `Ticket` schema changes
 - `game: String` — set at creation from existing `detectGame(subject, rawBody)`.
 - `closedAt: Date` — set when a ticket is closed (robust source for time-open /
  busiest-close-times even if events are pruned).
 ## Recording
 New `services/staffStats.js` → `recordAction(staffId, type, payload)`,
 fire-and-forget (`.catch(() => {})`), never blocking the action. `ticketType`,
 `priority`, `game`, `senderEmail` read from the ticket being acted on.
 **Idempotency (correctness requirement):** record an event **only on a successful
 state transition** — a claim that actually set the claimer, a close that actually
 closed, an escalate that changed tier. No-op / rejected / double-click
 interactions must not produce events.
 | Event        | Site                                                  | Notes |
 |--------------|-------------------------------------------------------|-------|
 | `claim`      | `handlers/buttons.js` `handleClaimButton`             | only if claim succeeds; `tier` = current |
 | `response`   | `handlers/messages.js` `handleDiscordReply`           | only when author `isStaff`; email & discord; before the email-only early return |
 | `escalate`   | `handlers/commands/escalation.js` `runEscalation`     | `tier` = new tier |
 | `deescalate` | `handlers/commands/escalation.js` `runDeescalation`   | `tier` = new tier |
 | `transfer`   | `handlers/commands/index.js` `handleTransfer`         | `fromId` = old claimer, `toId` = target, actor = runner |
 | `close`      | `handlers/buttons.js` `runFinalClose`                 | sets `closerType`/`resolverId`/`wasClaimed`; also set `ticket.closedAt` |
 | `close`      | `handlers/commands/close.js` `finalizeForceClose`     | capture closer ID via `pendingCloses` (store `interaction.user.id` at countdown start) |
 | `reopen`     | `gmail-poll.js` reopen path (`existing.status === 'closed'`) | `staffId='system'`, customer-driven |
 Auto-close (`services/tickets.js`) and orphan-channel reconcile / auto-unclaim
 closes → `close` with `closerType: 'system'`, `staffId: 'system'`, preserving
 `resolverId`/`wasClaimed` so resolution credit and unclaimed-at-close still count
 without attributing a human.
 `response` volume: record each staff reply (low volume); "first response" =
 `min(createdAt)`; "after escalation" = first `response` after the `escalate` event.
 ## `/stats` command
 Registered in `commands/register.js`; handler in the commands layer.
 - `period` — string, **autocomplete + free text**, default **30 days**. Suggestions:
  `7 days`, `30 days`, `3 months`, `6 months`, `1 year`. Parses `<n>d/w/m/mo/y` and
  bare number = days; unparseable → 30 days.
 - `member` — optional user.
 - `source` — optional choice: **all** (default) / **email** / **discord**. Filters
  every metric by `ticketType`, so the same command shows combined stats or a
  single channel's stats.
 Gating: `setDefaultMemberPermissions(ManageMessages)` + `requireStaffRole`,
 ephemeral. No `member` → caller's own; `member` set → only if caller ∈
 `STATS_ADMIN_IDS`, else "You can only view your own stats."
 The command shows the **full** count metric set (not a trimmed subset); `source`
 toggles between combined and per-channel views. Aggregation: MongoDB pipeline over
 `StaffAction` (+ `Ticket` for volume) filtered by actor, `createdAt >= now - window`,
 and optional `ticketType`, grouped by `type`/`tier`/`ticketType`/`priority`.
 ### Display (embed, v1 — counts)
 ```
 📊 Stats — @member · last 30 days        (email 30 · discord 12)
 Claimed: 42        (while escalated — Tier 2: 5 · Tier 3: 1)
 Closed: 38         (unclaimed: 4)
 Resolved (credited): 35
 Escalated:         Tier 2: 4 · Tier 3: 1
 De-escalated:      Tier 2: 1 · Tier 3: 0
 Transfers: in 2 · out 3       Reopens (their resolved tickets): 1
 ```
 Timing/busiest-times not shown in v1 — collected for the website.
 ## Configuration
 ```
 STATS_ADMIN_IDS=321754640431710226,691678135527276614,224692549225283584
 ```
 (chicken, broccoli, ketchup) — comma-separated; users allowed to view others' stats.
 ## Non-goals (v1)
 - Tag / Gmail-folder / canned-response usage tracking (dropped).
 - Unclaim-action tracking (we track unclaimed-*at-close*).
 - Multi-staff leaderboard (per-member view only).
 - Website dashboard, graphs, timing/busiest-time displays, per-game/per-emailer
  reports, internal-API stats endpoint. **Deferred** — data captured now.
 - SLA / business-hours adjustment of timings (website computes from raw UTC).
 - Event-log pruning (volume is low; revisit if needed).
 ## Verification
 - Unit: period parser; aggregation shaping (counts by type/tier/ticketType/priority;
  resolved-credit; unclaimed-at-close; transfer in/out; reopen).
 - Unit: idempotency — no event on no-op claim/close.
 - Manual: run claim/respond/escalate/deescalate/transfer/close/reopen across a test
  email ticket and a test discord ticket; confirm `StaffAction` docs and fields,
  `ticket.game`/`closedAt`; confirm per-ticket timeline yields timing deltas;
  `/stats` counts + email/discord split; non-admin can't view others, admin can.
  Deploy `docker compose up --build -d`; confirm bot logs ready.
 ```
--- a/gmail-poll.js
+++ b/gmail-poll.js
@@ -21,6 +21,7 @@ const {
  sanitizeEmbedText
 } = require('./utils');
 const { getGmailClient } = require('./services/gmail');
 const { moveThreadToFolder } = require('./services/gmailLabels');
 const { getNextTicketNumber, checkTicketLimits, getOrCreateTicketCategory, toDiscordSafeName, getSenderLocal } = require('./services/tickets');
 const { logError } = require('./services/debugLog');
 const { enqueueSend } = require('./services/channelQueue');
@@ -153,22 +154,11 @@ async function findOrCreateTicketChannel(guild, parsed, number) {
    const channel = await guild.channels.create({
      name: chanName,
      type: ChannelType.GuildText,
-      parent: parentCategoryId,
+      parent: parentCategoryId
-      // Email tickets have no Discord creator — the customer is reachable
+      // Permissions are inherited from the ticket category — configure that
-      // only by email. So the only per-channel allow is the staff role; we
+      // category to deny @everyone View Channel and allow the staff role, so
-      // still explicitly deny @everyone in case the category permissions
+      // tickets stay staff-only. Inheriting (rather than setting per-channel
-      // are ever misconfigured to grant View Channel server-wide.
+      // overwrites here) means the bot does not need the Manage Roles permission.
      permissionOverwrites: [
        { id: guild.id, deny: [PermissionFlagsBits.ViewChannel] },
        ...(CONFIG.ROLE_ID_TO_PING ? [{
          id: CONFIG.ROLE_ID_TO_PING,
          allow: [
            PermissionFlagsBits.ViewChannel,
            PermissionFlagsBits.SendMessages,
            PermissionFlagsBits.ReadMessageHistory
          ]
        }] : [])
      ]
    });
    return { channel, parentCategoryId };
  } catch (createErr) {
@@ -277,7 +267,7 @@ async function poll(client) {
      const gmail = getGmailClient();
      const list = await gmail.users.messages.list({
        userId: 'me',
-        q: 'is:unread category:primary'
+        q: 'is:unread in:inbox'
      });
      if (!list.data.messages) return;
@@ -310,11 +300,15 @@ async function poll(client) {
        if (ticketChan) {
          // Append follow-up to existing channel.
          const truncatedFollowup = parsed.followupBody.slice(0, 1800);
-          // Role ping is intentional; body is attacker-controlled email content — suppress user/everyone mentions.
+          // No staff role ping; body is attacker-controlled email content — suppress all mentions.
          await enqueueSend(ticketChan, {
-            content: `<@&${CONFIG.ROLE_ID_TO_PING}>\n**New Follow-up from ${parsed.senderEmail}:**\n${truncatedFollowup}`,
+            content: `**New Follow-up from ${parsed.senderEmail}:**\n${truncatedFollowup}`,
-            allowedMentions: { parse: ['roles'] }
+            allowedMentions: { parse: [] }
          });
          // Follow-up on an existing thread: archive the new message only. Leave
          // whatever managed folder staff filed this thread under untouched.
          console.log('Archiving/reading Gmail message', msgRef.id);
          await markGmailMessageRead(gmail, msgRef);
        } else {
          // Create a new ticket channel.
          const limitCheck = await checkTicketLimits(parsed.senderEmail);
@@ -345,10 +339,9 @@ async function poll(client) {
            );
          const welcomeMsg = await enqueueSend(ticketChan, {
            content: `<@&${CONFIG.ROLE_ID_TO_PING}>`,
            embeds: [ticketInfoEmbed],
            components: [buttons],
-            allowedMentions: { parse: ['roles'] }
+            allowedMentions: { parse: [] }
          });
          const { createStaffThread } = require('./services/staffThread');
@@ -392,10 +385,13 @@ async function poll(client) {
            },
            { upsert: true, new: true }
          ));
        }
-        console.log('Archiving/reading Gmail message', msgRef.id);
+          // New (or reopened) ticket: file the email thread into Triage — out of
-        await markGmailMessageRead(gmail, msgRef);
+          // the inbox, marked read, awaiting staff action. The threads.modify also
          // clears UNREAD, so a success archives it like markGmailMessageRead did.
          console.log('Filing Gmail thread into Triage', parsed.threadId);
          await moveThreadToFolder(parsed.threadId, 'TRIAGE', gmail);
        }
      }
      authErrorNotified = false;
    } catch (e) {
--- a/handlers/buttons.js
+++ b/handlers/buttons.js
@@ -24,6 +24,7 @@ const { mongoose } = require('../db-connection');
 const { CONFIG } = require('../config');
 const { makeTicketName, resolveCreatorNickname, getOrCreateTicketCategory, cleanupEmptyOverflowCategory, checkTicketCreationRateLimit, toDiscordSafeName } = require('../services/tickets');
 const { sendTicketClosedEmail } = require('../services/gmail');
 const { moveThreadToFolder } = require('../services/gmailLabels');
 const { getTicketActionRow, ticketChannelOverwrites } = require('../utils/ticketComponents');
 const { buildTranscriptText, formatDateForTranscript, renderTranscriptHeader } = require('../services/transcript');
 const { sanitizeEmbedText, truncateEmbedDescription } = require('../utils');
@@ -422,7 +423,8 @@ async function runFinalClose(interaction, ticket, sendEmail = true) {
    if (transcriptChan) {
      transcriptMsg = await enqueueSend(transcriptChan, {
        content: transcriptContent,
-        files: [file]
+        files: [file],
        allowedMentions: { parse: [] }
      });
    }
@@ -447,6 +449,12 @@ async function runFinalClose(interaction, ticket, sendEmail = true) {
      { $set: { discordThreadId: null, status: 'closed' }, $unset: { welcomeMessageId: '' } }
    );
    // File the email thread into the Resolved folder — non-fatal, email tickets only.
    if (!ticket.gmailThreadId?.startsWith('discord-')) {
      moveThreadToFolder(ticket.gmailThreadId, 'RESOLVED')
        .catch(err => logError('gmailLabels: resolved move', err).catch(() => {}));
    }
    if (transcriptMsg?.id) {
      await Transcript.create({
        gmailThreadId: ticket.gmailThreadId,
@@ -519,7 +527,7 @@ async function postCloseLogEntry(interaction, ticket, channelName) {
  } else {
    logMsg = `Closed **${channelName}** (${ticket.senderEmail}) by ${closerMention} (${closerDisplayName})`;
  }
-  await enqueueSend(logChan, logMsg);
+  await enqueueSend(logChan, { content: logMsg, allowedMentions: { parse: [] } });
 }
 // ============================================================
@@ -607,7 +615,7 @@ async function handleTicketModal(interaction) {
    if (CONFIG.LOGGING_CHANNEL_ID) {
      const logChan = await interaction.client.channels.fetch(CONFIG.LOGGING_CHANNEL_ID).catch(() => null);
      if (logChan) {
-        await enqueueSend(logChan, `📝 ${channel.name} created by ${interaction.user.tag}`);
+        await enqueueSend(logChan, { content: `📝 ${channel.name} created by ${interaction.user.tag}`, allowedMentions: { parse: [] } });
      }
    }
  } catch (err) {
--- a/handlers/commands/close.js
+++ b/handlers/commands/close.js
@@ -11,7 +11,8 @@ const { AttachmentBuilder, MessageFlags } = require('discord.js');
 const { mongoose } = require('../../db-connection');
 const { CONFIG } = require('../../config');
 const { enqueueSend } = require('../../services/channelQueue');
-const { logTicketEvent } = require('../../services/debugLog');
+const { logTicketEvent, logError } = require('../../services/debugLog');
 const { moveThreadToFolder } = require('../../services/gmailLabels');
 const { pendingCloses } = require('../pendingCloses');
 const { findTicketForChannel } = require('../sharedHelpers');
 const { buildTranscriptText, formatDateForTranscript, renderTranscriptHeader } = require('../../services/transcript');
@@ -74,6 +75,12 @@ async function finalizeForceClose(channelRef, clientRef) {
      { $set: { status: 'closed' }, $unset: { welcomeMessageId: '' } }
    );
    // File the email thread into the Resolved folder — non-fatal, email tickets only.
    if (!freshTicket.gmailThreadId.startsWith('discord-')) {
      moveThreadToFolder(freshTicket.gmailThreadId, 'RESOLVED')
        .catch(err => logError('gmailLabels: resolved move', err).catch(() => {}));
    }
    await enqueueSend(channelRef, 'Ticket force-closed. Archiving...');
    await postTranscript(channelRef, clientRef, freshTicket).catch(tErr =>
      console.error('Transcript error (force-close):', tErr)
@@ -106,7 +113,7 @@ async function postTranscript(channelRef, clientRef, freshTicket) {
  const openedStr = formatDateForTranscript(freshTicket.createdAt);
  const closedStr = formatDateForTranscript(new Date());
  const transcriptContent = renderTranscriptHeader(channelRef.name, freshTicket.senderEmail, openedStr, closedStr);
-  await enqueueSend(transcriptChan, { content: transcriptContent, files: [file] });
+  await enqueueSend(transcriptChan, { content: transcriptContent, files: [file], allowedMentions: { parse: [] } });
 }
 module.exports = { handleCloseTimer, handleCancelClose, handleForceClose };
--- a/handlers/commands/escalation.js
+++ b/handlers/commands/escalation.js
@@ -10,6 +10,7 @@ const { mongoose } = require('../../db-connection');
 const { CONFIG } = require('../../config');
 const { makeTicketName, resolveCreatorNickname } = require('../../services/tickets');
 const { sendTicketNotificationEmail } = require('../../services/gmail');
 const { moveThreadToFolder } = require('../../services/gmailLabels');
 const { getTicketActionRow } = require('../../utils/ticketComponents');
 const { enqueueRename, enqueueMove, enqueueSend } = require('../../services/channelQueue');
 const { pinMessage } = require('../../services/pinMessage');
@@ -98,11 +99,20 @@ async function runEscalation(interaction, ticket, nextTier) {
    try {
      const escalatorName = interaction.member?.displayName || interaction.user.username;
      const tierLabel = nextTier === 1 ? 'tier 2' : 'tier 3';
-      const emailBody = `${escalatorName} escalated this ticket to ${tierLabel}.`;
+      // Editable via TICKET_ESCALATION_EMAIL_MESSAGE in .env. Placeholders:
      // {escalator_name}, {tier}; \n for line breaks.
      const emailBody = (CONFIG.TICKET_ESCALATION_EMAIL_MESSAGE || '')
        .replace(/\\n/g, '\n')
        .replace(/\{escalator_name\}/g, escalatorName)
        .replace(/\{tier\}/g, tierLabel);
      await sendTicketNotificationEmail(ticket, emailBody, interaction.user.id);
    } catch (emailErr) {
      console.error('Escalation email failed (non-fatal):', emailErr.message);
    }
    // File the email thread into the Escalated folder — non-fatal, never blocks
    // the escalation.
    moveThreadToFolder(ticket.gmailThreadId, 'ESCALATED')
      .catch(err => logError('gmailLabels: escalate move', err).catch(() => {}));
  }
  if (nextTier === 2 && ticket.welcomeMessageId) {
@@ -118,9 +128,10 @@ async function runEscalation(interaction, ticket, nextTier) {
  if (logChan) {
    const ticketType = isDiscordTicket ? 'Discord' : 'Email';
    const tierLabel = nextTier === 1 ? 'tier 2' : 'tier 3';
-    await enqueueSend(logChan,
+    await enqueueSend(logChan, {
-      `${ticketType} ticket ${interaction.channel} escalated to ${tierLabel} by ${interaction.user.tag}.`
+      content: `${ticketType} ticket ${interaction.channel} escalated to ${tierLabel} by ${interaction.user.tag}.`,
-    );
+      allowedMentions: { parse: [] }
    });
  }
 }
@@ -168,9 +179,10 @@ async function runDeescalation(interaction, ticket) {
  const logChan = await fetchLoggingChannel(interaction.client);
  if (logChan) {
    const ticketType = isDiscordTicket ? 'Discord' : 'Email';
-    await enqueueSend(logChan,
+    await enqueueSend(logChan, {
-      `${ticketType} ticket ${interaction.channel} de‑escalated to ${tierLabel} by ${interaction.user.tag}.`
+      content: `${ticketType} ticket ${interaction.channel} de‑escalated to ${tierLabel} by ${interaction.user.tag}.`,
-    );
+      allowedMentions: { parse: [] }
    });
  }
 }
--- a/handlers/commands/index.js
+++ b/handlers/commands/index.js
@@ -22,6 +22,8 @@ const { setNotifyDm } = require('../../services/staffSettings');
 const { makeTicketName, resolveCreatorNickname } = require('../../services/tickets');
 const { enqueueRename, enqueueMove, enqueueOverwrite, enqueueTopic, enqueueSend } = require('../../services/channelQueue');
 const { logError, logTicketEvent } = require('../../services/debugLog');
 const { applyConfigUpdates } = require('../../services/configPersistence');
 const { moveThreadToFolder, folderDisplayName } = require('../../services/gmailLabels');
 const { findTicketForChannel } = require('../sharedHelpers');
 const { requireStaffRole, fetchLoggingChannel } = require('./helpers');
@@ -152,7 +154,7 @@ async function handleTransfer(interaction) {
    if (logChan) {
      await enqueueSend(logChan, {
        content: `Ticket ${interaction.channel} transferred from ${interaction.user.tag} to ${member.tag}.\nReason: ${reason}`,
-        allowedMentions: { parse: ['users'] }
+        allowedMentions: { parse: [] }
      });
    }
  } catch (err) {
@@ -176,9 +178,10 @@ async function handleMove(interaction) {
    const logChan = await fetchLoggingChannel(interaction.client);
    if (logChan) {
-      await enqueueSend(logChan,
+      await enqueueSend(logChan, {
-        `Ticket ${interaction.channel} moved to category **${category.name}** by ${interaction.user.tag}`
+        content: `Ticket ${interaction.channel} moved to category **${category.name}** by ${interaction.user.tag}`,
-      );
+        allowedMentions: { parse: [] }
      });
    }
  } catch (err) {
    console.error('Move error:', err);
@@ -245,6 +248,16 @@ async function handleGmailPoll(interaction) {
  // drop below 30s and trip Gmail's per-user quota under sustained load.
  const ms = Math.max(30000, requested * 1000);
  const seconds = ms / 1000;
  // While the inbound email flow is off, setting an interval must NOT silently
  // restart polling. Record it for this session (matches /gmailpoll's existing
  // runtime-only model) so it applies the next time someone runs /email on.
  if (!CONFIG.GMAIL_POLL_ENABLED) {
    CONFIG.GMAIL_POLL_INTERVAL_MS = ms;
    return interaction.reply({
      content: `Interval saved (${seconds}s), but the inbound email flow is currently **off** — it will apply when you run \`/email on\`.`,
      flags: MessageFlags.Ephemeral
    });
  }
  // Lazy require — broccolini-discord re-exports this and we'd otherwise cycle.
  const { setGmailPollInterval } = require('../../broccolini-discord');
  setGmailPollInterval(ms);
@@ -255,6 +268,82 @@ async function handleGmailPoll(interaction) {
  return interaction.reply({ content: `Gmail poll interval set to ${seconds} seconds.`, flags: MessageFlags.Ephemeral });
 }
 async function handleEmail(interaction) {
  const sub = interaction.options.getSubcommand();
  if (sub === 'status') {
    const intervalSec = Math.round(CONFIG.GMAIL_POLL_INTERVAL_MS / 1000);
    return interaction.reply({
      content: `Inbound email flow is **${CONFIG.GMAIL_POLL_ENABLED ? 'on' : 'off'}**.\nPoll interval: ${intervalSec}s.`,
      flags: MessageFlags.Ephemeral
    });
  }
  const enable = sub === 'on';
  // applyConfigUpdates writes both CONFIG and .env so the state survives restart.
  const { applied, errors } = applyConfigUpdates({ GMAIL_POLL_ENABLED: enable });
  if (!applied.includes('GMAIL_POLL_ENABLED')) {
    const reason = (errors.find(e => e.key === 'GMAIL_POLL_ENABLED') || {}).error || 'unknown error';
    return interaction.reply({
      content: `Failed to turn email flow ${enable ? 'on' : 'off'}: ${reason}`,
      flags: MessageFlags.Ephemeral
    });
  }
  // Lazy require — broccolini-discord re-exports these and we'd otherwise cycle.
  const { setGmailPollInterval, clearGmailPollInterval } = require('../../broccolini-discord');
  if (enable) {
    // Clear any auth-suspend latch so a prior invalid_grant doesn't keep polling
    // dead. If auth is still broken, the next cycle re-suspends and DMs admin.
    try { require('../../gmail-poll').setPollSuspended(false); } catch (_) {}
    setGmailPollInterval(CONFIG.GMAIL_POLL_INTERVAL_MS);
  } else {
    clearGmailPollInterval();
  }
  logTicketEvent('Email flow toggled', [
    { name: 'State', value: enable ? 'on' : 'off' },
    { name: 'Set by', value: interaction.user.tag }
  ], interaction).catch(() => {});
  return interaction.reply({
    content: enable
      ? 'Inbound email flow is now **on** — the inbox will be polled.'
      : 'Inbound email flow is now **off** — the inbox will not be polled. Outbound emails still send.',
    flags: MessageFlags.Ephemeral
  });
 }
 async function handleFolder(interaction) {
  const folderKey = interaction.options.getString('destination');
  const ticket = await findTicketForChannel(interaction);
  if (!ticket) return;
  // Discord-origin tickets have no Gmail thread to file.
  if (ticket.gmailThreadId.startsWith('discord-')) {
    return interaction.reply({
      content: "This ticket has no email thread, so it can't be moved to a Gmail folder.",
      flags: MessageFlags.Ephemeral
    });
  }
  const label = folderDisplayName(folderKey) || 'Spam';
  // Defer: resolving/creating labels + threads.modify can exceed the 3s window.
  await interaction.deferReply({ flags: MessageFlags.Ephemeral });
  try {
    await moveThreadToFolder(ticket.gmailThreadId, folderKey);
    logTicketEvent('Email thread filed', [
      { name: 'Folder', value: label },
      { name: 'Filed by', value: interaction.user.tag }
    ], interaction).catch(() => {});
    return interaction.editReply({ content: `Moved this ticket's email thread to **${label}**.` });
  } catch (err) {
    logError('handleFolder', err, interaction).catch(() => {});
    return interaction.editReply({ content: `Failed to move the email thread: ${err.message}` });
  }
 }
 async function handleHelp(interaction) {
  const embed = new EmbedBuilder()
    .setTitle('Ticket System - Commands')
@@ -266,7 +355,7 @@ async function handleHelp(interaction) {
      },
      {
        name: 'Ticket Management',
-        value: '`/transfer @staff [reason]` - Transfer ticket to another staff member\n`/move #category` - Move ticket to another category\n`/force-close` - Force close ticket without confirmation\n`/cancel-close` - Abort a pending force-close countdown\n`/topic <text>` - Set ticket topic/description'
+        value: '`/transfer @staff [reason]` - Transfer ticket to another staff member\n`/move #category` - Move ticket to another category\n`/force-close` - Force close ticket without confirmation\n`/cancel-close` - Abort a pending force-close countdown\n`/topic <text>` - Set ticket topic/description\n`/folder <destination>` - File this ticket\'s email into a Gmail folder'
      },
      {
        name: 'Saved Responses',
@@ -286,7 +375,7 @@ async function handleHelp(interaction) {
      },
      {
        name: 'Staff Configuration',
-        value: '`/notifydm` - Toggle DM notifications for your claimed tickets\n`/signature` - Set your email signature\n`/closetimer <seconds>` - Set the force-close countdown\n`/staffthread` - Toggle/configure per-ticket staff threads\n`/pinmessages` - Toggle auto-pinning of ticket messages\n`/gmailpoll <interval>` - Set the Gmail poll interval'
+        value: '`/notifydm` - Toggle DM notifications for your claimed tickets\n`/signature` - Set your email signature\n`/closetimer <seconds>` - Set the force-close countdown\n`/staffthread` - Toggle/configure per-ticket staff threads\n`/pinmessages` - Toggle auto-pinning of ticket messages\n`/gmailpoll <interval>` - Set the Gmail poll interval\n`/email on|off|status` - Turn the inbound email flow on/off'
      },
      {
        name: 'Right-click (Apps menu)',
@@ -313,6 +402,8 @@ const COMMAND_HANDLERS = {
  staffthread: handleStaffThread,
  pinmessages: handlePinMessages,
  gmailpoll: handleGmailPoll,
  email: handleEmail,
  folder: handleFolder,
  closetimer: handleCloseTimer,
  'cancel-close': handleCancelClose,
  'force-close': handleForceClose,
--- a/handlers/messages.js
+++ b/handlers/messages.js
@@ -3,7 +3,7 @@
 */
 const { mongoose } = require('../db-connection');
 const { CONFIG } = require('../config');
-const { extractRawEmail, isStaff } = require('../utils');
+const { extractRawEmail, isStaff, getCleanBody } = require('../utils');
 const { getGmailClient, sendGmailReply } = require('../services/gmail');
 const { getNotifyDm } = require('../services/staffSettings');
 const { logError } = require('../services/debugLog');
@@ -77,6 +77,10 @@ async function handleDiscordReply(m) {
      'Support';
    const msgId =
      last.payload.headers.find(h => h.name === 'Message-ID')?.value;
    const origDate =
      last.payload.headers.find(h => h.name === 'Date')?.value || '';
    const origFrom =
      last.payload.headers.find(h => h.name === 'From')?.value || recipient;
    const recipientEmail = extractRawEmail(recipient).toLowerCase();
    if (!recipientEmail || recipientEmail === CONFIG.MY_EMAIL) {
@@ -84,13 +88,17 @@ async function handleDiscordReply(m) {
      return;
    }
    // Quote the customer's latest inbound message beneath the staff reply.
    const quote = { from: origFrom, date: origDate, body: getCleanBody(last.payload) };
    await sendGmailReply(
      ticket.gmailThreadId,
      m.content,
      recipientEmail,
      subject,
      msgId,
-      m.author.id
+      m.author.id,
      quote
    );
  } catch (e) {
    console.error('REPLY ERROR:', e);
--- a/services/configSchema.js
+++ b/services/configSchema.js
@@ -35,17 +35,17 @@ const ALLOWED_CONFIG_KEYS = new Set([
  'BUTTON_LABEL_CLOSE', 'BUTTON_LABEL_CLAIM', 'BUTTON_LABEL_UNCLAIM',
  'BUTTON_EMOJI_CLOSE', 'BUTTON_EMOJI_CLAIM', 'BUTTON_EMOJI_UNCLAIM',
  // Branding
-  'LOGO_URL', 'SUPPORT_NAME', 'EMAIL_SIGNATURE', 'GAME_LIST',
+  'LOGO_URL', 'SUPPORT_NAME', 'GAME_LIST',
  // Toggles
  'AUTO_CLOSE_ENABLED', 'AUTO_CLOSE_AFTER_HOURS', 'AUTO_UNCLAIM_ENABLED', 'AUTO_UNCLAIM_AFTER_HOURS',
-  'ALLOW_CLAIM_OVERWRITE',
+  'ALLOW_CLAIM_OVERWRITE', 'TRANSCRIPT_DM_TO_CREATOR',
  'PRIORITY_ENABLED', 'DEFAULT_PRIORITY',
  'STAFF_THREAD_ENABLED', 'STAFF_THREAD_NAME', 'STAFF_THREAD_AUTO_ADD_ROLE', 'STAFF_THREAD_ROLE_ID',
  'PIN_INITIAL_MESSAGE_ENABLED', 'PIN_ESCALATION_MESSAGE_ENABLED', 'PIN_SUPPRESS_SYSTEM_MESSAGE',
  // Limits and thresholds
  'GLOBAL_TICKET_LIMIT',
  'RATE_LIMIT_TICKETS_PER_USER', 'RATE_LIMIT_WINDOW_MINUTES',
-  'FORCE_CLOSE_TIMER_SECONDS', 'GMAIL_POLL_INTERVAL_SECONDS',
+  'FORCE_CLOSE_TIMER_SECONDS', 'GMAIL_POLL_INTERVAL_SECONDS', 'GMAIL_POLL_ENABLED',
  // Embed colors
  'EMBED_COLOR_OPEN', 'EMBED_COLOR_CLAIMED', 'EMBED_COLOR_ESCALATED', 'EMBED_COLOR_INFO',
  'PRIORITY_HIGH_EMOJI', 'PRIORITY_MEDIUM_EMOJI', 'PRIORITY_LOW_EMOJI'
@@ -163,6 +163,8 @@ function inferType(key) {
  if (key.includes('COLOR')) return 'hex_color';
  // ROLE_ID_TO_PING has _ID mid-key — standard _ID$ pattern misses it.
  if (key === 'ROLE_ID_TO_PING') return 'discord_id';
  // Boolean toggle whose name doesn't match the ENABLED/_ON pattern.
  if (key === 'TRANSCRIPT_DM_TO_CREATOR') return 'boolean';
  // 2. Name patterns
  if (/ENABLED$|^USE_|_ON$/.test(key)) return 'boolean';
--- a/services/debugLog.js
+++ b/services/debugLog.js
@@ -36,7 +36,7 @@ async function sendToChannel(channelId, embed, overrideClient) {
  if (!c || !channelId) return;
  try {
    const channel = await c.channels.fetch(channelId);
-    if (channel) await channel.send({ embeds: [embed] });
+    if (channel) await channel.send({ embeds: [embed], allowedMentions: { parse: [] } });
  } catch (_) {
    // ignore send failures
  }
@@ -59,7 +59,8 @@ async function logError(context, error, interaction = null, overrideClient = nul
    const message = redactPII(error.message || String(error));
    const stack = redactPII(error.stack || error.message || String(error)).slice(0, 1500);
    await channel.send({
-      content: `\`[${context}]\` ${message}\n${userLine}${commandLine}\n\`\`\`${stack}\`\`\``
+      content: `\`[${context}]\` ${message}\n${userLine}${commandLine}\n\`\`\`${stack}\`\`\``,
      allowedMentions: { parse: [] }
    });
  } catch (_) {
    // ignore send failures
--- a/services/gmail.js
+++ b/services/gmail.js
@@ -23,7 +23,6 @@ function buildCompanySigHtml() {
              Indifferent Broccoli Support<br>
              <a href="https://indifferentbroccoli.com/">https://indifferentbroccoli.com/</a><br>
              Join us on <a href="https://discord.gg/2vmfrrtvJY">Discord</a><br>
              <br>
              <em>Host your own game server. Or not... we don't care.</em>
            </td>
          </tr>
@@ -35,7 +34,6 @@ function buildCompanySigText() {
    'Indifferent Broccoli Support',
    'https://indifferentbroccoli.com/',
    'Join us on Discord: https://discord.gg/2vmfrrtvJY',
    '',
    "Host your own game server. Or not... we don't care."
  ].join('\n');
 }
@@ -96,23 +94,168 @@ function encodeReplySubject(baseSubject) {
 }
 // Compose and send a multipart/alternative reply on an existing Gmail thread.
-async function sendThreadedEmail(gmail, { threadId, recipient, encodedSubject, msgId, messageText, userId }) {
+// Build the "On <date>, <sender> wrote:" attribution line for a quoted reply.
 function formatQuoteAttribution(quote) {
  const who = (quote.from || '').trim() || 'the sender';
  const when = (quote.date || '').trim();
  return when ? `On ${when}, ${who} wrote:` : `${who} wrote:`;
 }
 // Plain-text quoted block: attribution + each original line prefixed with "> ".
 // Returns null when there is nothing to quote.
 function buildQuoteText(quote) {
  if (!quote || !(quote.body || '').trim()) return null;
  const quoted = quote.body.replace(/\r\n/g, '\n').split('\n').map(l => `> ${l}`).join('\n');
  return `${formatQuoteAttribution(quote)}\n${quoted}`;
 }
 // HTML quoted block. Mirrors Gmail's own reply markup (gmail_quote / gmail_attr
 // classes + the standard blockquote styling) so receiving clients recognize it
 // as quoted content and collapse it behind the "•••" toggle. Body is
 // attacker-controlled email content — escapeHtml it.
 function buildQuoteHtml(quote) {
  if (!quote || !(quote.body || '').trim()) return '';
  const attribution = escapeHtml(formatQuoteAttribution(quote));
  const quotedHtml = escapeHtml(quote.body.replace(/\r\n/g, '\n')).replace(/\n/g, '<br>');
  return `<div class="gmail_quote">` +
    `<div dir="ltr" class="gmail_attr">${attribution}<br></div>` +
    `<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex;">${quotedHtml}</blockquote>` +
    `</div>`;
 }
 // Discord custom emoji token: <:name:id> (static) or <a:name:id> (animated).
 const DISCORD_EMOJI_RE = /<(a?):(\w+):(\d+)>/g;
 // Same token after escapeHtml has turned the angle brackets into entities.
 const DISCORD_EMOJI_RE_ESCAPED = /&lt;(a?):(\w+):(\d+)&gt;/g;
 // Plain-text: collapse a custom-emoji token to its :name: shortcode.
 function discordEmojiToText(s) {
  return (s || '').replace(DISCORD_EMOJI_RE, (_m, _anim, name) => `:${name}:`);
 }
 // Collect the distinct custom emoji referenced in a message.
 function collectDiscordEmojis(s) {
  const seen = new Map();
  for (const m of (s || '').matchAll(DISCORD_EMOJI_RE)) {
    const [, anim, name, id] = m;
    if (!seen.has(id)) seen.set(id, { id, name, ext: anim ? 'gif' : 'png' });
  }
  return [...seen.values()];
 }
 // Fetch one emoji's bytes from Discord's CDN for inline (cid:) embedding.
 // Returns null on any failure so the caller can fall back to a remote <img>.
 async function fetchEmojiInline(emoji) {
  try {
    const res = await fetch(`https://cdn.discordapp.com/emojis/${emoji.id}.${emoji.ext}`);
    if (!res.ok) return null;
    const base64 = Buffer.from(await res.arrayBuffer()).toString('base64');
    return { ...emoji, base64, cid: `emoji-${emoji.id}@broccolini` };
  } catch {
    return null;
  }
 }
 // HTML: escape first (body is staff-authored but treated as untrusted), then
 // swap the now-escaped emoji tokens for an inline <img>. Prefer a cid: reference
 // (embedded part, always renders); fall back to Discord's CDN when not embedded.
 // The id is digits-only and name is \w+, so neither can break out of the attribute.
 function messageTextToHtml(s, cidById = {}) {
  return escapeHtml(s || '')
    .replace(DISCORD_EMOJI_RE_ESCAPED, (_m, anim, name, id) => {
      const ext = anim ? 'gif' : 'png';
      const src = cidById[id] ? `cid:${cidById[id]}` : `https://cdn.discordapp.com/emojis/${id}.${ext}`;
      return `<img src="${src}" alt=":${name}:" ` +
        `width="20" height="20" style="vertical-align: middle;">`;
    })
    .replace(/\n/g, '<br>');
 }
 // Strip Discord role mentions (<@&id>) — internal staff pings like @broccolini
 // that mean nothing to an email recipient. Collapse the whitespace left behind.
 function stripRoleMentions(s) {
  return (s || '')
    .replace(/<@&\d+>/g, '')
    .replace(/[^\S\r\n]{2,}/g, ' ')
    .replace(/[^\S\r\n]+\n/g, '\n')
    .trim();
 }
 async function sendThreadedEmail(gmail, { threadId, recipient, encodedSubject, msgId, messageText, userId, quote = null }) {
  const sigBlocks = userId ? await getStaffSignatureBlocks(userId) : { text: '', html: '' };
  const safeStaffSigHtml = sigBlocks.html ? sigBlocks.html.replace(/\n/g, '<br>') : '';
  const safeStaffSigText = sigBlocks.text;
  const cleanText = stripRoleMentions(messageText);
  // Embed any custom emoji inline (cid:) so they render without the recipient
  // having to load remote images. Failed fetches fall back to a remote <img>.
  const inlineEmojis = (await Promise.all(collectDiscordEmojis(cleanText).map(fetchEmojiInline))).filter(Boolean);
  const cidById = {};
  for (const e of inlineEmojis) cidById[e.id] = e.cid;
  const htmlBody = `
    <div style="font-family: sans-serif; font-size: 14px; color: #333;">
-      <p>${escapeHtml(messageText || '').replace(/\n/g, '<br>')}</p>
+      <p>${messageTextToHtml(cleanText, cidById)}</p>
      ${safeStaffSigHtml ? `<p style="margin: 10px 0;">${safeStaffSigHtml}</p>` : ''}
      ${buildCompanySigHtml()}
      ${buildQuoteHtml(quote)}
    </div>`;
-  const plainBody = [messageText || ''];
+  const plainBody = [discordEmojiToText(cleanText)];
  if (safeStaffSigText) plainBody.push('', safeStaffSigText);
  plainBody.push('', ...buildCompanySigText().split('\n'));
  const quoteText = buildQuoteText(quote);
  if (quoteText) plainBody.push('', quoteText);
  const stamp = Date.now().toString(16);
  const altBoundary = 'alt_' + stamp;
  const altPart = [
    `--${altBoundary}`,
    'Content-Type: text/plain; charset="UTF-8"',
    '',
    ...plainBody,
    '',
    `--${altBoundary}`,
    'Content-Type: text/html; charset="UTF-8"',
    '',
    htmlBody,
    '',
    `--${altBoundary}--`
  ];
  // With no inline images the message stays a plain multipart/alternative.
  // With them, wrap the alternative + image parts in a multipart/related.
  let topContentType;
  let bodyLines;
  if (inlineEmojis.length) {
    const relBoundary = 'rel_' + stamp;
    topContentType = `multipart/related; boundary="${relBoundary}"`;
    bodyLines = [
      `--${relBoundary}`,
      `Content-Type: multipart/alternative; boundary="${altBoundary}"`,
      '',
      ...altPart,
      ''
    ];
    for (const e of inlineEmojis) {
      bodyLines.push(
        `--${relBoundary}`,
        `Content-Type: image/${e.ext === 'gif' ? 'gif' : 'png'}`,
        'Content-Transfer-Encoding: base64',
        `Content-ID: <${e.cid}>`,
        `Content-Disposition: inline; filename="${e.name}.${e.ext}"`,
        '',
        ...(e.base64.match(/.{1,76}/g) || []),
        ''
      );
    }
    bodyLines.push(`--${relBoundary}--`);
  } else {
    topContentType = `multipart/alternative; boundary="${altBoundary}"`;
    bodyLines = altPart;
  }
  const boundary = '000000000000' + Date.now().toString(16);
  const headers = [
    `From: ${sanitizeHeaderValue(CONFIG.MY_EMAIL)}`,
    `To: ${recipient}`,
@@ -120,24 +263,10 @@ async function sendThreadedEmail(gmail, { threadId, recipient, encodedSubject, m
    msgId && `In-Reply-To: ${msgId}`,
    msgId && `References: ${msgId}`,
    'MIME-Version: 1.0',
-    `Content-Type: multipart/alternative; boundary="${boundary}"`
+    `Content-Type: ${topContentType}`
  ].filter(Boolean);
-  const raw = Buffer.from([
+  const raw = Buffer.from([...headers, '', ...bodyLines].join('\r\n'))
    ...headers,
    '',
    `--${boundary}`,
    'Content-Type: text/plain; charset="UTF-8"',
    '',
    ...plainBody,
    '',
    `--${boundary}`,
    'Content-Type: text/html; charset="UTF-8"',
    '',
    htmlBody,
    '',
    `--${boundary}--`
  ].join('\r\n'))
    .toString('base64')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@ -164,15 +293,20 @@ async function sendTicketClosedEmail(ticket, closerName, userId = null) {
    const gmail = getGmailClient();
    const { subject, msgId } = await fetchThreadSubjectAndMsgId(gmail, ticket.gmailThreadId);
    const encodedSubject = encodeReplySubject(subject || ticket.subject || 'Support');
-    const messageText = `${closerName} has marked this ticket as resolved. If you would like to re-open this issue, please reply to this email.`;
+    // Editable via TICKET_CLOSE_MESSAGE in .env. Supports a {closer_name}
    // placeholder and \n for line breaks.
    const messageText = (CONFIG.TICKET_CLOSE_MESSAGE || '')
      .replace(/\\n/g, '\n')
      .replace(/\{closer_name\}/g, closerName);
    // Closing emails intentionally omit the staff signature (userId left out)
    // — only the resolution message and the company signature go out.
    await sendThreadedEmail(gmail, {
      threadId: ticket.gmailThreadId,
      recipient,
      encodedSubject,
      msgId,
-      messageText,
+      messageText
      userId
    });
  } catch (err) {
    console.error('Ticket closed email error:', err);
@@ -211,7 +345,7 @@ async function sendTicketNotificationEmail(ticket, messageBody, userId = null) {
 * Send a Gmail reply on an existing thread. Caller supplies subject + messageId
 * (typically pulled from the latest non-self message in the thread).
 */
-async function sendGmailReply(threadId, replyText, recipientEmail, subject, messageId, userId = null) {
+async function sendGmailReply(threadId, replyText, recipientEmail, subject, messageId, userId = null, quote = null) {
  const safeRecipient = sanitizeHeaderValue(extractRawEmail(recipientEmail || '')).toLowerCase();
  if (!EMAIL_RE.test(safeRecipient)) {
    logError('sendGmailReply: invalid recipient', new Error(`Rejected: ${safeRecipient}`)).catch(() => {});
@@ -225,7 +359,8 @@ async function sendGmailReply(threadId, replyText, recipientEmail, subject, mess
    encodedSubject: encodeReplySubject(subject || 'Support'),
    msgId: sanitizeHeaderValue(messageId) || null,
    messageText: replyText,
-    userId
+    userId,
    quote
  });
 }
--- a/services/gmailLabels.js
+++ b/services/gmailLabels.js
@@ -0,0 +1,152 @@
 /**
 * Gmail "folder" routing — map a ticket's Gmail thread into a managed set of
 * labels with exclusive-folder semantics.
 *
 * Gmail labels are additive; we synthesize folders by, on every move, adding the
 * target label and removing every *other* managed label plus INBOX + UNREAD
 * (removing an absent label is a no-op, so this is idempotent). "Spam" maps to
 * the built-in system SPAM label, which is never created.
 *
 * Acyclic require graph: this module depends on services/gmail (getGmailClient);
 * gmail.js does not depend back on this file.
 */
 'use strict';
 const { CONFIG } = require('../config');
 const { getGmailClient } = require('./gmail');
 // Logical folder key -> how to resolve its label. User folders read their display
 // name from CONFIG (env-configurable); SPAM is the Gmail system label.
 const FOLDER_DEFS = {
  TRIAGE:             { configKey: 'GMAIL_LABEL_TRIAGE' },
  ESCALATED:          { configKey: 'GMAIL_LABEL_ESCALATED' },
  RESOLVED:           { configKey: 'GMAIL_LABEL_RESOLVED' },
  FOR_JAKE:           { configKey: 'GMAIL_LABEL_FOR_JAKE' },
  DASHBOARD_ERRORS:   { configKey: 'GMAIL_LABEL_DASHBOARD_ERRORS' },
  PARTNERSHIP_OFFERS: { configKey: 'GMAIL_LABEL_PARTNERSHIP_OFFERS' },
  SPAM:               { system: 'SPAM' }
 };
 // User-managed folder keys (everything but the system SPAM label).
 const MANAGED_USER_KEYS = Object.keys(FOLDER_DEFS).filter(k => !FOLDER_DEFS[k].system);
 // Always stripped on a move so the thread leaves the inbox and is marked read.
 const ALWAYS_REMOVE = ['INBOX', 'UNREAD'];
 // Cache: Gmail label display name -> label ID. Populated lazily; cleared on a
 // stale-label error so a label recreated in Gmail is re-resolved.
 const labelIdByName = new Map();
 /** Display name for a user folder key (null for the system SPAM label). */
 function folderDisplayName(key) {
  const def = FOLDER_DEFS[key];
  if (!def) throw new Error(`Unknown folder key: ${key}`);
  if (def.system) return null;
  return CONFIG[def.configKey];
 }
 async function ensureLabelCache(gmail) {
  if (labelIdByName.size > 0) return;
  const res = await gmail.users.labels.list({ userId: 'me' });
  for (const label of res.data.labels || []) {
    labelIdByName.set(label.name, label.id);
  }
 }
 /**
 * Resolve a folder key to a Gmail label ID, creating a missing *user* label.
 * SPAM short-circuits to the system id and is never created.
 */
 async function resolveLabelId(gmail, key) {
  const def = FOLDER_DEFS[key];
  if (!def) throw new Error(`Unknown folder key: ${key}`);
  if (def.system) return def.system;
  const name = folderDisplayName(key);
  await ensureLabelCache(gmail);
  if (labelIdByName.has(name)) return labelIdByName.get(name);
  const created = await gmail.users.labels.create({
    userId: 'me',
    requestBody: { name, labelListVisibility: 'labelShow', messageListVisibility: 'show' }
  });
  labelIdByName.set(name, created.data.id);
  return created.data.id;
 }
 /**
 * Pure: given the target key and a key->id map of every managed label, build the
 * add/remove sets for an exclusive-folder move. The target label is added; every
 * other managed label plus INBOX + UNREAD is removed.
 */
 function computeLabelMutation(targetKey, idByKey) {
  const targetId = idByKey[targetKey];
  if (!targetId) throw new Error(`Missing resolved id for target folder: ${targetKey}`);
  const removeLabelIds = [];
  for (const key of Object.keys(idByKey)) {
    if (key === targetKey) continue;
    const id = idByKey[key];
    if (id) removeLabelIds.push(id);
  }
  for (const sys of ALWAYS_REMOVE) removeLabelIds.push(sys);
  return { addLabelIds: [targetId], removeLabelIds };
 }
 function isInvalidLabelError(err) {
  const status = err && ((err.response && err.response.status) || err.code);
  const msg = (err && err.message) || '';
  return status === 400 || /invalid label|labelId not found/i.test(msg);
 }
 /**
 * Move a Gmail thread into a managed folder with exclusive-folder semantics.
 * Resolves (and creates) every managed label, then issues one threads.modify.
 * On a stale cached label id (400 invalid label), clears the cache and retries
 * once.
 *
 * @param {string} threadId   Gmail thread id (ticket.gmailThreadId)
 * @param {string} targetKey  one of FOLDER_DEFS keys
 * @param {object} [gmail]    optional Gmail client (poll loop passes its own)
 */
 async function moveThreadToFolder(threadId, targetKey, gmail = getGmailClient()) {
  if (!threadId) throw new Error('moveThreadToFolder: threadId required');
  if (!FOLDER_DEFS[targetKey]) throw new Error(`Unknown folder key: ${targetKey}`);
  const applyOnce = async () => {
    const idByKey = {};
    for (const key of Object.keys(FOLDER_DEFS)) {
      idByKey[key] = await resolveLabelId(gmail, key);
    }
    const mutation = computeLabelMutation(targetKey, idByKey);
    await gmail.users.threads.modify({
      userId: 'me',
      id: threadId,
      requestBody: mutation
    });
  };
  try {
    await applyOnce();
  } catch (err) {
    if (isInvalidLabelError(err)) {
      labelIdByName.clear();
      await applyOnce();
    } else {
      throw err;
    }
  }
 }
 module.exports = {
  FOLDER_DEFS,
  MANAGED_USER_KEYS,
  ALWAYS_REMOVE,
  folderDisplayName,
  resolveLabelId,
  computeLabelMutation,
  moveThreadToFolder,
  // test seam: clear the name->id cache between cases
  __clearLabelCache: () => labelIdByName.clear()
 };
--- a/tests/gmailLabels.test.js
+++ b/tests/gmailLabels.test.js
@@ -0,0 +1,152 @@
 import { describe, it, expect, beforeEach } from 'vitest';
 import {
  computeLabelMutation,
  resolveLabelId,
  moveThreadToFolder,
  folderDisplayName,
  __clearLabelCache
 } from '../services/gmailLabels.js';
 const FULL_IDS = {
  TRIAGE: 'L_TRIAGE',
  ESCALATED: 'L_ESC',
  RESOLVED: 'L_RES',
  FOR_JAKE: 'L_FJ',
  DASHBOARD_ERRORS: 'L_DE',
  PARTNERSHIP_OFFERS: 'L_PO',
  SPAM: 'SPAM'
 };
 const FULL_LABELS = [
  { name: 'Triage', id: 'L_TRIAGE' },
  { name: 'Escalated', id: 'L_ESC' },
  { name: 'Resolved', id: 'L_RES' },
  { name: 'For Jake', id: 'L_FJ' },
  { name: 'Dashboard Errors', id: 'L_DE' },
  { name: 'Partnership Offers', id: 'L_PO' }
 ];
 describe('computeLabelMutation', () => {
  it('adds the target, removes every other managed label plus INBOX/UNREAD', () => {
    const { addLabelIds, removeLabelIds } = computeLabelMutation('FOR_JAKE', FULL_IDS);
    expect(addLabelIds).toEqual(['L_FJ']);
    expect(removeLabelIds).toContain('INBOX');
    expect(removeLabelIds).toContain('UNREAD');
    expect(removeLabelIds).toContain('SPAM');
    expect(removeLabelIds).toContain('L_TRIAGE');
    expect(removeLabelIds).not.toContain('L_FJ'); // target is never removed
  });
  it('moving to SPAM adds SPAM and removes all user labels but not SPAM itself', () => {
    const { addLabelIds, removeLabelIds } = computeLabelMutation('SPAM', FULL_IDS);
    expect(addLabelIds).toEqual(['SPAM']);
    expect(removeLabelIds).not.toContain('SPAM');
    expect(removeLabelIds).toContain('L_TRIAGE');
    expect(removeLabelIds).toContain('INBOX');
  });
  it('throws when the target id is missing', () => {
    expect(() => computeLabelMutation('FOR_JAKE', { TRIAGE: 'x' })).toThrow();
  });
 });
 describe('folderDisplayName', () => {
  it('returns null for the system SPAM folder', () => {
    expect(folderDisplayName('SPAM')).toBeNull();
  });
  it('returns the configured/default name for a user folder', () => {
    expect(folderDisplayName('FOR_JAKE')).toBe('For Jake');
  });
  it('throws on an unknown key', () => {
    expect(() => folderDisplayName('NOPE')).toThrow();
  });
 });
 describe('resolveLabelId', () => {
  beforeEach(() => __clearLabelCache());
  it('short-circuits SPAM to the system id without any API call', async () => {
    let called = false;
    const gmail = { users: { labels: { list: async () => { called = true; return { data: {} }; } } } };
    expect(await resolveLabelId(gmail, 'SPAM')).toBe('SPAM');
    expect(called).toBe(false);
  });
  it('returns an existing label id matched by name', async () => {
    const gmail = {
      users: { labels: {
        list: async () => ({ data: { labels: [{ name: 'For Jake', id: 'L_EXISTING' }] } }),
        create: async () => { throw new Error('should not create'); }
      } }
    };
    expect(await resolveLabelId(gmail, 'FOR_JAKE')).toBe('L_EXISTING');
  });
  it('creates a missing user label under its configured name and caches it', async () => {
    let createdName = null;
    const gmail = {
      users: { labels: {
        list: async () => ({ data: { labels: [] } }),
        create: async ({ requestBody }) => { createdName = requestBody.name; return { data: { id: 'L_NEW' } }; }
      } }
    };
    expect(await resolveLabelId(gmail, 'FOR_JAKE')).toBe('L_NEW');
    expect(createdName).toBe('For Jake');
  });
 });
 describe('moveThreadToFolder', () => {
  beforeEach(() => __clearLabelCache());
  it('resolves labels then issues one threads.modify with exclusive sets', async () => {
    let modifyArgs = null;
    const gmail = {
      users: {
        labels: {
          list: async () => ({ data: { labels: FULL_LABELS } }),
          create: async () => { throw new Error('no create expected'); }
        },
        threads: { modify: async (args) => { modifyArgs = args; return { data: {} }; } }
      }
    };
    await moveThreadToFolder('thread123', 'ESCALATED', gmail);
    expect(modifyArgs.id).toBe('thread123');
    expect(modifyArgs.requestBody.addLabelIds).toEqual(['L_ESC']);
    expect(modifyArgs.requestBody.removeLabelIds).toContain('L_TRIAGE');
    expect(modifyArgs.requestBody.removeLabelIds).toContain('INBOX');
    expect(modifyArgs.requestBody.removeLabelIds).not.toContain('L_ESC');
  });
  it('clears the cache and retries once on an invalid-label error', async () => {
    let modifyCalls = 0;
    let listCalls = 0;
    const gmail = {
      users: {
        labels: {
          list: async () => { listCalls++; return { data: { labels: FULL_LABELS } }; },
          create: async () => ({ data: { id: 'X' } })
        },
        threads: {
          modify: async () => {
            modifyCalls++;
            if (modifyCalls === 1) { const e = new Error('invalid label'); e.code = 400; throw e; }
            return { data: {} };
          }
        }
      }
    };
    await moveThreadToFolder('t1', 'TRIAGE', gmail);
    expect(modifyCalls).toBe(2);
    expect(listCalls).toBe(2); // cache was cleared and labels re-listed
  });
  it('rejects an unknown folder key before touching the API', async () => {
    const gmail = {
      users: {
        labels: { list: async () => ({ data: { labels: [] } }) },
        threads: { modify: async () => ({}) }
      }
    };
    await expect(moveThreadToFolder('t', 'BOGUS', gmail)).rejects.toThrow();
  });
 });