fix(e2e): update 5 selectors that drifted with FlowPilot/PSA UI changes

Mechanical drift between the e2e selectors and the current UI surfaced
on the first CI run after PR #149 unblocked the artifact upload step.
Five tests, three categories of drift:

1. **Page heading renames** (navigation.spec.ts)
   - `Sessions` → `Session History` on /sessions
   - `Account Settings` → `Account Management` on /account

2. **Route rename** (command-palette.spec.ts:74)
   - The "Troubleshoot with FlowPilot" command palette option now lands
     on /pilot (Phase 1 of the FlowPilot migration renamed /assistant).
     /assistant still 301-redirects, so the assertion accepts either.

3. **Feature moved to /sessions** (history.spec.ts, resume.spec.ts)
   - Default tab on /sessions is "AI Sessions"; flow-session filtering
     and the Resume button moved behind the "Flow Sessions" tab. Both
     tests now click that tab before asserting.
   - resume.spec.ts no longer starts at /trees (Resume buttons aren't
     rendered there anymore — the flow lives on /sessions). Destination
     URL (/trees/:id/navigate) is unchanged.

No product-code changes — these are pure test updates against the
shipped UI. Run the suite locally with
`cd frontend && npm run test:e2e` once a fresh build is available.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.ai/CURRENT_TASK.md

@@ -0,0 +1,33 @@
+# CURRENT_TASK.md
+
+**Task:** none — replace this file when starting the next real task.
+
+**Status:** not-started
+
+**Definition of Done:** n/a
+
+**Assumptions:** n/a
+
+**Out of scope:** n/a
+
+---
+
+<!-- When you start a real task, replace the block above with:
+
+**Task:** One-sentence goal.
+
+**Status:** not-started | in-progress | blocked | ready-for-review | complete
+
+**Definition of Done:**
+- [ ] Testable criterion 1
+- [ ] Testable criterion 2
+- [ ] Tests added or updated
+- [ ] `npm run build` passes (frontend) / `pytest` passes (backend)
+
+**Assumptions:**
+- What we're treating as given
+
+**Out of scope:**
+- What this task explicitly does NOT cover
+
+-->

.ai/DECISIONS.md

@@ -0,0 +1,31 @@
+# DECISIONS.md
+
+> Append-only architectural decision log. Newest entries at the top.
+> Entry format:
+>
+> ```
+> ## YYYY-MM-DD — <short title>
+> **Context:** why this came up
+> **Decision:** what we chose
+> **Rejected:** what we didn't choose and why
+> **Consequences:** what this means going forward
+> ```
+
+---
+
+## 2026-04-24 — Adopt dual-agent handoff system (`.ai/` + `CLAUDE.md` + `AGENTS.md`)
+
+**Context:** Claude Code hits session and weekly usage limits. Work stalls when the primary agent is locked out. Needed a structured way for OpenAI Codex to resume where Claude left off without losing architectural truth or drifting across sessions.
+
+**Decision:** Split the old CLAUDE.md into `.ai/PROJECT_CONTEXT.md` (stable repo truth), agent-specific root files (`CLAUDE.md`, `AGENTS.md`) with a shared protocol block, and a small handoff toolkit (`CURRENT_TASK.md`, `HANDOFF.md`, `TODO.md`, `DECISIONS.md`, `SESSION_LOG.md`, `README.md`). Previous CLAUDE.md snapshotted in commit `e110fed` before the migration.
+
+**Rejected:**
+- Single symlinked CLAUDE.md/AGENTS.md — diverges silently, hides agent-specific tooling differences.
+- Putting GitNexus/gstack content in AGENTS.md — Codex doesn't have those tools; would mislead the resume agent.
+- Keeping the old CLAUDE.md as-is and adding AGENTS.md alongside it — duplicated truth, drift guaranteed.
+
+**Consequences:**
+- First read for either agent: `.ai/PROJECT_CONTEXT.md` + `.ai/CURRENT_TASK.md` + `.ai/HANDOFF.md`.
+- Architectural changes in the repo require updating PROJECT_CONTEXT.md, not the root agent files.
+- Git trailers differ per agent (`Claude Opus 4.7` vs `Codex`) — preserved in each root file.
+- Legacy `SESSION-HANDOFF.md` deleted in the same commit; superseded by `.ai/HANDOFF.md`.

.ai/HANDOFF.md

@@ -0,0 +1,35 @@
+<!-- Keep under ~2K tokens. Old handoffs live in SESSION_LOG.md. Do not let this file accumulate history. -->
+
+# HANDOFF.md
+
+**Last updated:** 2026-04-24 (America/New_York)
+
+**Active task:** None — see [CURRENT_TASK.md](CURRENT_TASK.md). Replace it when picking up the next real task.
+
+**Branch:** `feat/flowpilot-migration` — a long-running FlowPilot Phase 9 feature branch. The recent AI-handoff migration commits ride on this branch (not on their own branch); they'll merge to `main` whenever Phase 9 does.
+
+**Branch state:** 3 commits ahead of `origin/feat/flowpilot-migration`:
+
+- `b3be1e0 chore: ignore .remember/ skill runtime state`
+- `b3506b5 docs(pilot): phase 9 review issues`
+- `b14a16a chore(tests): gate RLS tests behind RUN_RLS_TESTS flag`
+
+Earlier in this session (already pushed to origin):
+
+- `9c8ba29 fix(ai): correct stale role-hierarchy and file-listing claims`
+- `bee8690 chore(ai): migrate to dual-agent handoff system`
+- `e110fed chore: snapshot CLAUDE.md before ai-handoff migration` (tag: `pre-ai-handoff`)
+
+**Where I left off:**
+- File: n/a — nothing mid-edit.
+- Next intended action: push the 3 unpushed commits when ready (`git push`), then start the next real task (replace `CURRENT_TASK.md`, update this file).
+
+**Uncommitted state:**
+- Working tree is clean.
+
+**Immediate next steps:**
+1. `git push` to publish the 3 local commits (cleanup batch).
+2. When starting the next real feature task: replace `CURRENT_TASK.md` with actual goal/DoD, rewrite this file's resume section.
+
+**Open questions / blockers:**
+- None. The dual-agent handoff system is live and has survived one Codex review round (see DECISIONS.md 2026-04-24 entry; corrections in `9c8ba29`).

.ai/PROJECT_CONTEXT.md

@@ -0,0 +1,254 @@
+# PROJECT_CONTEXT.md — ResolutionFlow
+
+> SaaS troubleshooting platform for MSPs. Stable architectural truth. Updated only when the repo's shape changes.
+
+---
+
+## Product & naming
+
+Canonical product name is **ResolutionFlow**. `patherly` is the legacy internal name — still present in DB name (`patherly` on Railway, `resolutionflow` locally), some Railway service names, and historical paths. Treat as aliases, not canonical. Docker containers are `resolutionflow_*`.
+
+**User terminology:** "Flows" (not Trees), "Projects" (not Procedures), "Solutions Library" (not Step Library). Maintenance flows hidden from pilot UI (backend retains them). DB column `tree_type` values unchanged.
+
+---
+
+## SaaS shape
+
+Multi-tenant by account. Primary role hierarchy: `super_admin` > `owner` > `engineer` > `viewer` — driven by `is_super_admin` + `account_role`. Never `role=='admin'` — use `is_super_admin`. Separate team-scoped admin gate exists orthogonally to the role hierarchy: `is_team_admin=True` + valid `team_id`, enforced by `require_team_admin`. Backend deps in `app/api/deps.py`: `get_current_active_user`, `require_engineer_or_admin`, `require_admin`, `require_account_owner`, `require_team_admin`. Frontend: `usePermissions()` hook. Central logic in `backend/app/core/permissions.py` + `frontend/src/hooks/usePermissions.ts`.
+
+---
+
+## Status
+
+Go-to-Market Validation (pre-PMF). Backend feature-complete (55+ endpoints, 100+ tests). Phase 0.5 FlowPilot telemetry baseline accruing. See [CURRENT-STATE.md](../CURRENT-STATE.md) for live status, [03-DEVELOPMENT-ROADMAP.md](../03-DEVELOPMENT-ROADMAP.md) for phases.
+
+---
+
+## Tech stack
+
+- **Backend:** Python 3.11 + FastAPI, SQLAlchemy 2.0 async (asyncpg), Alembic, Pydantic v2, JWT (python-jose + bcrypt, JTI refresh rotation), APScheduler (in-process with FastAPI lifespan).
+- **Frontend:** React 19 + Vite + TypeScript, Tailwind v4 (CSS-only config in `index.css`), Zustand (immer + zundo), React Router v7, Axios (token-refresh interceptor), Lucide.
+- **DB:** PostgreSQL 16 (RLS enabled Phase 4, pgvector).
+
+---
+
+## Project structure
+
+```
+resolutionflow/
+├── backend/
+│   ├── app/
+│   │   ├── main.py                     # FastAPI entry
+│   │   ├── api/endpoints/              # 50+ routers registered in api/router.py — auth/admin, trees/sessions, AI/chat, scripts, integrations, uploads, accounts, FlowPilot, etc.
+│   │   ├── api/deps.py                 # auth deps (incl. require_team_admin)
+│   │   ├── api/router.py               # registration
+│   │   ├── core/                       # config, database, permissions, security, audit, rate_limit
+│   │   ├── models/                     # SQLAlchemy (incl. FlowProposal)
+│   │   ├── schemas/                    # Pydantic
+│   │   ├── services/psa/               # PSA provider pattern (base, connectwise/, autotask/, halopsa/, cache, encryption, exceptions, registry, ticket_context, types)
+│   │   ├── services/knowledge_flywheel.py + _scheduler.py
+│   │   └── services/knowledge_gap_service.py
+│   ├── alembic/versions/               # 001-070 sequential, then hex hash
+│   ├── scripts/                        # seed_data, seed_trees, seed_test_users
+│   └── tests/                          # pytest integration
+├── frontend/
+│   ├── src/
+│   │   ├── api/                        # Axios client + endpoint modules
+│   │   ├── components/                 # common, layout, dashboard, tree-editor, session, procedural, procedural-editor, library, step-library, ui, flowpilot
+│   │   ├── hooks/                      # usePermissions, useSessionTimer, useKeyboardShortcuts
+│   │   ├── pages/
+│   │   ├── store/                      # Zustand (auth, treeEditor, proceduralEditor, userPreferences, scriptGeneratorStore)
+│   │   └── types/
+│   └── (Tailwind v4 CSS-only config in src/index.css)
+├── docs/plans/archive/                 # pre-March 2026 plans
+├── docs/connectwise/                   # CW API reference + best-practices guides
+├── docs/LESSONS-ARCHIVE.md             # archived lessons (fixes in code)
+├── .ai/                                # dual-agent handoff system (see .ai/README.md)
+├── CLAUDE.md · AGENTS.md · CURRENT-STATE.md · DESIGN-SYSTEM.md · DEV-ENV.md
+```
+
+---
+
+## Dev commands
+
+Full setup in [DEV-ENV.md](../DEV-ENV.md) (host-agnostic, with homelab Proxmox reference topology). Day-to-day:
+
+```bash
+docker compose -f docker-compose.dev.yml up -d                      # start stack
+cd backend && source venv/bin/activate && uvicorn app.main:app --reload
+cd frontend && npm run dev
+pytest --override-ini="addopts="                                    # tests (first time: CREATE DATABASE resolutionflow_test)
+cd backend && alembic upgrade head                                  # migrate
+cd backend && alembic revision -m "desc"                            # manual migration (preferred per Lesson 77)
+cd backend && alembic revision --autogenerate -m "desc"             # picks up drift; review carefully
+cd frontend && npm run build                                        # stricter than tsc --noEmit — final check
+cd frontend && npx tsc -b                                           # TS-only check when dist/ has EACCES
+docker exec -it resolutionflow_postgres psql -U postgres -d resolutionflow
+python -m scripts.seed_trees                                        # seed (from backend/)
+```
+
+**Never pass `--rev-id`** to alembic — let it generate the hex hash.
+
+---
+
+## URLs & test users
+
+**URLs:** Frontend <http://localhost:5173>, backend <http://localhost:8000>, API docs <http://localhost:8000/api/docs>.
+
+**Test users** (all password `TestPass123!`): `admin@resolutionflow.example.com` (super_admin), `teamadmin@resolutionflow.example.com`, `engineer@resolutionflow.example.com`, `pro@resolutionflow.example.com`.
+
+---
+
+## CI
+
+Gitea (`gitea.resolutionflow.com/chihlasm/resolutionflow/actions`). `gh` CLI works for issues/PRs on the GitHub mirror, but not CI runs.
+
+---
+
+## Deployment (Railway)
+
+- **Prod:** `resolutionflow.com` (frontend), `api.resolutionflow.com` (backend).
+- Auto-deploy: Gitea push → GitHub mirror → Railway follows GitHub `main`.
+- PR environments auto-created; need manual domain generation + `VITE_API_URL` with `https://` prefix.
+- `ALLOW_RAILWAY_ORIGINS=true` for `*.up.railway.app` CORS.
+- Shared Variables (Railway project-level) auto-propagate to PR envs — use for secrets like `ANTHROPIC_API_KEY`.
+- Super admin utility: `backend/make_superadmin_simple.py list|<email>`.
+
+---
+
+## ConnectWise PSA
+
+Reference: `docs/connectwise/` — start with `CONNECTWISE-API-REFERENCE.md`, then the `best-practices/` guides. Extracted OpenAPI spec in `connectwise-psa-resolutionflow-reference.json` (670 endpoints, v2025.16); full spec in `connectwise-psa-openapi-full.json`.
+
+- **Auth:** API Key (Base64 `companyId+publicKey:privateKey`) + `clientId` header every request. `clientId` is server-side (`CW_CLIENT_ID` in `config.py`) — identifies ResolutionFlow, not per-tenant. Per-connection: `company_id`, `public_key`, `private_key`, `server_url`.
+- **Architecture:** `services/psa/` provider pattern — `PSAProvider` base, `ConnectWiseProvider` impl, `PsaProviderRegistry` for multi-PSA dispatch. Credentials encrypted at rest via `services/psa/encryption.py` (Fernet). Per-team credentials, never per-user. Endpoints in `api/endpoints/integrations.py`. In-memory TTL cache in `services/psa/cache.py`.
+- **Integration flows:** session docs → ticket notes (`POST /service/tickets/{id}/notes`, markdown supported); ticket context → FlowPilot; callbacks via `/system/callbacks` with HMAC verification.
+- **API rules:** pin version via Accept header `application/vnd.connectwise.com+json; version=2025.16`. Paginate ≤1000/page. Dynamic base URL via `/login/companyinfo/{companyId}`. Request minimal permissions (MY, not ALL).
+
+---
+
+## Coding standards
+
+- **Python:** type hints everywhere, async/await for DB, Pydantic v2, `DateTime(timezone=True)` always.
+- **TypeScript:** interfaces for all data, `const` over `let`, functional components + hooks, shared logic in custom hooks.
+- **Git:** feature branch before committing (`git checkout -b feat/feature-name`). Commit format: `type: description` (feat/fix/refactor/docs/test/chore). Large features: commit per phase with `npm run build` validation. Push to Gitea — auto-mirrors to GitHub (`.gitea/workflows/mirror-to-github.yml`); never push GitHub directly. (Agent-specific `Co-Authored-By` trailers live in CLAUDE.md / AGENTS.md.)
+
+**After shipping:** update [CURRENT-STATE.md](../CURRENT-STATE.md) + [03-DEVELOPMENT-ROADMAP.md](../03-DEVELOPMENT-ROADMAP.md), `gh issue close #N` for resolved issues, add lessons only for non-obvious traps (otherwise let the code speak).
+
+---
+
+## Common tasks
+
+- **New endpoint:** `endpoints/` → `router.py` → `schemas/` → tests → frontend API client.
+- **New page:** `pages/` → route in `router.tsx` → nav in `AppLayout.tsx`.
+- **New public route:** top-level in `router.tsx` alongside `/login`, not inside `ProtectedRoute`.
+- **New frontend API module:** types in `types/` → export from `types/index.ts` → client in `api/` → export from `api/index.ts`.
+- **Schema change:** update model → `alembic revision -m "desc"` → review → `alembic upgrade head`.
+- **New `VITE_*` env var:** add as `ARG` + `ENV` in `frontend/Dockerfile` for Railway builds (Lesson 60 — Railway env vars are runtime-only, Vite bakes at build time).
+- **Account sub-page:** add route in `router.tsx` under `account` children + add link card in `AccountSettingsPage.tsx` — `AccountLayout` has NO sidebar nav.
+
+---
+
+## Design system
+
+**Source of truth: [DESIGN-SYSTEM.md](../DESIGN-SYSTEM.md).** Read before any visual change.
+
+- Flat high-contrast dark theme, Sentry/PostHog-inspired. **No** glass, backdrop blur, ambient orbs, gradient surfaces.
+- Accent **electric blue** (#60a5fa dark / #2563eb light) — ≤5% of UI, interactive elements only. Warning amber (#fbbf24), info cyan (#67e8f9), success green (#34d399), danger red (#f87171). Each with `-dim` at 10% opacity.
+- Backgrounds: `bg-sidebar` (#0e1016) → `bg-page` (#16181f) → `bg-card` (#1e2028) → `bg-elevated` (#2a2d38). Borders `border-default` / `border-hover`.
+- Text: `text-heading` → `text-primary` → `text-muted-foreground` → `text-muted`.
+- Fonts: IBM Plex Sans (body), Bricolage Grotesque (heading, 700 weight for logo), JetBrains Mono (code).
+- Logo: 30px gradient square (ember orange) + "ResolutionFlow" in Bricolage Grotesque. Assets in `brand-assets/`, `frontend/src/assets/brand/`, `frontend/public/icons/`.
+- Mockups: `docs/mockups/` (HTML).
+- **Deprecated — do not use:** glass-card, glass-stat, `bg-gradient-brand`, `backdrop-filter: blur()`, ambient orbs, purple gradients, ember orange as accent, cyan as accent (cyan is info only).
+
+---
+
+## Frontend patterns
+
+- **Component basics:** `cn()` from `@/lib/utils`, Lucide icons, `Modal.tsx` for modals (mobile-responsive `items-end sm:items-center` + `max-w-full sm:max-w-lg`).
+- **Types:** Create in `types/`, export from `types/index.ts`, `import type { T } from '@/types'`.
+- **Routing:** `getTreeNavigatePath()` / `getTreeEditorPath()` from `@/lib/routing`. Tree editor is `/trees/new`. All dashboard session clicks → `/pilot/:id` regardless of `session_type`.
+- **Lazy routes:** `lazyWithRetry` from `@/lib/lazyWithRetry.ts`, not `React.lazy` (auto-reload on stale chunks).
+- **Public pages:** raw `fetch()` with full URL, NOT `apiClient` (which requires auth tokens).
+- **Toast:** `toast.warning()` not `toast.warn()`. Import from `@/lib/toast` — methods: `success`, `error`, `warning`, `info`.
+- **Assistant chat:** uses local React `useState`, not Zustand. All three send paths (`handleSend`, `sendPrefill`, `handleResumeNew`) must call `setShowTaskLane(true)` when response has actions/questions.
+- **Chat backend wiring:** `aiSessionsApi.sendChatMessage` → `/ai-sessions/{id}/chat` → `unified_chat_service.py`. NOT `assistant_chat_service.py` (removed except retention settings).
+- **FlowPilot:** Actions live in page header (Resolve/Escalate/Share Update + overflow). `useBlocker` for active-session nav guard. "Pause & Leave" auto-pauses.
+- **AI markers:** `[QUESTIONS]`, `[ACTIONS]`, `[FORK]`, `[DELTA]...[/DELTA]` (editor), `[TREE_UPDATE]` (troubleshooting builder), `[STEPS_UPDATE]` (procedural builder), `[METADATA]`. Parsed in `unified_chat_service.py`; conversation history stores stripped `display_content`. If markers disappear: check system-prompt final reminder + per-user-message `[SYSTEM: ...]` injection in `_call_anthropic_cached()`.
+- **Image uploads:** paste/attach → Railway S3 via `uploadsApi.upload()` → resized by `storage_service.resize_image_for_vision()` (Pillow, 1568px max, PNG→JPEG) → base64 → Claude multimodal blocks. Max 3/msg. Images NOT stored in history.
+- **Async select-load-apply:** guard with a ref (pattern in `AssistantChatPage` `currentChatRef`). Update synchronously on every selection change; after every `await`, bail out if `ref.current !== thisId`.
+- **Editor-Embedded Flow Assist:** `EditorAIPanel` (320px side panel) + `useEditorAI`. Ghost nodes via `_suggestion: true`. Route actions via `settings.get_model_for_action()`.
+- **Script Builder:** `/script-builder`, chat-style. Backend `ScriptBuilderSession`, `script_builder_service.py`, endpoints `/scripts/builder/`. FlowPilot handoff via `action_type: "open_script_builder"` + `sessionStorage`.
+- **Intake form field schema:** `variable_name` + `field_type` (NOT `name` / `type`).
+- **Node field priority** (copilot, summaries): `title` → `question` → `description` → `content` → `label`.
+- **Procedural sessions auto-start** on page load (no intake/Start screen). Troubleshooting flows DO have a start screen.
+
+---
+
+## Critical lessons
+
+> Lessons 1-40 archived to [docs/LESSONS-ARCHIVE.md](../docs/LESSONS-ARCHIVE.md) — fixes baked into the codebase. **Grep the archive when an error message or symptom is unfamiliar, or after two failed attempts at resolving an issue.** Don't pre-load for routine work.
+
+### Backend / data
+
+- **APScheduler interval jobs always `max_instances=1`** — without it, overlapping runs reprocess records (TOCTOU).
+- **`get_db` rolls back on exception** — never remove the `await session.rollback()`, or one failed request poisons the connection with `InFailedSQLTransaction` cascading.
+- **Startup routines on tenant-isolated tables must use `_admin_session_factory()`, not `get_db()`.** Phase 4 RLS has no `app.current_account_id` set at startup. `get_service_account_id` is safe (reads cached `app.state`).
+- **Backfill migrations adding `account_id`:** grep ALL `ModelClass(` sites in service code to verify `account_id=` is passed. SQLAlchemy accepts `None` silently — Phase 4 RLS WITH CHECK surfaces the problem at runtime as `InsufficientPrivilegeError: new row violates row-level security policy`.
+- **`tree_shares.account_id = tree.account_id`**, never `current_user.account_id`. A super_admin sharing another tenant's tree must produce the share in the tree owner's tenant, or it becomes invisible post-RLS.
+- **Global tables (no `account_id`, never in RLS migrations):** `script_categories`, `platform_steps`, `template_trees`, `plan_feature_defaults`, `accounts`. Scan at class level — one `.py` file can hold multiple classes with different columns (e.g. `ScriptCategory` vs `ScriptTemplate`).
+- **`ai_sessions.status` is VARCHAR(30)** — fits `requesting_escalation` (23 chars). Migration `f0aad74ea51b` widened from 20.
+- **PostgreSQL `func.sum(case(...))` returns `Decimal` via asyncpg** — cast to `int()` before Pydantic `dict[str, Any]`.
+- **Enhancement / branch_addition proposals need `modified_flow_data` via "Edit & Publish"** — backend 400 on direct approve. Only `new_flow` supports direct approve.
+- **Adding email types:** static async method on `EmailService` in `core/email.py`. Fire-and-forget from endpoints (log errors, don't fail the request).
+
+### AI / FlowPilot
+
+- **Anthropic SDK `max_retries=1`** — default of 2 can take 3× the timeout.
+- **Model tier routing:** `settings.get_model_for_action(action_type)`. Always alias form (`claude-sonnet-4-6`).
+- **FlowPilot must ask GUI-vs-script before suggesting either** when both are viable — see `FLOWPILOT_SYSTEM_PROMPT` in `flowpilot_engine.py`.
+- **Telemetry events to grep:** `anthropic.cache` (prompt-cache hit/create), `mcp.turn` (per-turn MCP availability), `mcp.fallback` (MCP silent-retry fired).
+- **Don't put literal payloads in system prompts.** Bit us twice in one day: a worked `[QUESTIONS]` example with literal "Outlook + jsmith" content, and a full DNS troubleshooting tree, both caused Claude to recite that content on unrelated tickets — the symptom looked like task-lane state leaking across chats. The fix is structural: every output example in a system prompt uses `<placeholder>` syntax (`{"text": "<one short, specific question>"}`), never literal field values. Real-looking format examples live in few-shot messages (separate file, separate code path), not system prompts. Guardrail: `tests/test_prompt_anti_parrot.py` scans every `*_PROMPT`/`*_SCHEMA`/`*_PROTOCOL`/`*_FORMAT` constant in `app/services/` and `app/core/`; CI fails when a marker block contains a literal JSON value or when a known leaked token (jsmith, DC01, ADSync, Dnscache, etc.) appears anywhere in a prompt.
+
+### Frontend / UI
+
+- **Flex height chain:** every ancestor from `app-shell` grid to React Flow canvas needs `flex` + `flex-1` + `min-h-0` or `h-full`. Missing `flex` collapses to 0. Same rule for FlowPilot action bar and any tall scroller.
+- **React Flow CSS in Tailwind v4:** import in `index.css`, not component JS. Override dark theme via `--xy-*` CSS vars.
+- **`text-secondary` renders invisible on dark** — Tailwind v4 maps it to `--color-secondary` (a surface color). Use `text-muted-foreground` for readable secondary text. Avoid `text-muted` for body — labels only.
+- **`bg-accent` is electric blue — never for code/kbd.** Use `bg-white/[0.12] border border-white/[0.06]` for inline code, `bg-white/[0.08]` for kbd. Accent reserved for interactive elements.
+- **`landing.css` uses self-contained `--lp-*` vars** — never `var(--color-*)` theme tokens (they resolve incorrectly outside the app shell).
+- **Never `transition: all`** — list properties explicitly, or layout props animate and jank.
+- **Date range filter end dates:** `setHours(23, 59, 59, 999)` before sending, or the day's items are excluded. For string-based date inputs, append `T23:59:59.999Z`.
+- **TopBar search:** full bar `hidden sm:block`, icon button `sm:hidden` — both open CommandPalette.
+- **Hover pop-out cards:** scrim `pointer-events-none`, expanded card has its own click handler at `z-50`, dismiss via `onMouseLeave` on wrapper. Never put handlers on the scrim.
+- **`tsc -b` in Dockerfile is stricter than `tsc --noEmit`** — enforces `noUnusedLocals` / `noUnusedParameters` as hard errors. Check IDE yellow squiggles before pushing.
+- **Dashboard prefill auto-submits** via `useEffect` + `prefillHandledRef` guard — no double-enter.
+- **Global Axios 5xx interceptor fires before component `.catch()`** — fix optional-data endpoints at the source (return `[]` / `{}` on provider failure), not in the component.
+- **Playwright strict mode:** scope selectors to avoid sidebar/main ambiguity. Use `getByRole('heading', { name })` or `.animate-scale-in` locators, not bare `getByText()`.
+
+### Env / infra
+
+- **Node 20.19+ required** (Vite 7). `nvm use 20` or `PATH="$HOME/.nvm/versions/node/v20.19.0/bin:$PATH"`.
+- **Railway backend service is `patherly`, DB name `railway`.** Public Postgres proxy: `interchange.proxy.rlwy.net:45797`.
+- **Railway Object Storage bucket `resolutionflow-uploads`.** Env vars `STORAGE_*`. boto3 in `storage_service.py`. Dockerfile needs Pillow + `libjpeg-dev` / `zlib1g-dev`.
+- **PostHog:** `PostHogProvider` + `posthog.init()` in `main.tsx`. Helpers in `lib/analytics.ts`. Env: `VITE_PUBLIC_POSTHOG_KEY`, `VITE_PUBLIC_POSTHOG_HOST`. `identifyUser()` in `authStore.fetchUser()`, `resetAnalytics()` on logout.
+- **bun PATH on devserver01:** `BUN_INSTALL="$HOME/.bun"`, `PATH="$BUN_INSTALL/bin:$PATH"`. Playwright Chromium needs `libatk1.0-0 libatk-bridge2.0-0 libcups2 libxkbcommon0 libatspi2.0-0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2`.
+- **Full-stack change:** trace schema → endpoint → API client → hook → store → UI. Don't assume one end proves the other.
+- **Dev env** — see [DEV-ENV.md](../DEV-ENV.md) for current topology, `REPO_ROOT` requirement when compose runs inside a container, Vite `allowedHosts`, linuxserver.io `group_add` + custom-cont-init.d workaround, `docker compose up` no-op-on-unchanged-hash gotcha.
+
+---
+
+## Quick reference
+
+| What | Where |
+|---|---|
+| Detailed status | [CURRENT-STATE.md](../CURRENT-STATE.md) |
+| Roadmap | [03-DEVELOPMENT-ROADMAP.md](../03-DEVELOPMENT-ROADMAP.md) |
+| Design system | [DESIGN-SYSTEM.md](../DESIGN-SYSTEM.md) |
+| Dev env | [DEV-ENV.md](../DEV-ENV.md) |
+| Archived lessons | [docs/LESSONS-ARCHIVE.md](../docs/LESSONS-ARCHIVE.md) |
+| ConnectWise API | `docs/connectwise/` |
+| GitHub issues | `gh issue list --state open` |
+| Local API docs | <http://localhost:8000/api/docs> |
+| Handoff system | [.ai/README.md](README.md) |

.ai/README.md

@@ -0,0 +1,42 @@
+# .ai/ — dual-agent handoff system
+
+ResolutionFlow uses two coding agents: **Claude Code** (primary) and **OpenAI Codex** (resume when Claude hits session or weekly limits). This directory holds the shared state that lets either agent start a session with full context.
+
+## Files
+
+| File | Holds | Written when | Read when |
+|---|---|---|---|
+| [PROJECT_CONTEXT.md](PROJECT_CONTEXT.md) | Stable repo truth: stack, structure, SaaS shape, ConnectWise, coding standards, frontend patterns, critical lessons | Only when the repo's shape changes | Every session start |
+| [CURRENT_TASK.md](CURRENT_TASK.md) | The single active task: goal, DoD, assumptions, out-of-scope | On task start; status updates during work | Every session start |
+| [HANDOFF.md](HANDOFF.md) | Exact resume point: branch, where you left off, next steps, blockers | On session end / context-window limit | Every session start (most important) |
+| [TODO.md](TODO.md) | Backlog of work NOT currently active | When deferring or queueing work | Only when `CURRENT_TASK.md` is `complete` |
+| [DECISIONS.md](DECISIONS.md) | Append-only architectural decision log | When an architectural choice is made | Skim top entries each session |
+| [SESSION_LOG.md](SESSION_LOG.md) | Append-only chronological history | On session end | Only when broader context is needed |
+
+Agent-specific tooling lives at the repo root:
+- [../CLAUDE.md](../CLAUDE.md) — Claude Code's tooling (GitNexus, gstack slash commands, Claude trailer)
+- [../AGENTS.md](../AGENTS.md) — OpenAI Codex's tooling (grep/rg fallbacks, Codex trailer)
+
+Both root files contain an **identical shared-protocol block**. If you edit one, edit the other.
+
+## The handoff ritual
+
+At session end (limit hit, task complete, or user stop): update `HANDOFF.md` to reflect the new resume point, update `CURRENT_TASK.md` status if it changed, append to `DECISIONS.md` if you made an architectural call, append a session entry to `SESSION_LOG.md`, and WIP-commit any dirty working tree with `wip(handoff): <one-line>` unless told otherwise. Don't push.
+
+## How to invoke a resume
+
+Tell the agent:
+
+> Read CLAUDE.md (or AGENTS.md) and follow its instructions.
+
+The agent will read its root file, which directs it to `.ai/PROJECT_CONTEXT.md`, `.ai/CURRENT_TASK.md`, and `.ai/HANDOFF.md` before doing anything else.
+
+## Recovery
+
+The previous monolithic CLAUDE.md is recoverable via:
+
+```bash
+git show pre-ai-handoff:CLAUDE.md
+```
+
+(Tag `pre-ai-handoff` on commit `e110fed` — the snapshot taken before this migration.)

.ai/SESSION_LOG.md

@@ -0,0 +1,23 @@
+# SESSION_LOG.md
+
+> Append-only chronological record. Newest entries at the top. Skim when broader context is needed.
+> Entry format:
+>
+> ```
+> ## YYYY-MM-DD HH:MM <timezone> — <agent> — <one-line summary>
+> - What was accomplished
+> - What was left for next session
+> - Files touched
+> ```
+
+---
+
+## 2026-04-24 — Claude Code — Migrate to dual-agent handoff system
+
+- Split CLAUDE.md into `.ai/PROJECT_CONTEXT.md` + shared-protocol root files (`CLAUDE.md`, `AGENTS.md`).
+- Seeded `CURRENT_TASK.md`, `HANDOFF.md`, `TODO.md`, `DECISIONS.md`, `SESSION_LOG.md`, `README.md`.
+- Deleted legacy `SESSION-HANDOFF.md` (superseded).
+- Left for next session: first real feature task should replace the seed `CURRENT_TASK.md` and update `HANDOFF.md` with real resume state.
+- Files touched: `.ai/*.md` (created), `CLAUDE.md` (rewritten), `AGENTS.md` (created), `SESSION-HANDOFF.md` (deleted).
+- Follow-up (same day): Codex review pass flagged stale SaaS-role claim and incomplete file-listings carried over from the pre-migration CLAUDE.md. Verified against `backend/app/core/permissions.py`, `frontend/src/hooks/usePermissions.ts`, `backend/app/api/deps.py`, `backend/app/api/router.py`, and `backend/app/services/psa/`. Corrected PROJECT_CONTEXT.md role hierarchy (`super_admin > owner > engineer > viewer`, not `team_admin`), added `require_account_owner` / `require_team_admin` to deps list, replaced stale endpoint comment with a summary pointing at `api/router.py`, added `exceptions.py` + `ticket_context.py` to the PSA file list. Also replaced seed-example content in `CURRENT_TASK.md` and `TODO.md` with clearer empty-state sentinels.
+- Branch cleanup (same day): committed pending test-isolation work as `b14a16a chore(tests): gate RLS tests behind RUN_RLS_TESTS flag`, new Phase 9 review doc as `b3506b5 docs(pilot): phase 9 review issues`, and `.remember/` gitignore entry as `b3be1e0 chore: ignore .remember/ skill runtime state`. Deleted `docs/landing-handoff/` (prepared for external design work, not meant to live in the repo). Working tree clean; 3 cleanup commits unpushed.

.ai/TODO.md

@@ -0,0 +1,12 @@
+# TODO.md
+
+> Backlog of work NOT currently active. Read only when `CURRENT_TASK.md` status is `complete`.
+> Format: `- [ ] short description — optional link to issue/PR`
+
+## Up next
+
+- [ ] No queued backlog yet.
+
+## Backlog
+
+- [ ] No queued backlog yet.

.claude/hooks/check-gstack.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Block skill usage when gstack is not installed globally.
+
+if [ ! -d "$HOME/.claude/skills/gstack/bin" ]; then
+  cat >&2 <<'MSG'
+BLOCKED: gstack is not installed globally.
+
+gstack is required for AI-assisted work in this repo.
+
+Install it:
+  git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
+  cd ~/.claude/skills/gstack && ./setup --team
+
+Then restart your AI coding tool.
+MSG
+  echo '{"permissionDecision":"deny","message":"gstack is required but not installed. See stderr for install instructions."}'
+  exit 0
+fi
+
+echo '{}'

.claude/settings.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/check-gstack.sh\""
+          }
+        ]
+      }
+    ]
+  }
+}

.gitignore

@@ -207,7 +207,11 @@ marimo/_lsp/
 __marimo__/
 
 # Claude Code (local config, agents, settings)
-.claude/
+.claude/*
+!.claude/settings.json
+!.claude/hooks/
+.claude/hooks/*
+!.claude/hooks/check-gstack.sh
 .agents/
 
 # Database dumps
@@ -238,3 +242,6 @@ package-lock.json
 # graphify knowledge graph outputs
 graphify-out/
 .graphify_python
+
+# remember skill runtime state (hook logs, PIDs)
+.remember/

AGENTS.md

@@ -0,0 +1,61 @@
+# AGENTS.md — ResolutionFlow
+
+You are OpenAI Codex, the resume agent for ResolutionFlow. Claude Code is the primary coding agent; you step in when Claude hits session or weekly limits.
+
+The first thing to do every session: read [`.ai/PROJECT_CONTEXT.md`](.ai/PROJECT_CONTEXT.md), [`.ai/CURRENT_TASK.md`](.ai/CURRENT_TASK.md), and [`.ai/HANDOFF.md`](.ai/HANDOFF.md). The ritual is spelled out below.
+
+> The protocol section below is byte-identical to the shared block in CLAUDE.md. If you edit one, edit the other.
+
+## Shared protocol
+
+### Startup ritual (every session)
+
+1. Read `.ai/PROJECT_CONTEXT.md` — architectural truth for this repo.
+2. Read `.ai/CURRENT_TASK.md` — what we're actively working on.
+3. Read `.ai/HANDOFF.md` — exact resume point.
+4. Skim `.ai/DECISIONS.md` for recent entries relevant to the current task.
+5. Run `git log --oneline -15` and `git status`.
+6. Before taking action, state back in two sentences: the current goal and your proposed next action.
+
+### Handoff ritual (session end — limit hit, task complete, or user stop)
+
+1. Update `.ai/HANDOFF.md` to reflect new state. Keep it under ~2K tokens.
+2. If `CURRENT_TASK.md` status changed, update it.
+3. If you made an architectural decision, append to `.ai/DECISIONS.md`.
+4. Append a session entry to `.ai/SESSION_LOG.md`.
+5. If working tree is dirty, commit WIP with `wip(handoff): <one-line summary>`. Do not push unless explicitly asked.
+
+### Writing rules for .ai/ files
+
+- Use model-neutral voice in `HANDOFF.md`, `SESSION_LOG.md`, `DECISIONS.md` ("previous session did X", NOT "Claude did X" or "Codex did X"). Exception: `SESSION_LOG.md` entries include an `<agent>` field in the header.
+- Do not duplicate content between files. `CURRENT_TASK.md` holds the goal, `HANDOFF.md` holds the resume point, `TODO.md` holds the backlog. If unsure where something goes, check `.ai/README.md`.
+- Don't invent facts about the repo. If you're uncertain, write `TODO: confirm` and flag it.
+
+### Project principle
+
+Prefer correct architecture over minimal diff. Flag "simpler approach" tradeoffs for review before taking them.
+
+## Codex-specific notes
+
+### Tooling you do NOT have
+
+- **No GitNexus tools.** Use `grep -r`, `rg`, `git grep`, or `find` for code search. For blast-radius reasoning, grep call sites manually and read the files.
+- **No gstack slash commands** (`/review`, `/ship`, `/qa`, `/browse`, `/investigate`, `/design-review`, `/plan-*`). Run the equivalent work directly: `pytest` for tests, `npm run build` for frontend validation, manual PR description for review flow.
+- **No `/codex` second-opinion command.** You are Codex.
+
+### Git trailer
+
+Every commit: `Co-Authored-By: Codex <noreply@openai.com>`
+
+### Model selection
+
+Handled on OpenAI's side. Do not attempt to set Anthropic model aliases for your own runtime. (The repo's application code still uses Anthropic aliases like `claude-sonnet-4-6` via `settings.get_model_for_action()` — that's runtime config for the product, not your agent.)
+
+### Reviewing Claude's work
+
+When you resume from a Claude session, assume some decisions may have been informed by GitNexus queries or gstack commands whose output isn't in the handoff. If a decision looks unverified from the `.ai/` files alone, either:
+
+- re-verify with `grep`/`rg`/file reads, or
+- flag it in `HANDOFF.md` under "Open questions" so Michael or Claude can confirm on the next handoff.
+
+Do not assume tooling output that isn't written down.

CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to ResolutionFlow are documented here.
 
+## [0.1.0.0] - 2026-04-16
+
+### Added
+- **PSA Ticket Management** — dedicated `/tickets` page with URL-param filter state (board, status, priority, company, assignment, closed), paginated ticket list, and slide-in detail panel
+- **TicketDetailPanel** — full ticket view with notes feed, configurations, related tickets, and resource manager; optimistic status updates via dropdown
+- **NewTicketModal** — two-tab ticket creation: "Quick Create (AI)" parses natural language into a pre-filled form via Claude, "Full Form" for manual entry; validates required fields before submitting to CW
+- **AiTicketParseForm** — natural language → structured ticket data using Claude; resolves board and assignee automatically, flags fields needing manual selection
+- **TicketResourceManager** — add/remove CW members as ticket resources with member search autocomplete
+- **Spin-off ticket creation from ResolutionAssist** — AI can detect when a new ticket should be created mid-session and surface the NewTicketModal pre-filled with session context
+- **TicketQueue improvements** — dashboard widget now detects member mapping, caps at 5 items, shows "View All" link to `/tickets`
+- **Board statuses endpoint** — `GET /integrations/boards/{board_id}/statuses` for direct status lookup without a ticket context
+- **Paginated ticket search** — `search_tickets` returns `{items, total, page, page_size}`; parallel CW count fetch for accurate totals
+- **Ticket service layer** — `ticket_service.py` wraps all PSA mutations (create, update status, list/add/remove resources)
+- **Priority lookup endpoint** — `GET /integrations/tickets/priorities` for form dropdowns
+- **PSA error surfacing** — `/tickets` page shows inline error banner with specific guidance when CW returns a permissions error (replaces silent empty state)
+
+### Fixed
+- CW query injection: sanitize search `query` string to strip single quotes before interpolation into CW conditions
+- `company_id` filter now correctly applied to CW ticket search conditions (was silently ignored)
+- `linkedTicket` fetch in ResolutionAssist guarded with `currentChatRef` to prevent race condition on session switch
+- Members endpoint auth gate no longer rejects engineers without a PSA mapping
+- Board fallback: ticket list derives available boards from ticket data when the boards API returns empty (permissions)
+- Assignment search and "Load More" removed from resource manager in favor of direct member list
+
 ## [Unreleased]
 
 ### Added

CLAUDE.md

@@ -1,215 +1,43 @@
 # CLAUDE.md — ResolutionFlow
 
-> SaaS troubleshooting platform for MSPs. Last reviewed 2026-04-19.
+You are Claude Code, the primary coding agent for ResolutionFlow. OpenAI Codex is the resume agent when you hit session or weekly limits.
 
-**Naming:** Canonical product name is **ResolutionFlow**. `patherly` is the legacy internal name — still present in DB name (`patherly` on Railway, `resolutionflow` locally), some Railway service names, and historical paths. Treat as aliases, not canonical. Docker containers are `resolutionflow_*`.
+The first thing to do every session: read [`.ai/PROJECT_CONTEXT.md`](.ai/PROJECT_CONTEXT.md), [`.ai/CURRENT_TASK.md`](.ai/CURRENT_TASK.md), and [`.ai/HANDOFF.md`](.ai/HANDOFF.md). The ritual is spelled out below.
 
-**User terminology:** "Flows" (not Trees), "Projects" (not Procedures), "Solutions Library" (not Step Library). Maintenance flows hidden from pilot UI (backend retains them). DB column `tree_type` values unchanged.
+> The protocol section below is byte-identical to the shared block in AGENTS.md. If you edit one, edit the other.
 
-**SaaS shape:** Multi-tenant by account. Roles: `super_admin` > `team_admin` > `engineer` > `viewer`. Team admin = `role='engineer'` + `is_team_admin=True` + valid `team_id`. Never `role=='admin'` — use `is_super_admin`. Backend deps in `app/api/deps.py`: `get_current_active_user`, `require_engineer_or_admin`, `require_admin`. Frontend: `usePermissions()` hook. Central logic in `backend/app/core/permissions.py` + `frontend/src/hooks/usePermissions.ts`.
+## Shared protocol
 
-**Status:** Go-to-Market Validation (pre-PMF). Backend feature-complete (55+ endpoints, 100+ tests). Phase 0.5 FlowPilot telemetry baseline accruing. See `CURRENT-STATE.md` for live status, `03-DEVELOPMENT-ROADMAP.md` for phases.
+### Startup ritual (every session)
 
-**Principle:** Prefer correct architecture over minimal diff. Flag "simpler approach" tradeoffs for review before taking them.
+1. Read `.ai/PROJECT_CONTEXT.md` — architectural truth for this repo.
+2. Read `.ai/CURRENT_TASK.md` — what we're actively working on.
+3. Read `.ai/HANDOFF.md` — exact resume point.
+4. Skim `.ai/DECISIONS.md` for recent entries relevant to the current task.
+5. Run `git log --oneline -15` and `git status`.
+6. Before taking action, state back in two sentences: the current goal and your proposed next action.
 
----
+### Handoff ritual (session end — limit hit, task complete, or user stop)
 
-## Tech stack
+1. Update `.ai/HANDOFF.md` to reflect new state. Keep it under ~2K tokens.
+2. If `CURRENT_TASK.md` status changed, update it.
+3. If you made an architectural decision, append to `.ai/DECISIONS.md`.
+4. Append a session entry to `.ai/SESSION_LOG.md`.
+5. If working tree is dirty, commit WIP with `wip(handoff): <one-line summary>`. Do not push unless explicitly asked.
 
-- **Backend:** Python 3.11 + FastAPI, SQLAlchemy 2.0 async (asyncpg), Alembic, Pydantic v2, JWT (python-jose + bcrypt, JTI refresh rotation), APScheduler (in-process with FastAPI lifespan).
-- **Frontend:** React 19 + Vite + TypeScript, Tailwind v4 (CSS-only config in `index.css`), Zustand (immer + zundo), React Router v7, Axios (token-refresh interceptor), Lucide.
-- **DB:** PostgreSQL 16 (RLS enabled Phase 4, pgvector).
+### Writing rules for .ai/ files
 
----
+- Use model-neutral voice in `HANDOFF.md`, `SESSION_LOG.md`, `DECISIONS.md` ("previous session did X", NOT "Claude did X" or "Codex did X"). Exception: `SESSION_LOG.md` entries include an `<agent>` field in the header.
+- Do not duplicate content between files. `CURRENT_TASK.md` holds the goal, `HANDOFF.md` holds the resume point, `TODO.md` holds the backlog. If unsure where something goes, check `.ai/README.md`.
+- Don't invent facts about the repo. If you're uncertain, write `TODO: confirm` and flag it.
 
-## Project structure
+### Project principle
 
-```
-resolutionflow/
-├── backend/
-│   ├── app/
-│   │   ├── main.py                     # FastAPI entry
-│   │   ├── api/endpoints/              # auth, trees, sessions, admin, steps, survey, copilot, assistant_chat, integrations, flow_proposals, flowpilot_analytics
-│   │   ├── api/deps.py                 # auth deps (incl. require_team_admin)
-│   │   ├── api/router.py               # registration
-│   │   ├── core/                       # config, database, permissions, security, audit, rate_limit
-│   │   ├── models/                     # SQLAlchemy (incl. FlowProposal)
-│   │   ├── schemas/                    # Pydantic
-│   │   ├── services/psa/               # PSA provider pattern (base, connectwise/, autotask/, halopsa/, cache, encryption, registry, types)
-│   │   ├── services/knowledge_flywheel.py + _scheduler.py
-│   │   └── services/knowledge_gap_service.py
-│   ├── alembic/versions/               # 001-070 sequential, then hex hash
-│   ├── scripts/                        # seed_data, seed_trees, seed_test_users
-│   └── tests/                          # pytest integration
-├── frontend/
-│   ├── src/
-│   │   ├── api/                        # Axios client + endpoint modules
-│   │   ├── components/                 # common, layout, dashboard, tree-editor, session, procedural, procedural-editor, library, step-library, ui, flowpilot
-│   │   ├── hooks/                      # usePermissions, useSessionTimer, useKeyboardShortcuts
-│   │   ├── pages/
-│   │   ├── store/                      # Zustand (auth, treeEditor, proceduralEditor, userPreferences, scriptGeneratorStore)
-│   │   └── types/
-│   └── (Tailwind v4 CSS-only config in src/index.css)
-├── docs/plans/archive/                 # pre-March 2026 plans
-├── docs/connectwise/                   # CW API reference + best-practices guides
-├── docs/LESSONS-ARCHIVE.md             # archived lessons (fixes in code)
-├── CLAUDE.md · CURRENT-STATE.md · DESIGN-SYSTEM.md · DEV-ENV.md
-```
+Prefer correct architecture over minimal diff. Flag "simpler approach" tradeoffs for review before taking them.
 
----
+## Claude-specific tooling
 
-## Design system
-
-**Source of truth: [DESIGN-SYSTEM.md](DESIGN-SYSTEM.md).** Read before any visual change.
-
-- Flat high-contrast dark theme, Sentry/PostHog-inspired. **No** glass, backdrop blur, ambient orbs, gradient surfaces.
-- Accent **electric blue** (#60a5fa dark / #2563eb light) — ≤5% of UI, interactive elements only. Warning amber (#fbbf24), info cyan (#67e8f9), success green (#34d399), danger red (#f87171). Each with `-dim` at 10% opacity.
-- Backgrounds: `bg-sidebar` (#0e1016) → `bg-page` (#16181f) → `bg-card` (#1e2028) → `bg-elevated` (#2a2d38). Borders `border-default` / `border-hover`.
-- Text: `text-heading` → `text-primary` → `text-muted-foreground` → `text-muted`.
-- Fonts: IBM Plex Sans (body), Bricolage Grotesque (heading, 700 weight for logo), JetBrains Mono (code).
-- Logo: 30px gradient square (ember orange) + "ResolutionFlow" in Bricolage Grotesque. Assets in `brand-assets/`, `frontend/src/assets/brand/`, `frontend/public/icons/`.
-- Mockups: `docs/mockups/` (HTML).
-- **Deprecated — do not use:** glass-card, glass-stat, `bg-gradient-brand`, `backdrop-filter: blur()`, ambient orbs, purple gradients, ember orange as accent, cyan as accent (cyan is info only).
-
----
-
-## ConnectWise PSA
-
-Reference: `docs/connectwise/` — start with `CONNECTWISE-API-REFERENCE.md`, then the `best-practices/` guides. Extracted OpenAPI spec in `connectwise-psa-resolutionflow-reference.json` (670 endpoints, v2025.16); full spec in `connectwise-psa-openapi-full.json`.
-
-- **Auth:** API Key (Base64 `companyId+publicKey:privateKey`) + `clientId` header every request. `clientId` is server-side (`CW_CLIENT_ID` in `config.py`) — identifies ResolutionFlow, not per-tenant. Per-connection: `company_id`, `public_key`, `private_key`, `server_url`.
-- **Architecture:** `services/psa/` provider pattern — `PSAProvider` base, `ConnectWiseProvider` impl, `PsaProviderRegistry` for multi-PSA dispatch. Credentials encrypted at rest via `services/psa/encryption.py` (Fernet). Per-team credentials, never per-user. Endpoints in `api/endpoints/integrations.py`. In-memory TTL cache in `services/psa/cache.py`.
-- **Integration flows:** session docs → ticket notes (`POST /service/tickets/{id}/notes`, markdown supported); ticket context → FlowPilot; callbacks via `/system/callbacks` with HMAC verification.
-- **API rules:** pin version via Accept header `application/vnd.connectwise.com+json; version=2025.16`. Paginate ≤1000/page. Dynamic base URL via `/login/companyinfo/{companyId}`. Request minimal permissions (MY, not ALL).
-
----
-
-## Dev commands
-
-Full setup in [DEV-ENV.md](DEV-ENV.md) (host-agnostic, with homelab Proxmox reference topology). Day-to-day:
-
-```bash
-docker compose -f docker-compose.dev.yml up -d                      # start stack
-cd backend && source venv/bin/activate && uvicorn app.main:app --reload
-cd frontend && npm run dev
-pytest --override-ini="addopts="                                    # tests (first time: CREATE DATABASE resolutionflow_test)
-cd backend && alembic upgrade head                                  # migrate
-cd backend && alembic revision -m "desc"                            # manual migration (preferred per Lesson 77)
-cd backend && alembic revision --autogenerate -m "desc"             # picks up drift; review carefully
-cd frontend && npm run build                                        # stricter than tsc --noEmit — final check
-cd frontend && npx tsc -b                                           # TS-only check when dist/ has EACCES
-docker exec -it resolutionflow_postgres psql -U postgres -d resolutionflow
-python -m scripts.seed_trees                                        # seed (from backend/)
-```
-
-**URLs:** Frontend <http://localhost:5173>, backend <http://localhost:8000>, API docs <http://localhost:8000/api/docs>.
-
-**Test users** (all password `TestPass123!`): `admin@resolutionflow.example.com` (super_admin), `teamadmin@resolutionflow.example.com`, `engineer@resolutionflow.example.com`, `pro@resolutionflow.example.com`.
-
-**CI:** Gitea (`gitea.resolutionflow.com/chihlasm/resolutionflow/actions`). `gh` CLI works for issues/PRs on the GitHub mirror, but not CI runs.
-
-**Never pass `--rev-id`** to alembic — let it generate the hex hash.
-
----
-
-## Common tasks
-
-- **New endpoint:** `endpoints/` → `router.py` → `schemas/` → tests → frontend API client.
-- **New page:** `pages/` → route in `router.tsx` → nav in `AppLayout.tsx`.
-- **New public route:** top-level in `router.tsx` alongside `/login`, not inside `ProtectedRoute`.
-- **New frontend API module:** types in `types/` → export from `types/index.ts` → client in `api/` → export from `api/index.ts`.
-- **Schema change:** update model → `alembic revision -m "desc"` → review → `alembic upgrade head`.
-- **New `VITE_*` env var:** add as `ARG` + `ENV` in `frontend/Dockerfile` for Railway builds (Lesson 60 — Railway env vars are runtime-only, Vite bakes at build time).
-- **Account sub-page:** add route in `router.tsx` under `account` children + add link card in `AccountSettingsPage.tsx` — `AccountLayout` has NO sidebar nav.
-
----
-
-## Coding standards
-
-- **Python:** type hints everywhere, async/await for DB, Pydantic v2, `DateTime(timezone=True)` always.
-- **TypeScript:** interfaces for all data, `const` over `let`, functional components + hooks, shared logic in custom hooks.
-- **Git:** feature branch before committing (`git checkout -b feat/feature-name`). Format: `type: description` (feat/fix/refactor/docs/test/chore). Always `Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>`. Large features: commit per phase with `npm run build` validation. Push to Gitea — auto-mirrors to GitHub (`.gitea/workflows/mirror-to-github.yml`); never push GitHub directly.
-
-**After shipping:** update `CURRENT-STATE.md` + `03-DEVELOPMENT-ROADMAP.md`, `gh issue close #N` for resolved issues, add lessons here only for non-obvious traps (otherwise let the code speak).
-
----
-
-## Frontend patterns
-
-- **Component basics:** `cn()` from `@/lib/utils`, Lucide icons, `Modal.tsx` for modals (mobile-responsive `items-end sm:items-center` + `max-w-full sm:max-w-lg`).
-- **Types:** Create in `types/`, export from `types/index.ts`, `import type { T } from '@/types'`.
-- **Routing:** `getTreeNavigatePath()` / `getTreeEditorPath()` from `@/lib/routing`. Tree editor is `/trees/new`. All dashboard session clicks → `/pilot/:id` regardless of `session_type`.
-- **Lazy routes:** `lazyWithRetry` from `@/lib/lazyWithRetry.ts`, not `React.lazy` (auto-reload on stale chunks).
-- **Public pages:** raw `fetch()` with full URL, NOT `apiClient` (which requires auth tokens).
-- **Toast:** `toast.warning()` not `toast.warn()`. Import from `@/lib/toast` — methods: `success`, `error`, `warning`, `info`.
-- **Assistant chat:** uses local React `useState`, not Zustand. All three send paths (`handleSend`, `sendPrefill`, `handleResumeNew`) must call `setShowTaskLane(true)` when response has actions/questions.
-- **Chat backend wiring:** `aiSessionsApi.sendChatMessage` → `/ai-sessions/{id}/chat` → `unified_chat_service.py`. NOT `assistant_chat_service.py` (removed except retention settings).
-- **FlowPilot:** Actions live in page header (Resolve/Escalate/Share Update + overflow). `useBlocker` for active-session nav guard. "Pause & Leave" auto-pauses.
-- **AI markers:** `[QUESTIONS]`, `[ACTIONS]`, `[FORK]`, `[DELTA]...[/DELTA]` (editor), `[TREE_UPDATE]` (troubleshooting builder), `[STEPS_UPDATE]` (procedural builder), `[METADATA]`. Parsed in `unified_chat_service.py`; conversation history stores stripped `display_content`. If markers disappear: check system-prompt final reminder + per-user-message `[SYSTEM: ...]` injection in `_call_anthropic_cached()`.
-- **Image uploads:** paste/attach → Railway S3 via `uploadsApi.upload()` → resized by `storage_service.resize_image_for_vision()` (Pillow, 1568px max, PNG→JPEG) → base64 → Claude multimodal blocks. Max 3/msg. Images NOT stored in history.
-- **Async select-load-apply:** guard with a ref (pattern in `AssistantChatPage` `currentChatRef`). Update synchronously on every selection change; after every `await`, bail out if `ref.current !== thisId`.
-- **Editor-Embedded Flow Assist:** `EditorAIPanel` (320px side panel) + `useEditorAI`. Ghost nodes via `_suggestion: true`. Route actions via `settings.get_model_for_action()`.
-- **Script Builder:** `/script-builder`, chat-style. Backend `ScriptBuilderSession`, `script_builder_service.py`, endpoints `/scripts/builder/`. FlowPilot handoff via `action_type: "open_script_builder"` + `sessionStorage`.
-- **Intake form field schema:** `variable_name` + `field_type` (NOT `name` / `type`).
-- **Node field priority** (copilot, summaries): `title` → `question` → `description` → `content` → `label`.
-- **Procedural sessions auto-start** on page load (no intake/Start screen). Troubleshooting flows DO have a start screen.
-
----
-
-## Critical lessons
-
-> Lessons 1-40 archived to `docs/LESSONS-ARCHIVE.md` — fixes baked into the codebase. **Grep the archive when an error message or symptom is unfamiliar, or after two failed attempts at resolving an issue.** Don't pre-load for routine work.
-
-### Backend / data
-
-- **APScheduler interval jobs always `max_instances=1`** — without it, overlapping runs reprocess records (TOCTOU).
-- **`get_db` rolls back on exception** — never remove the `await session.rollback()`, or one failed request poisons the connection with `InFailedSQLTransaction` cascading.
-- **Startup routines on tenant-isolated tables must use `_admin_session_factory()`, not `get_db()`.** Phase 4 RLS has no `app.current_account_id` set at startup. `get_service_account_id` is safe (reads cached `app.state`).
-- **Backfill migrations adding `account_id`:** grep ALL `ModelClass(` sites in service code to verify `account_id=` is passed. SQLAlchemy accepts `None` silently — Phase 4 RLS WITH CHECK surfaces the problem at runtime as `InsufficientPrivilegeError: new row violates row-level security policy`.
-- **`tree_shares.account_id = tree.account_id`**, never `current_user.account_id`. A super_admin sharing another tenant's tree must produce the share in the tree owner's tenant, or it becomes invisible post-RLS.
-- **Global tables (no `account_id`, never in RLS migrations):** `script_categories`, `platform_steps`, `template_trees`, `plan_feature_defaults`, `accounts`. Scan at class level — one `.py` file can hold multiple classes with different columns (e.g. `ScriptCategory` vs `ScriptTemplate`).
-- **`ai_sessions.status` is VARCHAR(30)** — fits `requesting_escalation` (23 chars). Migration `f0aad74ea51b` widened from 20.
-- **PostgreSQL `func.sum(case(...))` returns `Decimal` via asyncpg** — cast to `int()` before Pydantic `dict[str, Any]`.
-- **Enhancement / branch_addition proposals need `modified_flow_data` via "Edit & Publish"** — backend 400 on direct approve. Only `new_flow` supports direct approve.
-- **Adding email types:** static async method on `EmailService` in `core/email.py`. Fire-and-forget from endpoints (log errors, don't fail the request).
-
-### AI / FlowPilot
-
-- **Anthropic SDK `max_retries=1`** — default of 2 can take 3× the timeout.
-- **Model tier routing:** `settings.get_model_for_action(action_type)`. Always alias form (`claude-sonnet-4-6`).
-- **FlowPilot must ask GUI-vs-script before suggesting either** when both are viable — see `FLOWPILOT_SYSTEM_PROMPT` in `flowpilot_engine.py`.
-- **Telemetry events to grep:** `anthropic.cache` (prompt-cache hit/create), `mcp.turn` (per-turn MCP availability), `mcp.fallback` (MCP silent-retry fired).
-- **Don't put literal payloads in system prompts.** Bit us twice in one day: a worked `[QUESTIONS]` example with literal "Outlook + jsmith" content, and a full DNS troubleshooting tree, both caused Claude to recite that content on unrelated tickets — the symptom looked like task-lane state leaking across chats. The fix is structural: every output example in a system prompt uses `<placeholder>` syntax (`{"text": "<one short, specific question>"}`), never literal field values. Real-looking format examples live in few-shot messages (separate file, separate code path), not system prompts. Guardrail: `tests/test_prompt_anti_parrot.py` scans every `*_PROMPT`/`*_SCHEMA`/`*_PROTOCOL`/`*_FORMAT` constant in `app/services/` and `app/core/`; CI fails when a marker block contains a literal JSON value or when a known leaked token (jsmith, DC01, ADSync, Dnscache, etc.) appears anywhere in a prompt.
-
-### Frontend / UI
-
-- **Flex height chain:** every ancestor from `app-shell` grid to React Flow canvas needs `flex` + `flex-1` + `min-h-0` or `h-full`. Missing `flex` collapses to 0. Same rule for FlowPilot action bar and any tall scroller.
-- **React Flow CSS in Tailwind v4:** import in `index.css`, not component JS. Override dark theme via `--xy-*` CSS vars.
-- **`text-secondary` renders invisible on dark** — Tailwind v4 maps it to `--color-secondary` (a surface color). Use `text-muted-foreground` for readable secondary text. Avoid `text-muted` for body — labels only.
-- **`bg-accent` is electric blue — never for code/kbd.** Use `bg-white/[0.12] border border-white/[0.06]` for inline code, `bg-white/[0.08]` for kbd. Accent reserved for interactive elements.
-- **`landing.css` uses self-contained `--lp-*` vars** — never `var(--color-*)` theme tokens (they resolve incorrectly outside the app shell).
-- **Never `transition: all`** — list properties explicitly, or layout props animate and jank.
-- **Date range filter end dates:** `setHours(23, 59, 59, 999)` before sending, or the day's items are excluded. For string-based date inputs, append `T23:59:59.999Z`.
-- **TopBar search:** full bar `hidden sm:block`, icon button `sm:hidden` — both open CommandPalette.
-- **Hover pop-out cards:** scrim `pointer-events-none`, expanded card has its own click handler at `z-50`, dismiss via `onMouseLeave` on wrapper. Never put handlers on the scrim.
-- **`tsc -b` in Dockerfile is stricter than `tsc --noEmit`** — enforces `noUnusedLocals` / `noUnusedParameters` as hard errors. Check IDE yellow squiggles before pushing.
-- **Dashboard prefill auto-submits** via `useEffect` + `prefillHandledRef` guard — no double-enter.
-- **Global Axios 5xx interceptor fires before component `.catch()`** — fix optional-data endpoints at the source (return `[]` / `{}` on provider failure), not in the component.
-- **Playwright strict mode:** scope selectors to avoid sidebar/main ambiguity. Use `getByRole('heading', { name })` or `.animate-scale-in` locators, not bare `getByText()`.
-
-### Env / infra
-
-- **Node 20.19+ required** (Vite 7). `nvm use 20` or `PATH="$HOME/.nvm/versions/node/v20.19.0/bin:$PATH"`.
-- **Railway backend service is `patherly`, DB name `railway`.** Public Postgres proxy: `interchange.proxy.rlwy.net:45797`.
-- **Railway Object Storage bucket `resolutionflow-uploads`.** Env vars `STORAGE_*`. boto3 in `storage_service.py`. Dockerfile needs Pillow + `libjpeg-dev` / `zlib1g-dev`.
-- **PostHog:** `PostHogProvider` + `posthog.init()` in `main.tsx`. Helpers in `lib/analytics.ts`. Env: `VITE_PUBLIC_POSTHOG_KEY`, `VITE_PUBLIC_POSTHOG_HOST`. `identifyUser()` in `authStore.fetchUser()`, `resetAnalytics()` on logout.
-- **bun PATH on devserver01:** `BUN_INSTALL="$HOME/.bun"`, `PATH="$BUN_INSTALL/bin:$PATH"`. Playwright Chromium needs `libatk1.0-0 libatk-bridge2.0-0 libcups2 libxkbcommon0 libatspi2.0-0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2`.
-- **Full-stack change:** trace schema → endpoint → API client → hook → store → UI. Don't assume one end proves the other.
-- **Dev env** — see DEV-ENV.md for current topology, `REPO_ROOT` requirement when compose runs inside a container, Vite `allowedHosts`, linuxserver.io `group_add` + custom-cont-init.d workaround, `docker compose up` no-op-on-unchanged-hash gotcha.
-
----
-
-## GitNexus code intelligence
+### GitNexus code intelligence
 
 Indexed as `resolutionflow`. Earns its cost on cross-cutting work only.
 
@@ -224,42 +52,23 @@ Indexed as `resolutionflow`. Earns its cost on cross-cutting work only.
 
 Re-indexes automatically on commit (PostToolUse hook). Manual refresh if stale: `npx gitnexus analyze`.
 
----
+### gstack skills
 
-## gstack skills
+Always use `/browse` for web, never `mcp__claude-in-chrome__*`.
 
-Always use `/browse` for web, never `mcp__claude-in-chrome__*`. Most-used:
+Available commands:
 
-- `/review` — pre-land PR review
-- `/ship` — tests + review + PR creation
-- `/browse` + `/qa` / `/qa-only` — headless browser testing (setup: Lesson 82)
-- `/design-review` — visual QA
-- `/investigate` — systematic debug with root cause
-- `/codex` — OpenAI Codex second opinion
-- `/plan-eng-review` / `/plan-design-review` / `/plan-ceo-review` — plan critiques
+- **Planning & review:** `/autoplan`, `/plan-eng-review`, `/plan-design-review`, `/plan-ceo-review`, `/plan-devex-review`, `/devex-review`, `/review`, `/cso`, `/office-hours`
+- **Design:** `/design-consultation`, `/design-shotgun`, `/design-html`, `/design-review`
+- **Browser & QA:** `/browse`, `/connect-chrome`, `/qa`, `/qa-only`, `/setup-browser-cookies`
+- **Ship & deploy:** `/ship`, `/land-and-deploy`, `/canary`, `/benchmark`, `/setup-deploy`, `/document-release`
+- **Debug & investigate:** `/investigate`, `/careful`, `/freeze`, `/guard`, `/unfreeze`
+- **Other:** `/codex` (OpenAI second opinion), `/setup-gbrain`, `/retro`, `/learn`, `/gstack-upgrade`
 
----
+### Git trailer
 
-## Deployment (Railway)
+Every commit: `Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>`
 
-- **Prod:** `resolutionflow.com` (frontend), `api.resolutionflow.com` (backend).
-- Auto-deploy: Gitea push → GitHub mirror → Railway follows GitHub `main`.
-- PR environments auto-created; need manual domain generation + `VITE_API_URL` with `https://` prefix.
-- `ALLOW_RAILWAY_ORIGINS=true` for `*.up.railway.app` CORS.
-- Shared Variables (Railway project-level) auto-propagate to PR envs — use for secrets like `ANTHROPIC_API_KEY`.
-- Super admin utility: `backend/make_superadmin_simple.py list|<email>`.
+### Model aliases
 
----
-
-## Quick reference
-
-| What | Where |
-|---|---|
-| Detailed status | [CURRENT-STATE.md](CURRENT-STATE.md) |
-| Roadmap | [03-DEVELOPMENT-ROADMAP.md](03-DEVELOPMENT-ROADMAP.md) |
-| Design system | [DESIGN-SYSTEM.md](DESIGN-SYSTEM.md) |
-| Dev env | [DEV-ENV.md](DEV-ENV.md) |
-| Archived lessons | [docs/LESSONS-ARCHIVE.md](docs/LESSONS-ARCHIVE.md) |
-| ConnectWise API | `docs/connectwise/` |
-| GitHub issues | `gh issue list --state open` |
-| Local API docs | <http://localhost:8000/api/docs> |
+Always use alias form (`claude-sonnet-4-6`, `claude-opus-4-6`, etc.) via `settings.get_model_for_action()`. Never hardcode a dated model ID.

SESSION-HANDOFF.md

@@ -1,70 +0,0 @@
-# Session Handoff — Design System v4 Migration
-
-> **For the next Claude session:** Read this file completely, internalize the context, then delete it (`rm SESSION-HANDOFF.md`). This is a one-time context transfer.
-
----
-
-## What Was Done This Session
-
-### 1. FlowPilot Message Bar + AI Script Builder (MERGED to main)
-- PR #118 merged. Always-visible message bar in FlowPilot sessions, AI Script Builder at `/script-builder`, library reorg (My/Team Scripts tabs), FlowPilot-to-Script-Builder handoff, session abandon/close, unified session history.
-- Eng review completed: normalized `script_builder_messages` table, typed content helpers, 6 edge case tests.
-
-### 2. Design System v4 Migration (PR #119, open, branch: `refactor/design-system-v4`)
-- Complete frontend redesign from glassmorphism to flat dark theme (Sentry/PostHog-inspired)
-- **CSS Foundation:** New color tokens in `index.css`, all via CSS custom properties. Light mode ready (just needs `.light` class values).
-- **Icon Rail Sidebar:** 72px rail with 5 grouped icons (Home, Work, Knowledge, Insights, Help). Full-height resizable drawer on hover. Pin-to-expand to 260px. Mobile hamburger overlay.
-- **Component Sweep:** ~200 files migrated. All hardcoded hex replaced with semantic Tailwind tokens (bg-card, text-foreground, border-border, etc.).
-- **Landing Page:** Flat surfaces, no glow, solid buttons.
-- **Interactive Shadows:** Dark-mode-aware — elevated surfaces + faint cyan accent glow (black shadows invisible on dark bg).
-- **Stat Cards:** 3px colored left borders.
-- **Tab Toggles:** Active state uses `tab-active-shadow` (elevated bg + faint glow).
-
-### 3. GTM Strategy (from /office-hours)
-- Shadow & Ship approach: Michael uses ResolutionFlow on real tickets for 2 weeks, then hands logins to 5 MSP colleagues. Key metric: unprompted return.
-- Design doc at `~/.gstack/projects/patherly-patherly/`
-
----
-
-## What Needs To Be Done Next
-
-### Immediate (Design System v4 polish)
-1. **Home icon color fix:** The Home icon in the sidebar shouldn't have a cyan background when not active. Instead, the Home icon itself should always be cyan (brand accent), and only show the `bg-accent-dim` background when the route is actually `/`. Michael specifically requested this.
-2. **Visual QA pass:** Michael hasn't done a full page-by-page walkthrough yet. Expect feedback on individual pages once he does.
-3. **`font-label` cleanup:** ~10 files still reference `font-label` (deprecated alias for `font-mono`). Each needs inspection — some should be `font-mono`, others `font-sans text-xs`.
-4. **Inline `style` attributes:** ~29 instances still use hardcoded hex in inline styles (sidebar, drawer, badges). Should be converted to CSS variable references or Tailwind classes where possible.
-
-### Before Merging PR #119
-- Run migrations: `docker exec resolutionflow_backend alembic upgrade head` (new tables from the Script Builder PR are on main now)
-- Full visual QA with backend running
-- Test mobile responsive (hamburger menu)
-- Test FlowPilot session with new message bar + action bar positioning
-
-### Future
-- **Light mode toggle:** CSS variables are ready. Need to add `.light` class values in `index.css` + toggle in user settings/account page.
-- **Script Builder testing:** The AI Script Builder hasn't been tested end-to-end with the backend running yet.
-
----
-
-## Key Files to Know
-
-| File | What it does |
-|------|-------------|
-| `DESIGN-SYSTEM.md` | Single source of truth for all design decisions |
-| `frontend/src/index.css` | CSS tokens, component utilities, shadow patterns |
-| `frontend/src/components/layout/Sidebar.tsx` | Icon rail + drawer + pinned sidebar |
-| `frontend/src/components/layout/AppLayout.tsx` | CSS Grid shell |
-| `frontend/src/components/dashboard/StartSessionInput.tsx` | The Guided/Chat toggle |
-| `frontend/src/components/dashboard/PerformanceCards.tsx` | Stat cards with colored borders |
-
-## Key Lessons From This Session
-
-- The component sweep agents missed `editor-ai/`, `guides/`, `maintenance/`, `scripts/`, `settings/` directories and `text-brand-dark` references. Always do a final grep audit after sweeps.
-- `bg-[#hex]` hardcoding defeats the purpose of CSS variables. We had to do a second pass to replace 3,200+ hardcoded values with semantic tokens.
-- Black shadows (`rgba(0,0,0,...)`) are invisible on dark backgrounds. Use elevated surfaces + faint accent glow instead.
-- The sidebar flyout needed `position: fixed` to escape the CSS Grid cell clipping — `absolute` positioning was hidden behind the main content area.
-- Flyout hover timing: individual item `onMouseLeave` was killing the flyout before the mouse reached the drawer. Only the outer wrapper should handle `onMouseLeave`.
-
----
-
-> **After reading this file:** Save relevant context to your session memory, then run `rm SESSION-HANDOFF.md` and `git add -A && git commit -m "chore: remove session handoff file"`.

VERSION

@@ -0,0 +1 @@
+0.1.0.0

backend/app/api/endpoints/integrations.py

@@ -1,6 +1,7 @@
 """PSA integration endpoints — connection CRUD and test."""
 from __future__ import annotations
 
+import logging
 from datetime import datetime, timezone
 from typing import Annotated
 from uuid import UUID
@@ -11,6 +12,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from sqlalchemy import delete
 
+logger = logging.getLogger(__name__)
+
 from app.api.deps import get_current_active_user, require_account_owner, require_engineer_or_admin
 from app.core.database import get_db
 from app.models.psa_connection import PsaConnection
@@ -30,6 +33,17 @@ from app.schemas.psa_connection import (
     PSABoardResponse,
 )
 from app.core.config import settings
+from app.schemas.psa_tickets import (
+    PSAResourceSchema,
+    PSATicketCreatedSchema,
+    PSATicketStatusUpdateSchema,
+    TicketCreatePayloadSchema,
+    PSAPrioritySchema,
+    TicketListResponseSchema,
+    AiParseRequestSchema,
+    AiParseResponseSchema,
+)
+import app.services.ticket_service as ticket_svc
 from app.services.psa.encryption import (
     decrypt_credentials,
     encrypt_credentials,
@@ -362,33 +376,36 @@ async def list_boards(
         provider = await get_provider_for_account(current_user.account_id, db)
         boards = await provider.list_boards()
         return [PSABoardResponse(id=b.id, name=b.name) for b in boards]
-    except PSAError:
+    except PSAError as e:
         # Boards are optional UI chrome — degrade gracefully rather than surfacing a toast
+        logger.warning("list_boards failed: %s", e)
         return []
 
 
-@router.get("/tickets/search", response_model=list[PSATicketSearchResult])
+@router.get("/tickets/search", response_model=TicketListResponseSchema)
 async def search_tickets(
     current_user: Annotated[User, Depends(require_engineer_or_admin)],
     db: Annotated[AsyncSession, Depends(get_db)],
     query: str = "",
     board_id: int | None = None,
     status_id: int | None = None,
+    status_name: str | None = None,
     include_closed: bool = False,
     assigned_to_me: bool = False,
     unassigned: bool = False,
     board_ids: str = "",
+    priority: str | None = None,
+    company_id: int | None = None,
     page: int = 1,
-    page_size: int = 10,
+    page_size: int = 25,
 ):
-    """Search ConnectWise tickets."""
+    """Search ConnectWise tickets — returns paginated TicketListResponse."""
     if not current_user.account_id:
         raise HTTPException(status_code=400, detail="User has no account")
 
     from app.services.psa.registry import get_provider_for_account
     from app.services.psa.exceptions import PSAError
 
-    # Resolve assigned_to_me → member_identifier (CW login name for resources contains filter)
     member_identifier: str | None = None
     if assigned_to_me:
         conn_result = await db.execute(
@@ -407,23 +424,18 @@ async def search_tickets(
             )
             mapping = mapping_result.scalar_one_or_none()
             if not mapping:
-                # No mapping for this user — return empty list
-                return []
-
-            from app.services.psa.registry import get_provider_for_account as _get_provider
-            from app.services.psa.exceptions import PSAError as _PSAError
+                return {"items": [], "total": 0, "page": page, "page_size": page_size}
             try:
-                _provider = await _get_provider(current_user.account_id, db)
+                _provider = await get_provider_for_account(current_user.account_id, db)
                 cw_members = await _provider.list_members()
                 matched = next((m for m in cw_members if m.id == mapping.external_member_id), None)
                 if matched:
                     member_identifier = matched.identifier
                 else:
-                    return []
-            except _PSAError:
-                return []
+                    return {"items": [], "total": 0, "page": page, "page_size": page_size}
+            except PSAError:
+                return {"items": [], "total": 0, "page": page, "page_size": page_size}
 
-    # Parse comma-separated board_ids
     parsed_board_ids: list[int] = []
     if board_ids:
         try:
@@ -433,33 +445,250 @@ async def search_tickets(
 
     try:
         provider = await get_provider_for_account(current_user.account_id, db)
-        tickets = await provider.search_tickets(
+        result = await provider.search_tickets(
             query,
             board_id=board_id,
             status_id=status_id,
+            status_name=status_name,
             include_closed=include_closed,
             member_identifier=member_identifier,
             unassigned=unassigned,
             board_ids=parsed_board_ids,
+            company_id=company_id,
             page=page,
             page_size=page_size,
         )
-        return [
+        items = [
             PSATicketSearchResult(
                 id=t.id,
                 summary=t.summary,
                 company_name=t.company_name,
+                company_id=t.company_id,
                 board_name=t.board_name,
+                board_id=t.board_id,
                 status_name=t.status_name,
+                status_id=t.status_id,
                 priority_name=t.priority_name,
+                priority_id=t.priority_id,
                 closed=t.closed,
             )
-            for t in tickets
+            for t in result.items
         ]
+        return {"items": items, "total": result.total, "page": result.page, "page_size": result.page_size}
     except PSAError as e:
         raise HTTPException(status_code=502, detail=str(e))
 
 
+@router.post("/tickets", response_model=PSATicketCreatedSchema, status_code=201)
+async def create_ticket(
+    data: TicketCreatePayloadSchema,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Create a new PSA ticket."""
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.exceptions import PSAError
+    from app.services.psa.types import TicketCreatePayload
+    try:
+        return await ticket_svc.create_ticket(
+            current_user.account_id,
+            TicketCreatePayload(**data.model_dump()),
+            db,
+        )
+    except PSAError as e:
+        raise HTTPException(status_code=502, detail=str(e))
+
+
+@router.post("/tickets/ai-parse", response_model=AiParseResponseSchema)
+async def ai_parse_ticket(
+    data: AiParseRequestSchema,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Parse natural language into a ticket pre-fill payload using Claude."""
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+
+    from app.services.psa.registry import get_provider_for_account
+    from app.services.psa.exceptions import PSAError
+    import anthropic
+    import json
+
+    # Fetch boards + members for context (both cached)
+    boards = []
+    members = []
+    try:
+        provider = await get_provider_for_account(current_user.account_id, db)
+        boards = await provider.list_boards()
+        members = await provider.list_members()
+    except PSAError:
+        pass
+
+    boards_list = [{"id": b.id, "name": b.name} for b in boards]
+    members_list = [{"id": m.id, "name": m.name, "identifier": m.identifier} for m in members]
+
+    system_prompt = """You are a ticket triage assistant for an MSP help desk.
+Extract structured ticket information from the engineer's natural language description.
+Return ONLY valid JSON matching this exact schema — no other text:
+{
+  "summary": "short one-line ticket title or null",
+  "board_id": "integer matching one of the provided boards or null",
+  "priority_name": "one of: Critical, High, Medium, Low, or null",
+  "description": "expanded description or null",
+  "assignee_identifier": "member identifier string from the provided members list or null",
+  "warnings": ["list of strings explaining what could not be resolved"]
+}"""
+
+    user_msg = f"""Available boards: {json.dumps(boards_list)}
+Available members: {json.dumps(members_list[:50])}
+
+Engineer's description: {data.prompt}"""
+
+    missing_fields: list[str] = []
+    warnings: list[str] = []
+    response_data = AiParseResponseSchema()
+
+    try:
+        client = anthropic.AsyncAnthropic(
+            api_key=settings.ANTHROPIC_API_KEY,
+            max_retries=1,
+        )
+        msg = await client.messages.create(
+            model=settings.get_model_for_action("default"),
+            max_tokens=512,
+            system=system_prompt,
+            messages=[{"role": "user", "content": user_msg}],
+        )
+        raw = msg.content[0].text.strip()
+        # Strip markdown fences if present
+        if raw.startswith("```"):
+            import re
+            raw = re.sub(r'^```(?:json)?\s*', '', raw)
+            raw = re.sub(r'\s*```$', '', raw.strip())
+        parsed = json.loads(raw)
+
+        response_data.summary = parsed.get("summary")
+        response_data.description = parsed.get("description")
+        warnings = parsed.get("warnings", [])
+
+        # Resolve board_id
+        if parsed.get("board_id"):
+            board_match = next((b for b in boards if b.id == int(parsed["board_id"])), None)
+            if board_match:
+                response_data.board_id = board_match.id
+            else:
+                missing_fields.append("board_id")
+                warnings.append(f"Board ID {parsed['board_id']} not found")
+        else:
+            missing_fields.append("board_id")
+
+        # Resolve assignee
+        if parsed.get("assignee_identifier"):
+            member = next((m for m in members if m.identifier == parsed["assignee_identifier"]), None)
+            if member:
+                response_data.assigned_member_id = int(member.id)
+            else:
+                warnings.append(f"Member '{parsed['assignee_identifier']}' not found")
+
+        # Priority/status/company always need manual selection
+        missing_fields.extend(["status_id", "priority_id", "company_id"])
+
+    except Exception as e:
+        logger.warning("AI parse failed: %s", e)
+        missing_fields = ["summary", "board_id", "status_id", "priority_id", "company_id"]
+        warnings = ["AI parsing failed — please fill in manually"]
+
+    response_data.missing_fields = missing_fields
+    response_data.warnings = warnings
+    return response_data
+
+
+@router.patch("/tickets/{ticket_id}/status", response_model=PSATicketStatusUpdateSchema)
+async def update_ticket_status_endpoint(
+    ticket_id: int,
+    status_id: int,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Update a ticket's status."""
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.exceptions import PSAError
+    try:
+        return await ticket_svc.update_status(current_user.account_id, ticket_id, status_id, db)
+    except PSAError as e:
+        raise HTTPException(status_code=502, detail=str(e))
+
+
+@router.get("/tickets/{ticket_id}/resources", response_model=list[PSAResourceSchema])
+async def list_ticket_resources(
+    ticket_id: int,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.exceptions import PSAError
+    try:
+        return await ticket_svc.list_resources(current_user.account_id, ticket_id, db)
+    except PSAError as e:
+        # Resources are optional display data — degrade gracefully rather than surfacing a toast
+        logger.warning("list_resources(%s) failed: %s", ticket_id, e)
+        return []
+
+
+@router.post("/tickets/{ticket_id}/resources", response_model=PSAResourceSchema, status_code=201)
+async def add_ticket_resource(
+    ticket_id: int,
+    member_id: int,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.exceptions import PSAError
+    try:
+        return await ticket_svc.add_resource(current_user.account_id, ticket_id, member_id, db)
+    except PSAError as e:
+        raise HTTPException(status_code=502, detail=str(e))
+
+
+@router.delete("/tickets/{ticket_id}/resources/{member_id}", status_code=204)
+async def remove_ticket_resource(
+    ticket_id: int,
+    member_id: int,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.exceptions import PSAError
+    try:
+        await ticket_svc.remove_resource(current_user.account_id, ticket_id, member_id, db)
+    except PSAError as e:
+        raise HTTPException(status_code=502, detail=str(e))
+
+
+@router.get("/priorities", response_model=list[PSAPrioritySchema])
+async def list_priorities(
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """List PSA priority levels for ticket creation form."""
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+    from app.services.psa.registry import get_provider_for_account
+    from app.services.psa.exceptions import PSAError
+    try:
+        provider = await get_provider_for_account(current_user.account_id, db)
+        raw = await provider.list_priorities()
+        return [PSAPrioritySchema(id=p["id"], name=p["name"]) for p in raw if p.get("id")]
+    except PSAError as e:
+        logger.warning("list_priorities failed: %s", e)
+        return []
+
+
 @router.get("/tickets/{ticket_id}/context")
 async def get_ticket_context(
     ticket_id: int,
@@ -561,7 +790,30 @@ async def get_ticket_statuses(
     except PSANotFoundError:
         raise HTTPException(status_code=404, detail="Ticket not found")
     except PSAError as e:
-        raise HTTPException(status_code=502, detail=str(e))
+        logger.warning("get_ticket_statuses(%s) failed: %s", ticket_id, e)
+        return []
+
+
+@router.get("/boards/{board_id}/statuses", response_model=list[PSATicketStatusItem])
+async def get_board_statuses(
+    board_id: int,
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Get available statuses for a service board directly (no ticket lookup required)."""
+    if not current_user.account_id:
+        raise HTTPException(status_code=400, detail="User has no account")
+
+    from app.services.psa.registry import get_provider_for_account
+    from app.services.psa.exceptions import PSAError
+
+    try:
+        provider = await get_provider_for_account(current_user.account_id, db)
+        statuses = await provider.get_ticket_statuses(board_id)
+        return [PSATicketStatusItem(id=s.id, name=s.name, is_closed=s.is_closed) for s in statuses]
+    except PSAError as e:
+        logger.warning("get_board_statuses(%s) failed: %s", board_id, e)
+        return []
 
 
 # ── member mapping endpoints ─────────────────────────────────────────
@@ -569,7 +821,7 @@ async def get_ticket_statuses(
 
 @router.get("/members", response_model=list[PsaMemberResponse])
 async def list_members(
-    current_user: Annotated[User, Depends(require_account_owner)],
+    current_user: Annotated[User, Depends(require_engineer_or_admin)],
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
     """List CW members (from CW API)."""
@@ -587,7 +839,9 @@ async def list_members(
             for m in members
         ]
     except PSAError as e:
-        raise HTTPException(status_code=502, detail=str(e))
+        # Members are optional display data — degrade gracefully
+        logger.warning("list_members failed: %s", e)
+        return []
 
 
 @router.get("/member-mappings", response_model=list[PsaMemberMappingResponse])

backend/app/schemas/psa_connection.py

@@ -53,9 +53,13 @@ class PSATicketSearchResult(BaseModel):
     id: str
     summary: str
     company_name: str | None = None
+    company_id: str | None = None
     board_name: str | None = None
+    board_id: int | None = None
     status_name: str | None = None
+    status_id: int | None = None
     priority_name: str | None = None
+    priority_id: int | None = None
     closed: bool = False
 
 

backend/app/schemas/psa_tickets.py

@@ -0,0 +1,65 @@
+"""Normalized DTOs for ticket management endpoints."""
+from __future__ import annotations
+from pydantic import BaseModel
+
+
+class PSAResourceSchema(BaseModel):
+    member_id: int
+    member_name: str
+    member_identifier: str
+    is_rf_user: bool = False
+
+
+class PSATicketCreatedSchema(BaseModel):
+    id: int
+    summary: str
+    board_name: str
+    status_name: str
+    priority_name: str
+    company_name: str
+    resources: list[PSAResourceSchema] = []
+
+
+class PSATicketStatusUpdateSchema(BaseModel):
+    ticket_id: int
+    previous_status: str
+    new_status: str
+    new_status_id: int
+
+
+class TicketCreatePayloadSchema(BaseModel):
+    summary: str
+    company_id: int
+    board_id: int
+    status_id: int
+    priority_id: int
+    description: str | None = None
+    assigned_member_id: int | None = None
+
+
+class TicketListResponseSchema(BaseModel):
+    items: list = []
+    total: int = 0
+    page: int = 1
+    page_size: int = 25
+
+
+class AiParseRequestSchema(BaseModel):
+    prompt: str
+
+
+class AiParseResponseSchema(BaseModel):
+    summary: str | None = None
+    company_id: int | None = None
+    board_id: int | None = None
+    priority_id: int | None = None
+    status_id: int | None = None
+    assigned_member_id: int | None = None
+    description: str | None = None
+    missing_fields: list[str] = []
+    warnings: list[str] = []
+
+
+class PSAPrioritySchema(BaseModel):
+    id: int
+    name: str

backend/app/services/assistant_chat_service.py

@@ -295,6 +295,23 @@ To create a fork, append this marker AFTER your [QUESTIONS]/[ACTIONS] markers:
 - If a question is clearly outside your domain, say so briefly and redirect.
 - Never fabricate error codes, KB article numbers, or CLI flags. If unsure, say so.
 
+## SPIN-OFF TICKET CREATION
+
+When you identify a second distinct issue that is clearly separate from the primary topic \
+of this session, suggest creating a spin-off ticket using the [ACTIONS] marker below. \
+Use this sparingly — only when the issue is genuinely independent, not for every tangential mention.
+
+Format:
+[ACTIONS]
+[
+  {
+    "label": "Create ticket: <brief issue title>",
+    "command": "create_spin_off_ticket",
+    "description": "<one sentence description of the separate issue>"
+  }
+]
+[/ACTIONS]
+
 ## FINAL REMINDER — THIS OVERRIDES EVERYTHING ABOVE
 Every single response MUST contain [QUESTIONS] and/or [ACTIONS] markers with valid JSON. \
 No exceptions. Not even when forking. A response without at least one of these markers \

backend/app/services/psa/autotask/provider.py

@@ -12,6 +12,10 @@ from app.services.psa.types import (
     PSAConfiguration,
     PSATimeEntry,
     PSABoard,
+    PaginatedTicketResult,
+    PSAResource,
+    PSACreatedTicket,
+    TicketCreatePayload,
 )
 
 
@@ -28,7 +32,7 @@ class AutotaskProvider(PSAProvider):
     async def get_ticket(self, ticket_id: str) -> PSATicket:
         raise NotImplementedError("Autotask integration coming soon")
 
-    async def search_tickets(self, query: str, **filters) -> list[PSATicket]:
+    async def search_tickets(self, query: str, **filters) -> PaginatedTicketResult:
         raise NotImplementedError("Autotask integration coming soon")
 
     async def post_note(
@@ -74,3 +78,18 @@ class AutotaskProvider(PSAProvider):
         work_type: str | None = None,
     ) -> PSATimeEntry:
         raise NotImplementedError("Autotask integration coming soon")
+
+    async def list_resources(self, ticket_id: int) -> list[PSAResource]:
+        raise NotImplementedError("Autotask integration coming soon")
+
+    async def add_resource(self, ticket_id: int, member_id: int) -> PSAResource:
+        raise NotImplementedError("Autotask integration coming soon")
+
+    async def remove_resource(self, ticket_id: int, member_id: int) -> None:
+        raise NotImplementedError("Autotask integration coming soon")
+
+    async def create_ticket(self, payload: TicketCreatePayload) -> PSACreatedTicket:
+        raise NotImplementedError("Autotask integration coming soon")
+
+    async def list_priorities(self) -> list[dict]:
+        raise NotImplementedError("Autotask integration coming soon")

backend/app/services/psa/base.py

@@ -13,6 +13,10 @@ from .types import (
     PSAConfiguration,
     PSATimeEntry,
     PSABoard,
+    PaginatedTicketResult,
+    PSAResource,
+    PSACreatedTicket,
+    TicketCreatePayload,
 )
 
 
@@ -28,7 +32,7 @@ class PSAProvider(ABC):
         ...
 
     @abstractmethod
-    async def search_tickets(self, query: str, **filters) -> list[PSATicket]:
+    async def search_tickets(self, query: str, **filters) -> PaginatedTicketResult:
         ...
 
     @abstractmethod
@@ -83,3 +87,23 @@ class PSAProvider(ABC):
         work_type: str | None = None,
     ) -> PSATimeEntry:
         ...
+
+    @abstractmethod
+    async def list_resources(self, ticket_id: int) -> list[PSAResource]:
+        ...
+
+    @abstractmethod
+    async def add_resource(self, ticket_id: int, member_id: int) -> PSAResource:
+        ...
+
+    @abstractmethod
+    async def remove_resource(self, ticket_id: int, member_id: int) -> None:
+        ...
+
+    @abstractmethod
+    async def create_ticket(self, payload: TicketCreatePayload) -> PSACreatedTicket:
+        ...
+
+    @abstractmethod
+    async def list_priorities(self) -> list[dict]:
+        ...

backend/app/services/psa/connectwise/provider.py

@@ -7,6 +7,7 @@ from datetime import datetime, timezone
 
 from app.services.psa.base import PSAProvider
 from app.services.psa.cache import psa_cache
+from app.services.psa.exceptions import PSAError
 from app.services.psa.types import (
     ConnectionTestResult,
     PSATicket,
@@ -17,6 +18,10 @@ from app.services.psa.types import (
     PSAConfiguration,
     PSATimeEntry,
     PSABoard,
+    PaginatedTicketResult,
+    PSAResource,
+    PSACreatedTicket,
+    TicketCreatePayload,
 )
 from .client import ConnectWiseClient
 
@@ -55,27 +60,31 @@ class ConnectWiseProvider(PSAProvider):
         )
         return self._map_ticket(data)
 
-    async def search_tickets(self, query: str, **filters) -> list[PSATicket]:
-        """Search CW tickets by summary. Supports board_id, status_id, member_id,
-        unassigned, board_ids, page, and page_size filters."""
+    async def search_tickets(self, query: str, **filters) -> PaginatedTicketResult:
+        """Search CW tickets by summary. Supports board_id, status_id, member_identifier,
+        unassigned, board_ids, page, and page_size filters. Returns paginated result."""
         page_size = filters.get("page_size", 10)
         page = filters.get("page", 1)
 
         params: dict = {
             "fields": "id,summary,company,board,status,priority,closedFlag",
-            "orderBy": "id desc",
+            "orderBy": "priority/sort asc,dateEntered desc",
             "pageSize": page_size,
             "page": page,
         }
 
-        # Build CW condition query
         conditions: list[str] = []
         if query:
-            conditions.append(f"summary contains '{query}'")
+            # Sanitize: strip single quotes to prevent CW condition injection
+            safe_query = query.replace("'", "")
+            conditions.append(f"summary contains '{safe_query}'")
         if filters.get("board_id"):
             conditions.append(f"board/id = {filters['board_id']}")
         if filters.get("status_id"):
             conditions.append(f"status/id = {filters['status_id']}")
+        elif filters.get("status_name"):
+            safe_status = str(filters["status_name"]).replace("'", "")
+            conditions.append(f"status/name = '{safe_status}'")
         if not filters.get("include_closed", False):
             conditions.append("closedFlag = false")
         if filters.get("member_identifier") is not None:
@@ -86,16 +95,27 @@ class ConnectWiseProvider(PSAProvider):
         if board_ids:
             board_list = ", ".join(str(bid) for bid in board_ids)
             conditions.append(f"board/id in ({board_list})")
+        if filters.get("company_id"):
+            conditions.append(f"company/id = {int(filters['company_id'])}")
 
-        if conditions:
-            params["conditions"] = " and ".join(conditions)
+        condition_str = " and ".join(conditions) if conditions else ""
+        if condition_str:
+            params["conditions"] = condition_str
 
-        data = await self.client.get("/service/tickets", params=params)
+        count_params: dict = {}
+        if condition_str:
+            count_params["conditions"] = condition_str
 
-        return [
-            self._map_ticket(t)
-            for t in (data if isinstance(data, list) else [])
-        ]
+        # Fire page fetch + count in parallel
+        data, count_data = await asyncio.gather(
+            self.client.get("/service/tickets", params=params),
+            self.client.get("/service/tickets/count", params=count_params),
+        )
+
+        items = [self._map_ticket(t) for t in (data if isinstance(data, list) else [])]
+        total = count_data.get("count", len(items)) if isinstance(count_data, dict) else len(items)
+
+        return PaginatedTicketResult(items=items, total=total, page=page, page_size=page_size)
 
     async def get_ticket_configurations(
         self, ticket_id: str
@@ -246,13 +266,30 @@ class ConnectWiseProvider(PSAProvider):
     async def update_ticket_status(
         self, ticket_id: str, status_id: int
     ) -> PSATicket:
-        """Update a CW ticket's status using JSON Patch format."""
+        """Update a CW ticket's status using JSON Patch format.
+
+        Verifies CW actually applied the change — CW silently returns 200 when
+        a status id is invalid for the ticket's board. We check the response
+        body's status.id matches what we sent, and raise PSAError if not.
+        """
         patch_body = [
             {"op": "replace", "path": "status", "value": {"id": status_id}}
         ]
         data = await self.client.patch(
             f"/service/tickets/{ticket_id}", json_body=patch_body
         )
+        applied = (data.get("status") or {}) if isinstance(data, dict) else {}
+        applied_id = applied.get("id")
+        if applied_id != status_id:
+            logger.warning(
+                "CW status PATCH for ticket %s returned status id=%s instead of %s",
+                ticket_id, applied_id, status_id,
+            )
+            raise PSAError(
+                f"ConnectWise did not apply status {status_id} "
+                f"(still {applied.get('name') or applied_id}). "
+                "The status may not be valid for this ticket's board."
+            )
         return self._map_ticket(data)
 
     async def list_members(self) -> list[PSAMember]:
@@ -591,16 +628,247 @@ class ConnectWiseProvider(PSAProvider):
     @staticmethod
     def _map_ticket(data: dict) -> PSATicket:
         """Map a CW ticket JSON dict to a PSATicket."""
+        company = data.get("company") or {}
+        board = data.get("board") or {}
+        status = data.get("status") or {}
+        priority = data.get("priority") or {}
         return PSATicket(
-            id=str(data["id"]),
+            id=str(data.get("id", "")),
             summary=data.get("summary", ""),
-            company_name=data.get("company", {}).get("name"),
-            company_id=str(data["company"]["id"]) if data.get("company") else None,
-            board_name=data.get("board", {}).get("name"),
-            board_id=data.get("board", {}).get("id"),
-            status_name=data.get("status", {}).get("name"),
-            status_id=data.get("status", {}).get("id"),
-            priority_name=data.get("priority", {}).get("name"),
-            priority_id=data.get("priority", {}).get("id"),
+            company_name=company.get("name"),
+            company_id=str(company.get("id")) if company.get("id") else None,
+            board_name=board.get("name"),
+            board_id=board.get("id"),
+            status_name=status.get("name"),
+            status_id=status.get("id"),
+            priority_name=priority.get("name"),
+            priority_id=priority.get("id"),
             closed=data.get("closedFlag", False),
         )
+
+    # ── Resource management ───────────────────────────────────────────
+
+    # Schedule type id for "Service Ticket" resources — CW's canonical type for ticket co-assignees
+    _SCHEDULE_TYPE_SERVICE_TICKET = 4
+
+    async def _get_ticket_owner(self, ticket_id: int) -> dict | None:
+        """Fetch the ticket's current owner (MemberReference) or None if unassigned."""
+        data = await self.client.get(
+            f"/service/tickets/{ticket_id}",
+            params={"fields": "id,owner"},
+        )
+        if not isinstance(data, dict):
+            return None
+        owner_raw = data.get("owner")
+        return owner_raw if isinstance(owner_raw, dict) and owner_raw.get("id") else None
+
+    async def _list_ticket_schedule_entries(self, ticket_id: int) -> list[dict]:
+        """List schedule entries for a ticket's co-assignees.
+
+        Returns raw CW schedule entry dicts with at least id and member info.
+        """
+        data = await self.client.get(
+            "/schedule/entries",
+            params={
+                "conditions": (
+                    f"type/id={self._SCHEDULE_TYPE_SERVICE_TICKET} AND objectId={ticket_id}"
+                ),
+                "fields": "id,member,name",
+                "pageSize": 100,
+            },
+        )
+        return data if isinstance(data, list) else []
+
+    async def list_resources(self, ticket_id: int) -> list[PSAResource]:
+        """List members assigned to a CW ticket.
+
+        Merges the `owner` MemberReference (primary assignee) with schedule entries
+        of type 4 (Service Ticket resources — co-assignees). Deduped by member id.
+        """
+        owner = await self._get_ticket_owner(ticket_id)
+        entries = await self._list_ticket_schedule_entries(ticket_id)
+        members = await self.list_members()
+        by_id = {str(m.id): m for m in members}
+
+        seen_ids: set[str] = set()
+        results: list[PSAResource] = []
+
+        if owner is not None:
+            owner_id = str(owner.get("id"))
+            m = by_id.get(owner_id)
+            if m:
+                results.append(PSAResource(
+                    member_id=int(m.id),
+                    member_name=m.name,
+                    member_identifier=m.identifier,
+                ))
+            else:
+                results.append(PSAResource(
+                    member_id=int(owner.get("id") or 0),
+                    member_name=str(owner.get("name") or ""),
+                    member_identifier=str(owner.get("identifier") or ""),
+                ))
+            seen_ids.add(owner_id)
+
+        for entry in entries:
+            entry_member = entry.get("member") if isinstance(entry, dict) else None
+            if not isinstance(entry_member, dict):
+                continue
+            mid = str(entry_member.get("id") or "")
+            if not mid or mid in seen_ids:
+                continue
+            m = by_id.get(mid)
+            if m:
+                results.append(PSAResource(
+                    member_id=int(m.id),
+                    member_name=m.name,
+                    member_identifier=m.identifier,
+                ))
+            else:
+                results.append(PSAResource(
+                    member_id=int(entry_member.get("id") or 0),
+                    member_name=str(entry_member.get("name") or ""),
+                    member_identifier=str(entry_member.get("identifier") or ""),
+                ))
+            seen_ids.add(mid)
+
+        return results
+
+    async def add_resource(self, ticket_id: int, member_id: int) -> PSAResource:
+        """Assign a member to a CW ticket.
+
+        - If the ticket has no owner, set the target as `owner` (CW's canonical
+          primary assignee field). CW typically mirrors this into the derived
+          `resources` string automatically.
+        - If the ticket is already owned by someone else, add the target as a
+          co-assignee via a schedule entry of type 4 (Service Ticket). The
+          existing owner is not changed.
+        - Idempotent when target is already owner or already has a schedule entry.
+        """
+        members = await self.list_members()
+        target = next((m for m in members if str(m.id) == str(member_id)), None)
+        if target is None:
+            raise PSAError(f"Member {member_id} not found")
+
+        current_owner = await self._get_ticket_owner(ticket_id)
+
+        if current_owner is None:
+            # Primary assign — set owner
+            await self.client.patch(
+                f"/service/tickets/{ticket_id}",
+                json_body=[{"op": "replace", "path": "owner", "value": {"id": int(target.id)}}],
+            )
+        elif str(current_owner.get("id")) != str(target.id):
+            # Ticket owned by someone else — add as co-assignee via schedule entry.
+            # Idempotent: skip if a schedule entry already exists for this member.
+            existing = await self._list_ticket_schedule_entries(ticket_id)
+            already_assigned = any(
+                str((e.get("member") or {}).get("id") or "") == str(target.id)
+                for e in existing
+            )
+            if not already_assigned:
+                await self.client.post(
+                    "/schedule/entries",
+                    json_body={
+                        "member": {"id": int(target.id)},
+                        "objectId": int(ticket_id),
+                        "type": {"id": self._SCHEDULE_TYPE_SERVICE_TICKET},
+                        "name": target.name or target.identifier or f"Member {target.id}",
+                    },
+                )
+        # else: already the owner — idempotent no-op
+
+        return PSAResource(
+            member_id=int(target.id),
+            member_name=target.name,
+            member_identifier=target.identifier,
+        )
+
+    async def remove_resource(self, ticket_id: int, member_id: int) -> None:
+        """Remove a member from a CW ticket (idempotent).
+
+        - If the target is the current owner, clear the owner field.
+        - Otherwise, delete their schedule entry (Service Ticket type).
+        """
+        members = await self.list_members()
+        target = next((m for m in members if str(m.id) == str(member_id)), None)
+        if target is None:
+            return
+
+        current_owner = await self._get_ticket_owner(ticket_id)
+
+        if current_owner is not None and str(current_owner.get("id")) == str(target.id):
+            # Unassign the owner. Try RFC 6902 "remove" first; fall back to
+            # "replace" with null if CW rejects it.
+            try:
+                await self.client.patch(
+                    f"/service/tickets/{ticket_id}",
+                    json_body=[{"op": "remove", "path": "owner"}],
+                )
+            except PSAError:
+                await self.client.patch(
+                    f"/service/tickets/{ticket_id}",
+                    json_body=[{"op": "replace", "path": "owner", "value": None}],
+                )
+            return
+
+        # Not the owner — find and delete the schedule entry for this member.
+        entries = await self._list_ticket_schedule_entries(ticket_id)
+        for entry in entries:
+            entry_member = entry.get("member") if isinstance(entry, dict) else None
+            if isinstance(entry_member, dict) and str(entry_member.get("id") or "") == str(target.id):
+                entry_id = entry.get("id")
+                if entry_id:
+                    await self.client.delete(f"/schedule/entries/{entry_id}")
+                break
+
+    # ── Ticket creation ───────────────────────────────────────────────
+
+    async def create_ticket(self, payload: TicketCreatePayload) -> PSACreatedTicket:
+        """Create a new CW service ticket."""
+        body: dict = {
+            "summary": payload.summary,
+            "board": {"id": payload.board_id},
+            "company": {"id": payload.company_id},
+            "status": {"id": payload.status_id},
+            "priority": {"id": payload.priority_id},
+        }
+        if payload.description:
+            body["initialDescription"] = payload.description
+        if payload.assigned_member_id:
+            body["owner"] = {"id": payload.assigned_member_id}
+
+        data = await self.client.post("/service/tickets", json_body=body)
+
+        ticket_id = data.get("id") if isinstance(data, dict) else None
+        resources: list[PSAResource] = []
+        if ticket_id and payload.assigned_member_id:
+            try:
+                resources = await self.list_resources(ticket_id)
+            except Exception:
+                pass
+
+        company = (data.get("company") or {}) if isinstance(data, dict) else {}
+        board = (data.get("board") or {}) if isinstance(data, dict) else {}
+        status = (data.get("status") or {}) if isinstance(data, dict) else {}
+        priority = (data.get("priority") or {}) if isinstance(data, dict) else {}
+
+        return PSACreatedTicket(
+            id=ticket_id or 0,
+            summary=data.get("summary", payload.summary) if isinstance(data, dict) else payload.summary,
+            board_name=board.get("name", ""),
+            status_name=status.get("name", ""),
+            priority_name=priority.get("name", ""),
+            company_name=company.get("name", ""),
+            resources=resources,
+        )
+
+    # ── Priorities ────────────────────────────────────────────────────
+
+    async def list_priorities(self) -> list[dict]:
+        """List CW service priorities."""
+        data = await self.client.get("/service/priorities", params={"pageSize": 50})
+        return [
+            {"id": p.get("id"), "name": p.get("name")}
+            for p in (data if isinstance(data, list) else [])
+        ]

backend/app/services/psa/halopsa/provider.py

@@ -12,6 +12,10 @@ from app.services.psa.types import (
     PSAConfiguration,
     PSATimeEntry,
     PSABoard,
+    PaginatedTicketResult,
+    PSAResource,
+    PSACreatedTicket,
+    TicketCreatePayload,
 )
 
 
@@ -28,7 +32,7 @@ class HaloPSAProvider(PSAProvider):
     async def get_ticket(self, ticket_id: str) -> PSATicket:
         raise NotImplementedError("Halo PSA integration coming soon")
 
-    async def search_tickets(self, query: str, **filters) -> list[PSATicket]:
+    async def search_tickets(self, query: str, **filters) -> PaginatedTicketResult:
         raise NotImplementedError("Halo PSA integration coming soon")
 
     async def post_note(
@@ -74,3 +78,18 @@ class HaloPSAProvider(PSAProvider):
         work_type: str | None = None,
     ) -> PSATimeEntry:
         raise NotImplementedError("Halo PSA integration coming soon")
+
+    async def list_resources(self, ticket_id: int) -> list[PSAResource]:
+        raise NotImplementedError("Halo PSA integration coming soon")
+
+    async def add_resource(self, ticket_id: int, member_id: int) -> PSAResource:
+        raise NotImplementedError("Halo PSA integration coming soon")
+
+    async def remove_resource(self, ticket_id: int, member_id: int) -> None:
+        raise NotImplementedError("Halo PSA integration coming soon")
+
+    async def create_ticket(self, payload: TicketCreatePayload) -> PSACreatedTicket:
+        raise NotImplementedError("Halo PSA integration coming soon")
+
+    async def list_priorities(self) -> list[dict]:
+        raise NotImplementedError("Halo PSA integration coming soon")

backend/app/services/psa/types.py

@@ -73,6 +73,40 @@ class PSABoard(BaseModel):
     inactive: bool = False
 
 
+class PaginatedTicketResult(BaseModel):
+    items: list[PSATicket]
+    total: int
+    page: int
+    page_size: int
+
+
+class PSAResource(BaseModel):
+    member_id: int
+    member_name: str
+    member_identifier: str
+    is_rf_user: bool = False
+
+
+class PSACreatedTicket(BaseModel):
+    id: int
+    summary: str
+    board_name: str
+    status_name: str
+    priority_name: str
+    company_name: str
+    resources: list[PSAResource] = []
+
+
+class TicketCreatePayload(BaseModel):
+    summary: str
+    company_id: int
+    board_id: int
+    status_id: int
+    priority_id: int
+    description: str | None = None
+    assigned_member_id: int | None = None
+
+
 class NoteType:
     INTERNAL_ANALYSIS = "internal_analysis"
     RESOLUTION = "resolution"

backend/app/services/ticket_service.py

@@ -0,0 +1,116 @@
+"""Ticket mutation service — wraps PSA provider, resolves is_rf_user flag."""
+from __future__ import annotations
+
+import logging
+from uuid import UUID
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.psa_connection import PsaConnection
+from app.models.psa_member_mapping import PsaMemberMapping
+from app.schemas.psa_tickets import (
+    PSAResourceSchema,
+    PSATicketCreatedSchema,
+    PSATicketStatusUpdateSchema,
+)
+from app.services.psa.registry import get_provider_for_account
+from app.services.psa.types import TicketCreatePayload
+
+logger = logging.getLogger(__name__)
+
+
+async def _get_mapped_member_ids(account_id: UUID, db: AsyncSession) -> set[int]:
+    """Return set of external_member_id ints that are mapped to RF users."""
+    conn_result = await db.execute(
+        select(PsaConnection).where(PsaConnection.account_id == account_id)
+    )
+    conn = conn_result.scalar_one_or_none()
+    if not conn:
+        return set()
+    mappings = await db.execute(
+        select(PsaMemberMapping).where(PsaMemberMapping.psa_connection_id == conn.id)
+    )
+    return {int(m.external_member_id) for m in mappings.scalars().all() if m.external_member_id}
+
+
+async def list_resources(
+    account_id: UUID, ticket_id: int, db: AsyncSession
+) -> list[PSAResourceSchema]:
+    provider = await get_provider_for_account(account_id, db)
+    mapped_ids = await _get_mapped_member_ids(account_id, db)
+    resources = await provider.list_resources(ticket_id)
+    return [
+        PSAResourceSchema(
+            member_id=r.member_id,
+            member_name=r.member_name,
+            member_identifier=r.member_identifier,
+            is_rf_user=r.member_id in mapped_ids,
+        )
+        for r in resources
+    ]
+
+
+async def add_resource(
+    account_id: UUID, ticket_id: int, member_id: int, db: AsyncSession
+) -> PSAResourceSchema:
+    provider = await get_provider_for_account(account_id, db)
+    mapped_ids = await _get_mapped_member_ids(account_id, db)
+    resource = await provider.add_resource(ticket_id, member_id)
+    return PSAResourceSchema(
+        member_id=resource.member_id,
+        member_name=resource.member_name,
+        member_identifier=resource.member_identifier,
+        is_rf_user=resource.member_id in mapped_ids,
+    )
+
+
+async def remove_resource(
+    account_id: UUID, ticket_id: int, member_id: int, db: AsyncSession
+) -> None:
+    provider = await get_provider_for_account(account_id, db)
+    await provider.remove_resource(ticket_id, member_id)
+
+
+async def update_status(
+    account_id: UUID, ticket_id: int, status_id: int, db: AsyncSession
+) -> PSATicketStatusUpdateSchema:
+    provider = await get_provider_for_account(account_id, db)
+    # get current status before updating
+    ticket = await provider.get_ticket(str(ticket_id))
+    previous_status = ticket.status_name or ""
+    await provider.update_ticket_status(str(ticket_id), status_id)
+    # get new status name from statuses list
+    statuses = await provider.get_ticket_statuses(ticket.board_id or 0)
+    new_status = next((s.name for s in statuses if s.id == status_id), str(status_id))
+    return PSATicketStatusUpdateSchema(
+        ticket_id=ticket_id,
+        previous_status=previous_status,
+        new_status=new_status,
+        new_status_id=status_id,
+    )
+
+
+async def create_ticket(
+    account_id: UUID, payload: TicketCreatePayload, db: AsyncSession
+) -> PSATicketCreatedSchema:
+    provider = await get_provider_for_account(account_id, db)
+    mapped_ids = await _get_mapped_member_ids(account_id, db)
+    result = await provider.create_ticket(payload)
+    return PSATicketCreatedSchema(
+        id=result.id,
+        summary=result.summary,
+        board_name=result.board_name,
+        status_name=result.status_name,
+        priority_name=result.priority_name,
+        company_name=result.company_name,
+        resources=[
+            PSAResourceSchema(
+                member_id=r.member_id,
+                member_name=r.member_name,
+                member_identifier=r.member_identifier,
+                is_rf_user=r.member_id in mapped_ids,
+            )
+            for r in result.resources
+        ],
+    )

backend/pytest.ini

@@ -27,6 +27,7 @@ markers =
     slow: marks tests as slow (deselect with '-m "not slow"')
     integration: marks tests as integration tests
     unit: marks tests as unit tests
+    rls: opt-in RLS migration and policy tests (run with RUN_RLS_TESTS=1)
 
 # Ignore paths
 testpaths = tests

backend/requirements-dev.txt

@@ -1,11 +1,11 @@
 # Include production dependencies
 -r requirements.txt
 
-# Testing
-pytest==7.4.3
-pytest-asyncio==0.23.0
+# Testing — pytest-asyncio 0.24+ requires pytest>=8.2
+pytest==8.4.2
+pytest-asyncio==0.24.0
 httpx>=0.27.0
-pytest-cov==4.1.0
+pytest-cov==5.0.0
 
 # Code quality
 black==24.1.1

backend/scripts/seed_phase9_qa_fixtures.py

@@ -0,0 +1,375 @@
+#!/usr/bin/env python3
+"""
+Seed Phase 9 QA fixtures: 4 ai_sessions + matching suggested_fixes that
+exercise the five Phase 9 components which gate on a backend-emitted
+`SUGGEST_FIX` action and don't fire reliably in normal local sessions.
+
+Usage:
+  cd backend
+  python -m scripts.seed_phase9_qa_fixtures
+  python -m scripts.seed_phase9_qa_fixtures --reset   # delete & recreate
+
+Targets the super-admin from `seed_test_users.py`
+(admin@resolutionflow.example.com) and their account. UUIDs are
+deterministic (UUID5 over a fixed namespace) so re-runs are idempotent
+without --reset.
+
+Sessions created:
+
+| # | Title                           | Phase 9 component reached when…                       |
+|---|---------------------------------|-------------------------------------------------------|
+| A | Phase 9 QA — no-template path   | ChatTabStrip + ScriptBuilderTab + ProposalBanner      |
+| B | Phase 9 QA — drafted-script     | InlineNoTemplateDialog + ProposalBanner               |
+| C | Phase 9 QA — template match     | TemplateMatchPanel + ProposalBanner                   |
+| D | Phase 9 QA — verify state       | EscalateInterceptDialog (with new "partial" choice)   |
+
+Run /qa, then in the browser go to /pilot, click each session in the
+sidebar, and exercise its Phase 9 surface. The session URLs are printed
+at the end.
+"""
+import argparse
+import asyncio
+import sys
+import uuid
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import create_async_engine
+
+from app.core.config import settings
+
+
+ADMIN_EMAIL = "admin@resolutionflow.example.com"
+
+# Deterministic UUIDs so re-running the seeder updates rather than duplicates.
+NS = uuid.UUID("00000000-0000-0000-0000-000000000901")
+SESSION_A = uuid.uuid5(NS, "session-A-no-template")
+SESSION_B = uuid.uuid5(NS, "session-B-drafted-script")
+SESSION_C = uuid.uuid5(NS, "session-C-template-match")
+SESSION_D = uuid.uuid5(NS, "session-D-verify-state")
+FIX_A = uuid.uuid5(NS, "fix-A")
+FIX_B = uuid.uuid5(NS, "fix-B")
+FIX_C = uuid.uuid5(NS, "fix-C")
+FIX_D = uuid.uuid5(NS, "fix-D")
+CATEGORY_QA = uuid.uuid5(NS, "category-qa-fixtures")
+TEMPLATE_QA = uuid.uuid5(NS, "template-qa-fixtures")
+
+DRAFTED_SCRIPT = """\
+# Phase 9 QA fixture — AI-drafted PowerShell to flush DNS and
+# restart the FortiClient service. Not for production use.
+ipconfig /flushdns
+Restart-Service -Name "FortiSslvpnDaemon" -Force
+Get-Service -Name "FortiSslvpnDaemon" | Format-Table -AutoSize
+"""
+
+TEMPLATE_BODY = """\
+# Phase 9 QA fixture — canned template that the AI matches against.
+param([string]$ServiceName = "FortiSslvpnDaemon")
+Restart-Service -Name $ServiceName -Force
+Get-Service -Name $ServiceName | Select-Object Status, Name
+"""
+
+
+async def main(reset: bool = False) -> None:
+    db_url = (
+        settings.ADMIN_DATABASE_URL
+        if hasattr(settings, "ADMIN_DATABASE_URL") and settings.ADMIN_DATABASE_URL
+        else settings.DATABASE_URL
+    )
+    engine = create_async_engine(db_url, echo=False)
+    now = datetime.now(timezone.utc)
+
+    async with engine.begin() as conn:
+        # ─── Locate the admin user + account ───────────────────────────
+        row = (
+            await conn.execute(
+                text(
+                    "SELECT id, account_id FROM users WHERE email = :email LIMIT 1"
+                ),
+                {"email": ADMIN_EMAIL},
+            )
+        ).first()
+        if row is None:
+            print(
+                f"ERROR: user {ADMIN_EMAIL!r} not found. Run "
+                "`python -m scripts.seed_test_users` first.",
+                file=sys.stderr,
+            )
+            sys.exit(2)
+        user_id, account_id = row
+
+        if reset:
+            await conn.execute(
+                text(
+                    "DELETE FROM session_suggested_fixes WHERE id = ANY(:ids)"
+                ),
+                {"ids": [FIX_A, FIX_B, FIX_C, FIX_D]},
+            )
+            await conn.execute(
+                text("DELETE FROM ai_sessions WHERE id = ANY(:ids)"),
+                {"ids": [SESSION_A, SESSION_B, SESSION_C, SESSION_D]},
+            )
+            await conn.execute(
+                text("DELETE FROM script_templates WHERE id = :id"),
+                {"id": TEMPLATE_QA},
+            )
+            await conn.execute(
+                text("DELETE FROM script_categories WHERE id = :id"),
+                {"id": CATEGORY_QA},
+            )
+
+        # ─── Script category + template (for Session C) ────────────────
+        await conn.execute(
+            text(
+                """
+                INSERT INTO script_categories (id, name, slug, sort_order, is_active, created_at, updated_at)
+                VALUES (:id, 'QA Fixtures', 'qa-fixtures', 999, true, :now, :now)
+                ON CONFLICT (id) DO NOTHING
+                """
+            ),
+            {"id": CATEGORY_QA, "now": now},
+        )
+        await conn.execute(
+            text(
+                """
+                INSERT INTO script_templates (
+                    id, category_id, account_id, created_by, name, slug,
+                    description, script_body, language, parameters_schema,
+                    default_values, validation_rules, tags, complexity,
+                    requires_elevation, requires_modules, created_at, updated_at
+                )
+                VALUES (
+                    :id, :cat_id, :acct_id, :user_id,
+                    'QA Fixture: Restart Forti Service',
+                    'qa-fixture-restart-forti-service',
+                    'Phase 9 QA fixture template for TemplateMatchPanel testing.',
+                    :body, 'powershell',
+                    '{}'::jsonb, '{}'::jsonb, '{}'::jsonb, '[]'::jsonb,
+                    'beginner', false, '[]'::jsonb,
+                    :now, :now
+                )
+                ON CONFLICT (id) DO NOTHING
+                """
+            ),
+            {
+                "id": TEMPLATE_QA,
+                "cat_id": CATEGORY_QA,
+                "acct_id": account_id,
+                "user_id": user_id,
+                "body": TEMPLATE_BODY,
+                "now": now,
+            },
+        )
+
+        # ─── 4 sessions ────────────────────────────────────────────────
+        # `canAct` in the chat header gates Resolve/Escalate on
+        # `messages.length >= 2`, so each fixture seeds two synthetic
+        # conversation messages — enough to enable the buttons that drive
+        # the Phase 9 surfaces.
+        seed_messages = (
+            '['
+            '{"role":"user","content":"QA fixture: see seed_phase9_qa_fixtures.py"},'
+            '{"role":"assistant","content":"This session is a Phase 9 QA fixture. The suggested fix below is pre-seeded — drive it from the UI."}'
+            ']'
+        )
+        sessions = [
+            (SESSION_A, "Phase 9 QA — no-template path"),
+            (SESSION_B, "Phase 9 QA — drafted-script path"),
+            (SESSION_C, "Phase 9 QA — template-match path"),
+            (SESSION_D, "Phase 9 QA — verify state (Escalate intercept)"),
+        ]
+        for sid, title in sessions:
+            await conn.execute(
+                text(
+                    """
+                    INSERT INTO ai_sessions (
+                        id, user_id, account_id, session_type, title,
+                        intake_type, intake_content, status, confidence_tier,
+                        confidence_score, conversation_messages,
+                        total_input_tokens, total_output_tokens, step_count,
+                        is_branching, state_version,
+                        handoff_count, total_active_seconds, total_parked_seconds,
+                        created_at, updated_at
+                    )
+                    VALUES (
+                        :id, :user_id, :acct_id, 'chat', :title,
+                        'free_text', '{"text": "QA fixture session"}'::jsonb,
+                        'active', 'discovery',
+                        0.0, (:msgs)::jsonb,
+                        0, 0, 0,
+                        false, 0,
+                        0, 0, 0,
+                        :now, :now
+                    )
+                    ON CONFLICT (id) DO UPDATE SET
+                        title = EXCLUDED.title,
+                        status = EXCLUDED.status,
+                        conversation_messages = EXCLUDED.conversation_messages,
+                        updated_at = EXCLUDED.updated_at
+                    """
+                ),
+                {
+                    "id": sid,
+                    "user_id": user_id,
+                    "acct_id": account_id,
+                    "title": title,
+                    "msgs": seed_messages,
+                    "now": now,
+                },
+            )
+
+        # ─── 4 suggested fixes ─────────────────────────────────────────
+        # Fix A — no template, no draft → ChatTabStrip + ScriptBuilderTab
+        await _upsert_fix(
+            conn, fix_id=FIX_A, session_id=SESSION_A, account_id=account_id,
+            title="Restart the FortiClient daemon and flush DNS",
+            description=(
+                "Error -8 on FortiClient SSL VPN typically clears after a "
+                "service restart on the endpoint. No matching template; "
+                "no AI draft yet — engineer should choose Build Template "
+                "or One-Off in the Script Builder tab."
+            ),
+            confidence_pct=72,
+            script_template_id=None,
+            ai_drafted_script=None,
+            status="proposed",
+            applied_at=None,
+            now=now,
+        )
+
+        # Fix B — drafted script, no template → InlineNoTemplateDialog
+        await _upsert_fix(
+            conn, fix_id=FIX_B, session_id=SESSION_B, account_id=account_id,
+            title="Run AI-drafted PowerShell to recover SSL VPN",
+            description=(
+                "AI drafted a session-specific script because no library "
+                "template matched. Inline dialog should offer Save-as-template, "
+                "Run-once, or Discard."
+            ),
+            confidence_pct=68,
+            script_template_id=None,
+            ai_drafted_script=DRAFTED_SCRIPT,
+            status="proposed",
+            applied_at=None,
+            now=now,
+        )
+
+        # Fix C — template match → TemplateMatchPanel
+        await _upsert_fix(
+            conn, fix_id=FIX_C, session_id=SESSION_C, account_id=account_id,
+            title="Match: QA Fixture Restart Forti Service",
+            description=(
+                "AI matched an existing library template. The match panel "
+                "should render with the parameterization preview and an "
+                "explicit 'I ran this' action."
+            ),
+            confidence_pct=88,
+            script_template_id=TEMPLATE_QA,
+            ai_drafted_script=None,
+            status="proposed",
+            applied_at=None,
+            now=now,
+        )
+
+        # Fix D — applied_at set, status='proposed' → verify state.
+        # Hitting Escalate from this state opens EscalateInterceptDialog.
+        await _upsert_fix(
+            conn, fix_id=FIX_D, session_id=SESSION_D, account_id=account_id,
+            title="Verifying: post-apply tunnel reconnect",
+            description=(
+                "Engineer marked the fix as Applied; we're now in the "
+                "verify window. Clicking Escalate from here should open "
+                "the EscalateInterceptDialog with the four outcome choices "
+                "(worked / didn't / partial / never-applied)."
+            ),
+            confidence_pct=80,
+            script_template_id=None,
+            ai_drafted_script=DRAFTED_SCRIPT,
+            status="proposed",
+            applied_at=now - timedelta(minutes=2),
+            now=now,
+        )
+
+    await engine.dispose()
+
+    print()
+    print("=" * 64)
+    print("  Phase 9 QA fixtures ready.")
+    print("=" * 64)
+    print()
+    print(f"  Sign in as : {ADMIN_EMAIL}")
+    print(f"  Then visit : http://docker-01:5173/pilot")
+    print(f"  Pick from the History sidebar:")
+    print(f"    A. Phase 9 QA — no-template path        (ChatTabStrip + ScriptBuilderTab)")
+    print(f"    B. Phase 9 QA — drafted-script path     (InlineNoTemplateDialog)")
+    print(f"    C. Phase 9 QA — template-match path     (TemplateMatchPanel)")
+    print(f"    D. Phase 9 QA — verify state            (EscalateInterceptDialog)")
+    print()
+    print(f"  Re-run with --reset to wipe and recreate.")
+    print()
+
+
+async def _upsert_fix(
+    conn,
+    *,
+    fix_id: uuid.UUID,
+    session_id: uuid.UUID,
+    account_id: uuid.UUID,
+    title: str,
+    description: str,
+    confidence_pct: int,
+    script_template_id: uuid.UUID | None,
+    ai_drafted_script: str | None,
+    status: str,
+    applied_at: datetime | None,
+    now: datetime,
+) -> None:
+    await conn.execute(
+        text(
+            """
+            INSERT INTO session_suggested_fixes (
+                id, session_id, account_id, title, description,
+                confidence_pct, script_template_id, ai_drafted_script,
+                status, applied_at, created_at
+            )
+            VALUES (
+                :id, :sid, :acct, :title, :desc,
+                :conf, :tmpl, :draft,
+                :status, :applied, :now
+            )
+            ON CONFLICT (id) DO UPDATE SET
+                title = EXCLUDED.title,
+                description = EXCLUDED.description,
+                confidence_pct = EXCLUDED.confidence_pct,
+                script_template_id = EXCLUDED.script_template_id,
+                ai_drafted_script = EXCLUDED.ai_drafted_script,
+                status = EXCLUDED.status,
+                applied_at = EXCLUDED.applied_at,
+                superseded_at = NULL
+            """
+        ),
+        {
+            "id": fix_id,
+            "sid": session_id,
+            "acct": account_id,
+            "title": title,
+            "desc": description,
+            "conf": confidence_pct,
+            "tmpl": script_template_id,
+            "draft": ai_drafted_script,
+            "status": status,
+            "applied": applied_at,
+            "now": now,
+        },
+    )
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Seed Phase 9 QA fixtures.")
+    parser.add_argument(
+        "--reset",
+        action="store_true",
+        help="Delete and recreate the fixtures.",
+    )
+    args = parser.parse_args()
+    asyncio.run(main(reset=args.reset))

backend/scripts/seed_test_users.py

@@ -161,8 +161,8 @@ async def main() -> None:
             if cfg["plan"] is not None:
                 await conn.execute(
                     text("""
-                        INSERT INTO subscriptions (id, account_id, plan, status, created_at, updated_at)
-                        VALUES (:id, :aid, :plan, 'active', :now, :now)
+                        INSERT INTO subscriptions (id, account_id, plan, status, cancel_at_period_end, created_at, updated_at)
+                        VALUES (:id, :aid, :plan, 'active', false, :now, :now)
                     """),
                     {"id": uuid.uuid4(), "aid": account_id, "plan": cfg["plan"], "now": now},
                 )

backend/tests/conftest.py

@@ -4,8 +4,8 @@ Pytest configuration and fixtures for integration tests.
 Provides test database setup, client fixtures, and authentication helpers.
 """
 
-import asyncio
-from typing import AsyncGenerator, Generator
+import os
+from typing import AsyncGenerator
 import pytest
 import sqlalchemy as sa
 from httpx import AsyncClient, ASGITransport
@@ -16,6 +16,14 @@ from app.main import app
 from app.core.database import Base, get_db
 from app.core.admin_database import get_admin_db
 from app.core.config import settings
+# Import every model module so all tables are registered with Base.metadata
+# before the test_db fixture calls create_all. app.main imports models lazily
+# (inside scheduler functions and route modules), which is fine at runtime
+# but leaves the metadata incomplete at fixture-setup time — surfacing as
+# "relation X does not exist" errors for any model whose route/scheduler
+# hasn't been loaded yet. The `from app import models` form avoids
+# shadowing the `app` FastAPI instance imported just above.
+from app import models as _models  # noqa: F401
 
 # Disable invite code requirement for tests
 settings.REQUIRE_INVITE_CODE = False
@@ -26,7 +34,6 @@ settings.REQUIRE_INVITE_CODE = False
 # would silently nuke the dev database. Only DATABASE_TEST_URL is honored,
 # and the safety assertion below refuses to run against a DB whose name
 # doesn't contain "test".
-import os
 TEST_DATABASE_URL = os.environ.get(
     "DATABASE_TEST_URL",
     "postgresql+asyncpg://postgres:postgres@localhost:5432/resolutionflow_test",
@@ -43,13 +50,27 @@ assert "test" in _test_db_name, (
     f"test database (e.g. resolutionflow_test)."
 )
 
+_RUN_RLS_TESTS = os.environ.get("RUN_RLS_TESTS") == "1"
+_RLS_ISOLATION_FILE = "test_rls_isolation.py"
 
-@pytest.fixture(scope="session")
-def event_loop() -> Generator:
-    """Create an instance of the default event loop for each test case."""
-    loop = asyncio.get_event_loop_policy().new_event_loop()
-    yield loop
-    loop.close()
+
+def pytest_collection_modifyitems(config, items):
+    """Keep migration-managed RLS checks out of the default create_all suite."""
+    if _RUN_RLS_TESTS:
+        return
+
+    selected = []
+    deselected = []
+    for item in items:
+        item_path = getattr(item, "path", None) or getattr(item, "fspath", None)
+        if item_path and str(item_path).endswith(_RLS_ISOLATION_FILE):
+            deselected.append(item)
+        else:
+            selected.append(item)
+
+    if deselected:
+        config.hook.pytest_deselected(items=deselected)
+        items[:] = selected
 
 
 @pytest.fixture

backend/tests/test_psa_tickets.py

@@ -0,0 +1,55 @@
+# backend/tests/test_psa_tickets.py
+"""Routing and auth tests for new ticket management endpoints."""
+import pytest
+
+
+@pytest.mark.asyncio
+async def test_create_ticket_requires_auth(client):
+    """POST /tickets returns 401 without auth."""
+    response = await client.post(
+        "/api/v1/integrations/psa/tickets",
+        json={
+            "summary": "Test", "company_id": 1, "board_id": 1,
+            "status_id": 1, "priority_id": 1
+        },
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_list_resources_requires_auth(client):
+    response = await client.get("/api/v1/integrations/psa/tickets/1/resources")
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_search_tickets_returns_paginated_shape(client, auth_headers):
+    """search endpoint returns TicketListResponse shape when no PSA connected."""
+    response = await client.get(
+        "/api/v1/integrations/psa/tickets/search",
+        headers=auth_headers,
+    )
+    # No PSA connection → 400 or 502; with PSA → 200
+    assert response.status_code in (200, 400, 502)
+    if response.status_code == 200:
+        data = response.json()
+        assert "items" in data
+        assert "total" in data
+        assert "page" in data
+
+
+@pytest.mark.asyncio
+async def test_update_status_requires_auth(client):
+    response = await client.patch(
+        "/api/v1/integrations/psa/tickets/1/status?status_id=5"
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_ai_parse_requires_auth(client):
+    response = await client.post(
+        "/api/v1/integrations/psa/tickets/ai-parse",
+        json={"prompt": "New ticket for Acme"},
+    )
+    assert response.status_code == 401

backend/tests/test_rls_isolation.py

@@ -11,30 +11,57 @@ Tests bypass FastAPI entirely — raw asyncpg connections only.
 MUST FAIL before Task 10 (RLS migration) and PASS after it.
 
 Run with:
-    DB_APP_ROLE_PASSWORD=app_secret_change_me pytest tests/test_rls_isolation.py -v
+    RUN_RLS_TESTS=1 DB_APP_ROLE_PASSWORD=app_secret_change_me pytest tests/test_rls_isolation.py -v
 
-The test DB is patherly_test (matches conftest.py default).
+The test DB comes from DATABASE_TEST_URL, matching conftest.py.
 """
 import os
 import subprocess
 import sys
 import uuid
 from pathlib import Path
+from urllib.parse import unquote, urlsplit
 
 import asyncpg
 import pytest
+import pytest_asyncio
 
 # All tests in this module use module-scoped async fixtures (admin_conn,
 # seed_rls_test_data) which run on the module event loop. Without this marker,
 # pytest-asyncio 0.23+ defaults tests to function-scoped loops, causing
 # "Future attached to a different loop" errors on the asyncpg connections.
-pytestmark = pytest.mark.asyncio(loop_scope="module")
+pytestmark = [
+    pytest.mark.asyncio(loop_scope="module"),
+    pytest.mark.rls,
+]
 
-_DB_HOST = os.getenv("TEST_DB_HOST", "localhost")
-_DB_PORT = int(os.getenv("TEST_DB_PORT", "5432"))
-_DB_NAME = os.getenv("TEST_DB_NAME", "patherly_test")      # matches conftest.py
+_DATABASE_TEST_URL = os.getenv(
+    "DATABASE_TEST_URL",
+    "postgresql+asyncpg://postgres:postgres@localhost:5432/resolutionflow_test",
+)
+_DATABASE_TEST_URL_ASYNCPG = _DATABASE_TEST_URL.replace(
+    "postgresql+asyncpg://",
+    "postgresql://",
+    1,
+)
+_DATABASE_TEST_URL_SYNC = _DATABASE_TEST_URL_ASYNCPG
+_TEST_DB_PARTS = urlsplit(_DATABASE_TEST_URL_ASYNCPG)
+
+_DB_HOST = os.getenv("TEST_DB_HOST", _TEST_DB_PARTS.hostname or "localhost")
+_DB_PORT = int(os.getenv("TEST_DB_PORT", str(_TEST_DB_PARTS.port or 5432)))
+_DB_NAME = os.getenv(
+    "TEST_DB_NAME",
+    unquote(_TEST_DB_PARTS.path.lstrip("/") or "resolutionflow_test"),
+)
+_ADMIN_USER = os.getenv(
+    "TEST_DB_ADMIN_USER",
+    unquote(_TEST_DB_PARTS.username or "postgres"),
+)
+_ADMIN_PASSWORD = os.getenv(
+    "TEST_DB_ADMIN_PASSWORD",
+    unquote(_TEST_DB_PARTS.password or "postgres"),
+)
 _APP_PASSWORD = os.getenv("DB_APP_ROLE_PASSWORD", "app_secret_change_me")
-_ADMIN_DSN = f"postgresql://postgres:postgres@{_DB_HOST}:{_DB_PORT}/{_DB_NAME}"
 
 PLATFORM_ACCOUNT_ID = "00000000-0000-0000-0000-000000000001"
 ACCOUNT_A_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
@@ -55,23 +82,33 @@ def _ensure_rls_schema():
     the full migration-managed schema (including RLS policies) is in place.
     """
     backend_dir = Path(__file__).parent.parent
+    env = os.environ.copy()
+    env["DATABASE_URL"] = _DATABASE_TEST_URL
+    env["DATABASE_URL_SYNC"] = _DATABASE_TEST_URL_SYNC
     subprocess.run(
         [sys.executable, "-m", "alembic", "upgrade", "head"],
         cwd=backend_dir,
+        env=env,
         check=True,
         capture_output=True,
     )
 
 
-@pytest.fixture(scope="module")
+@pytest_asyncio.fixture(scope="module", loop_scope="module")
 async def admin_conn(_ensure_rls_schema):
     """Superuser asyncpg connection for fixture setup and teardown."""
-    conn = await asyncpg.connect(_ADMIN_DSN)
+    conn = await asyncpg.connect(
+        host=_DB_HOST,
+        port=_DB_PORT,
+        database=_DB_NAME,
+        user=_ADMIN_USER,
+        password=_ADMIN_PASSWORD,
+    )
     yield conn
     await conn.close()
 
 
-@pytest.fixture(scope="module", autouse=True)
+@pytest_asyncio.fixture(scope="module", loop_scope="module", autouse=True)
 async def seed_rls_test_data(admin_conn):
     """
     Create two isolated test accounts, one user per account, and one private
@@ -154,7 +191,7 @@ async def seed_rls_test_data(admin_conn):
     await admin_conn.execute("DELETE FROM tree_tags WHERE slug = 'rls-global-tag'")
 
 
-@pytest.fixture
+@pytest_asyncio.fixture(loop_scope="module")
 async def conn_a():
     """App-role connection, tenant context = Account A."""
     conn = await asyncpg.connect(
@@ -168,7 +205,7 @@ async def conn_a():
     await conn.close()
 
 
-@pytest.fixture
+@pytest_asyncio.fixture(loop_scope="module")
 async def conn_b():
     """App-role connection, tenant context = Account B."""
     conn = await asyncpg.connect(
@@ -182,7 +219,7 @@ async def conn_b():
     await conn.close()
 
 
-@pytest.fixture
+@pytest_asyncio.fixture(loop_scope="module")
 async def conn_no_context():
     """App-role connection with NO tenant context set."""
     conn = await asyncpg.connect(
@@ -288,7 +325,7 @@ async def test_flow_proposals_account_a_cannot_see_account_b(conn_a):
 # Phase 2 fixtures
 # ---------------------------------------------------------------------------
 
-@pytest.fixture(scope="module")
+@pytest_asyncio.fixture(scope="module", loop_scope="module")
 async def session_row_ids(admin_conn):
     """
     Insert one `sessions` row and one `ai_sessions` row for each of
@@ -644,13 +681,15 @@ async def test_psa_post_log_account_a_cannot_see_account_b(conn_a, session_row_i
 
 async def test_step_library_account_a_cannot_see_account_b_private_steps(admin_conn, conn_a):
     """Private/non-public steps owned by Account B must not be visible to Account A."""
+    user_b_id = await _get_user_b_id(admin_conn)
     private_step_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO step_library (
-            id, account_id, title, step_type, content,
+            id, account_id, created_by, title, step_type, content,
             visibility, is_active, created_at, updated_at
         ) VALUES (
-            '{private_step_id}', '{ACCOUNT_B_ID}', 'RLS Private Step', 'action',
+            '{private_step_id}', '{ACCOUNT_B_ID}', '{user_b_id}',
+            'RLS Private Step', 'action',
             '{{}}'::jsonb, 'private', TRUE, NOW(), NOW()
         )
     """)
@@ -668,13 +707,15 @@ async def test_step_library_account_a_cannot_see_account_b_private_steps(admin_c
 
 async def test_step_library_account_a_can_see_account_b_public_steps(admin_conn, conn_a):
     """Public steps owned by Account B MUST be visible to Account A (cross-tenant visibility)."""
+    user_b_id = await _get_user_b_id(admin_conn)
     public_step_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO step_library (
-            id, account_id, title, step_type, content,
+            id, account_id, created_by, title, step_type, content,
             visibility, is_active, created_at, updated_at
         ) VALUES (
-            '{public_step_id}', '{ACCOUNT_B_ID}', 'RLS Public Step', 'action',
+            '{public_step_id}', '{ACCOUNT_B_ID}', '{user_b_id}',
+            'RLS Public Step', 'action',
             '{{}}'::jsonb, 'public', TRUE, NOW(), NOW()
         )
     """)
@@ -728,10 +769,11 @@ async def test_step_ratings_account_a_cannot_see_account_b(admin_conn, conn_a):
     step_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO step_library (
-            id, account_id, title, step_type, content,
+            id, account_id, created_by, title, step_type, content,
             visibility, is_active, created_at, updated_at
         ) VALUES (
-            '{step_id}', '{ACCOUNT_B_ID}', 'Phase3 RLS Step', 'action',
+            '{step_id}', '{ACCOUNT_B_ID}', '{user_b_id}',
+            'Phase3 RLS Step', 'action',
             '{{}}'::jsonb, 'private', TRUE, NOW(), NOW()
         )
     """)
@@ -768,10 +810,11 @@ async def test_step_usage_log_account_a_cannot_see_account_b(admin_conn, conn_a)
     step_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO step_library (
-            id, account_id, title, step_type, content,
+            id, account_id, created_by, title, step_type, content,
             visibility, is_active, created_at, updated_at
         ) VALUES (
-            '{step_id}', '{ACCOUNT_B_ID}', 'Phase3 Usage Step', 'action',
+            '{step_id}', '{ACCOUNT_B_ID}', '{user_b_id}',
+            'Phase3 Usage Step', 'action',
             '{{}}'::jsonb, 'private', TRUE, NOW(), NOW()
         )
     """)
@@ -971,10 +1014,10 @@ async def test_script_builder_sessions_account_a_cannot_see_account_b(admin_conn
     session_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO script_builder_sessions (
-            id, user_id, account_id, language, created_at, updated_at
+            id, user_id, account_id, language, origin, created_at, updated_at
         ) VALUES (
             '{session_id}', '{user_b_id}', '{ACCOUNT_B_ID}',
-            'powershell', NOW(), NOW()
+            'powershell', 'standalone', NOW(), NOW()
         )
     """)
     try:
@@ -1001,22 +1044,24 @@ async def test_ai_session_steps_account_a_cannot_see_account_b(admin_conn, conn_
     ai_session_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO ai_sessions (
-            id, user_id, account_id, flow_type, status, confidence_tier,
+            id, user_id, account_id, session_type, intake_type,
+            intake_content, status, confidence_tier, confidence_score,
             created_at, updated_at
         ) VALUES (
             '{ai_session_id}', '{user_b_id}', '{ACCOUNT_B_ID}',
-            'troubleshooting', 'active', 'guided', NOW(), NOW()
+            'guided', 'free_text', '{{}}'::jsonb, 'active', 'guided', 0.0,
+            NOW(), NOW()
         )
     """)
 
     step_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO ai_session_steps (
-            id, session_id, account_id, step_type, content,
+            id, session_id, account_id, step_order, step_type, content,
             created_at
         ) VALUES (
             '{step_id}', '{ai_session_id}', '{ACCOUNT_B_ID}',
-            'question', 'Phase4 RLS test step', NOW()
+            1, 'question', '{{"text": "Phase4 RLS test step"}}'::jsonb, NOW()
         )
     """)
     try:
@@ -1040,11 +1085,11 @@ async def test_notifications_account_a_cannot_see_account_b(admin_conn, conn_a):
     notif_id = str(uuid.uuid4())
     await admin_conn.execute(f"""
         INSERT INTO notifications (
-            id, user_id, account_id, type, title, message,
+            id, user_id, account_id, event, title, body,
             is_read, created_at
         ) VALUES (
             '{notif_id}', '{user_b_id}', '{ACCOUNT_B_ID}',
-            'info', 'Phase4 RLS Test', 'RLS isolation test notification',
+            'test_event', 'Phase4 RLS Test', 'RLS isolation test notification',
             FALSE, NOW()
         )
     """)
@@ -1055,4 +1100,3 @@ async def test_notifications_account_a_cannot_see_account_b(admin_conn, conn_a):
         assert len(rows) == 0, "Account A should not see Account B notifications"
     finally:
         await admin_conn.execute(f"DELETE FROM notifications WHERE id = '{notif_id}'")
-

docs/FlowAssist_Migration/Issues/phase-9-review-issues.md

@@ -0,0 +1,87 @@
+# Phase 9 Review Issues
+
+Date: 2026-04-24
+
+Scope reviewed:
+- `backend/app/api/endpoints/script_builder.py`
+- `backend/app/api/endpoints/session_suggested_fixes.py`
+- `backend/app/services/script_builder_service.py`
+- `frontend/src/pages/AssistantChatPage.tsx`
+- `frontend/src/components/pilot/ScriptBuilderTab.tsx`
+- `frontend/src/components/pilot/EscalateInterceptDialog.tsx`
+
+## 1. "Applied partially" from the escalation intercept cannot persist
+
+Severity: High
+
+The escalation intercept offers an "applied partially" choice, but the frontend
+sends `applied_partial` without notes. The backend requires notes for that
+outcome and returns 400. The frontend catches the error silently and still opens
+the conclude modal, so the user can believe the partial outcome was recorded
+when it was not.
+
+Relevant files:
+- `frontend/src/pages/AssistantChatPage.tsx:659`
+- `frontend/src/components/pilot/EscalateInterceptDialog.tsx:56`
+- `backend/app/api/endpoints/session_suggested_fixes.py:316`
+
+Why this matters:
+- `handleInterceptChoice()` maps the partial button directly to
+  `patchOutcome(..., "applied_partial")`.
+- The call does not provide `notes`.
+- `PATCH /suggested-fixes/{fix_id}/outcome` rejects `applied_partial` without
+  notes.
+- The catch block is silent and the UI continues into the conclude flow.
+- The recorded fix status therefore remains unchanged while the user sees a
+  flow that implies the partial outcome was accepted.
+
+Recommended fix:
+- Prompt for partial notes before calling `patchOutcome()` with
+  `applied_partial`.
+- Do not proceed to the conclude modal if the partial outcome write fails.
+- Consider hiding or disabling the partial option when it is not applicable, or
+  pass the current fix status into `EscalateInterceptDialog` so it can render
+  valid choices only.
+- Add a regression test covering the partial escalation-intercept path.
+
+## 2. Script Builder can attach stale script state to a newer active fix
+
+Severity: Medium/High
+
+`ScriptBuilderTab` keeps local builder state across active-fix changes within
+the same pilot chat. If a new active fix supersedes the previous one while the
+tab remains mounted, old messages, `latestScript`, or editor text can remain in
+memory while submission uses the new `fix.id`.
+
+Relevant files:
+- `frontend/src/components/pilot/ScriptBuilderTab.tsx:55`
+- `frontend/src/components/pilot/ScriptBuilderTab.tsx:78`
+- `frontend/src/components/pilot/ScriptBuilderTab.tsx:150`
+- `frontend/src/pages/AssistantChatPage.tsx:399`
+- `frontend/src/pages/AssistantChatPage.tsx:1630`
+
+Why this matters:
+- `ScriptBuilderTab` initializes `editorBuffer`, messages, and latest script
+  from props and builder-session data.
+- The create/resume effect depends on `pilotSessionId`, not `fix.id`.
+- `AssistantChatPage` detects active-fix changes but only closes the script
+  panel.
+- The rendered `ScriptBuilderTab` is not keyed by active fix id.
+- Submitting a stale builder draft calls the script patch endpoint with the
+  current `fix.id`, so an older script can be attached to a newer fix.
+
+Recommended fix:
+- Reset Script Builder local state when `activeFix.id` changes.
+- Key the rendered `ScriptBuilderTab` by `activeFix.id` if the intended UX is a
+  fresh builder surface per fix.
+- If inline builder conversations are intended to resume per fix, extend the
+  backend idempotency model to include the fix id instead of only
+  `(user_id, ai_session_id)`.
+- Add a frontend regression test for an active fix changing while the Script
+  Builder tab is mounted.
+
+## Review Context
+
+This review was based on code inspection of the latest committed Phase 9
+implementation. No tracked working-tree diffs were present at review time.
+

docs/LESSONS-ARCHIVE.md

@@ -1,4 +1,4 @@
-# Lessons Archive (1-40)
+# Lessons Archive (1-70)
 
 > These lessons were originally in CLAUDE.md. They've been archived because the fixes are now baked into the codebase. Consult this file if you encounter a regression in any of these areas.
 
@@ -81,3 +81,67 @@
 **39. Platform settings for feature toggles:** Use `SettingsManager.get("key", db, default=True)`.
 
 **40. Survey public routes:** Add at top level in `router.tsx` alongside `/login`.
+
+---
+
+## Archived Lessons (41-70)
+
+**41. Assistant chat uses local React state, not Zustand:** `AssistantChatPage.tsx` uses `useState` for `chats`, `messages`, `input`, `loading`. No store.
+
+**42. Public pages use raw `fetch()`, not `apiClient`:** Survey, shared sessions, and no-auth pages use `fetch()` with full URL. `apiClient` requires auth tokens.
+
+**43. Adding new email types:** Add static async method to `EmailService` in `core/email.py`. Fire-and-forget from endpoints (log errors, don't fail).
+
+**44. AI Chat Builder is flow-type-aware:** `ai_chat_service.py` dispatches by `flow_type`. Troubleshooting: `[TREE_UPDATE]` markers. Procedural: `[STEPS_UPDATE]` markers. Both support `[METADATA]`.
+
+**45. Intake form field schema:** Uses `variable_name` and `field_type` (NOT `name` and `type`).
+
+**46. `CreateFlowDropdown` uses `AIPromptDialog`:** Opens prompt modal, starts AI session, generates flow, navigates to editor with `{ state: { aiPanelOpen: true, sessionId } }`.
+
+**47. Editor-Embedded Flow Assist:** `EditorAIPanel` (320px side panel) + `useEditorAI` hook. Ghost nodes use `_suggestion: true` flag. Delta responses use `[DELTA]...[/DELTA]` markers.
+
+**48. Tree orphan validation uses dynamic root ID:** Orphan check compares against `state.treeStructure?.id` (NOT hardcoded `'root'`).
+
+**49. Full-stack features — verify both ends:** schema → endpoint → API client → hook → store → UI.
+
+**50. Anthropic SDK retry:** Set `max_retries=1` to fail fast. Default `max_retries=2` can take 3× timeout.
+
+**51. AI model tier routing:** Use `settings.get_model_for_action(action_type)`. Model IDs: alias form (`claude-sonnet-4-6`).
+
+**52. Mobile scroll-to-top:** Use `ref.current.scrollIntoView()`, not `window.scrollTo()`. Trigger via `useEffect`.
+
+**53. Flex height chain:** Every ancestor must be a flex container for `flex-1` to work. Missing `flex` class collapses React Flow to 0 height.
+
+**54. React Flow CSS in Tailwind v4:** Import in `index.css`, not component JS. Override dark theme using `--xy-*` CSS custom properties.
+
+**55. App shell height chain:** Every wrapper between `.main-content` and canvas needs `flex` + `flex-1` + `min-h-0` or `h-full`.
+
+**56. Railway backend service name is `patherly`:** Production DB name is `railway`. Public Postgres proxy: `interchange.proxy.rlwy.net:45797`.
+
+**57. Node field priority:** `title` → `question` → `description` → `content` → `label`. See `copilot_service.py`.
+
+**58. `scriptGeneratorStore.generate()` optional param:** Always wrap: `onClick={() => generate()}`, never `onClick={generate}`.
+
+**59. ConnectWise `clientId` is server-side config:** Set in `config.py` as `CW_CLIENT_ID`. Per-connection: `company_id`, `public_key`, `private_key`, `server_url`.
+
+**60. Dockerfile build args for Vite env vars:** Any new `VITE_*` var must be added as `ARG` + `ENV` in `frontend/Dockerfile`. Railway env vars are runtime-only without this; `import.meta.env.VITE_*` resolves to `undefined` in production builds.
+
+**61. Procedural sessions auto-start on page load:** `ProceduralNavigationPage` calls `startSession()` immediately in `loadTree()` — no intake form screen or "Start" button. Variables filled inline. Troubleshooting flows DO have a start screen.
+
+**62. Playwright strict mode — scope selectors:** Step titles appear in both sidebar and main heading. Use `getByRole('heading', { name })` for main content.
+
+**63. Node 20 required for frontend builds:** `export NVM_DIR="$HOME/.nvm" && source "$NVM_DIR/nvm.sh" && nvm use 20`. Or: `PATH="$HOME/.nvm/versions/node/v20.19.0/bin:$PATH"`.
+
+**64. PostHog product analytics:** `PostHogProvider` in `main.tsx`. Event helpers in `lib/analytics.ts`. `identifyUser()` in `authStore.fetchUser()`, `resetAnalytics()` on logout. Env vars: `VITE_PUBLIC_POSTHOG_KEY`, `VITE_PUBLIC_POSTHOG_HOST`.
+
+**65. Local Docker Compose uses `resolutionflow` database on port 5433:** Container `resolutionflow_postgres`, DB `resolutionflow` (not `patherly`), port `5433`. Playwright config defaults must match.
+
+**66. Dev environment runs on Hostinger VPS (46.202.92.250):** CORS must include VPS IP in `CORS_ORIGINS` and `FRONTEND_URL`. See DEV-ENV.md.
+
+**67. Tree editor route is `/trees/new`:** NOT `/editor/new`. Use `getTreeEditorPath()` from `@/lib/routing`.
+
+**68. APScheduler jobs need `max_instances=1`:** Without it, overlapping runs can process the same records twice (TOCTOU race).
+
+**69. PostgreSQL `func.sum(case(...))` returns `Decimal` via asyncpg:** Cast to `int()` before storing in Pydantic `dict[str, Any]` fields.
+
+**70. Toast library uses `toast.warning()` not `toast.warn()`:** Import from `@/lib/toast`. Methods: `success`, `error`, `warning`, `info`.

docs/connectwise/CW_Security_Roles/README.md

@@ -0,0 +1,63 @@
+# ConnectWise integration docs
+
+Reference material for ResolutionFlow's ConnectWise Manage integration.
+This folder pairs a **human-editable source** (the XLSX) with two
+**generated artifacts** (YAML + Markdown). Code reads the YAML; humans
+read the Markdown; edits happen in the XLSX.
+
+## Files
+
+| File | Role | Edit? |
+|------|------|-------|
+| `api-member-security-roles.md` | Human-readable reference — browse on GitHub, link in PRs, onboard new contributors. | Generated — do not edit |
+| `api-member-security-roles.yaml` | Machine-readable source of truth — imported by integration code, queried by Claude Code when writing permission checks. | Generated — do not edit |
+| `source/Security_Roles_Matrix_11132017.xlsx` | Canonical source. The matrix as published by ConnectWise (with any corrections we've applied). | Yes — this is the editing surface |
+| `source/generate_role_docs.py` | Regenerates the YAML and Markdown from the XLSX. Deterministic. | Only if the matrix schema itself changes |
+| `source/requirements.txt` | Python deps for the generator (`openpyxl`, `PyYAML`). | Only when bumping deps |
+
+## Regeneration workflow
+
+After editing the XLSX:
+
+```bash
+cd docs/integrations/connectwise/source
+pip install -r requirements.txt
+python generate_role_docs.py \
+    --source Security_Roles_Matrix_11132017.xlsx \
+    --out-yaml ../api-member-security-roles.yaml \
+    --out-md   ../api-member-security-roles.md
+```
+
+Commit all three files together (XLSX, YAML, MD). The diff on the YAML
+is what reviewers should scrutinize — it is the source of truth for code.
+
+## Querying the YAML from integration code
+
+The YAML groups permissions by module and action. Example — checking
+what `Inquire: ALL` means for Service Desk → Service Tickets:
+
+```python
+import yaml
+from pathlib import Path
+
+doc = yaml.safe_load(
+    Path("docs/integrations/connectwise/api-member-security-roles.yaml").read_text()
+)
+levels = doc["modules"]["Service Desk"]["actions"]["Service Tickets"]["inquire"]["levels"]
+print(levels["ALL"])
+```
+
+This is the pattern `ConnectWiseAuthManager` and the proxy authorization
+layer should use when the required permission level for a given API
+endpoint needs to be documented or validated against an assigned role.
+
+## Conventions
+
+- **Levels are ordered most-to-least privileged:** `ALL`, `MY`, `MINE`, `NONE`.
+- **Verbs are always in this order:** `add`, `edit`, `delete`, `inquire`.
+- **`Not applicable` notes** in a verb's cell mean the meaningful level
+  is documented under another verb (almost always `inquire`) — the
+  generator preserves these as `note:` fields rather than inventing
+  placeholder levels.
+- **The XLSX is the single source of input.** Never hand-edit the YAML
+  or Markdown; your changes will be overwritten on the next regeneration.

docs/connectwise/CW_Security_Roles/generate_role_docs.py

@@ -0,0 +1,361 @@
+"""
+Generate ConnectWise security-role documentation from the source XLSX.
+
+Produces:
+  - api-member-security-roles.yaml : machine-readable source of truth
+  - api-member-security-roles.md   : human-readable reference
+
+Re-run this script after editing the source XLSX. Both outputs are
+deterministic — they will produce identical content from identical input,
+so diffs in version control reflect only real permission-model changes.
+
+Usage:
+    python generate_role_docs.py \
+        --source source/Security_Roles_Matrix_11132017.xlsx \
+        --out-yaml ../api-member-security-roles.yaml \
+        --out-md   ../api-member-security-roles.md
+"""
+from __future__ import annotations
+
+import argparse
+import re
+from dataclasses import dataclass, field
+from datetime import date
+from pathlib import Path
+from typing import Dict, List, Optional
+
+import yaml
+from openpyxl import load_workbook
+
+# ---------------------------------------------------------------------------
+# Parsing
+# ---------------------------------------------------------------------------
+
+# A level description line looks like "ALL: text..." or "NONE: text..."
+# We capture the prefix (ALL | NONE | MINE | MY) and the trailing description.
+LEVEL_LINE = re.compile(r"^(ALL|NONE|MINE|MY)\s*:\s*(.*)$", re.DOTALL)
+
+# Recognized ConnectWise permission levels, most-to-least privileged.
+LEVEL_ORDER = ["ALL", "MY", "MINE", "NONE"]
+
+VERBS = ["add", "edit", "delete", "inquire"]
+VERB_COLS = {"add": 3, "edit": 4, "delete": 5, "inquire": 6}
+
+
+@dataclass
+class CellPermission:
+    """Parsed contents of a single (action, verb) cell."""
+
+    levels: Dict[str, str] = field(default_factory=dict)  # level -> description
+    note: Optional[str] = None  # for "Not applicable. See Inquire level." etc.
+    raw: str = ""  # original cell text, preserved for audit
+
+
+@dataclass
+class ActionRow:
+    module: str
+    action: str
+    permissions: Dict[str, CellPermission]  # verb -> CellPermission
+
+
+def parse_cell(raw: Optional[str]) -> CellPermission:
+    """Parse a single cell's multi-line content into levels + note."""
+    if raw is None:
+        return CellPermission(raw="")
+    text = str(raw).strip()
+    cp = CellPermission(raw=text)
+    if not text:
+        return cp
+
+    # Split into candidate entries. Each entry is typically one line that
+    # starts with a level prefix, but description text can itself contain
+    # newlines. We therefore split on newlines and accumulate continuation
+    # lines into the preceding entry.
+    current_level: Optional[str] = None
+    current_buf: List[str] = []
+    note_buf: List[str] = []
+
+    def flush_level() -> None:
+        nonlocal current_level, current_buf
+        if current_level is not None:
+            cp.levels[current_level] = " ".join(current_buf).strip()
+        current_level = None
+        current_buf = []
+
+    for line in text.splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        m = LEVEL_LINE.match(line)
+        if m:
+            flush_level()
+            current_level = m.group(1).upper()
+            current_buf = [m.group(2).strip()]
+        elif current_level is not None:
+            current_buf.append(line)
+        else:
+            # No level prefix yet — belongs to the note.
+            note_buf.append(line)
+    flush_level()
+
+    if note_buf:
+        cp.note = " ".join(note_buf).strip()
+
+    return cp
+
+
+def read_matrix(xlsx_path: Path) -> List[ActionRow]:
+    wb = load_workbook(xlsx_path, data_only=True)
+    ws = wb.active  # Single sheet in this workbook.
+
+    # Header row is row 2 per the source file; data begins row 3.
+    actions: List[ActionRow] = []
+    for r in range(3, ws.max_row + 1):
+        module = ws.cell(row=r, column=1).value
+        action = ws.cell(row=r, column=2).value
+        if not (module or action):
+            continue  # skip fully empty rows
+        if not module or not action:
+            # Partial row — keep but flag. This shouldn't happen in the
+            # current source; if it does, the generator should fail loudly
+            # rather than silently produce wrong output.
+            raise ValueError(
+                f"Row {r} has a missing Module or Action: "
+                f"module={module!r}, action={action!r}"
+            )
+
+        perms: Dict[str, CellPermission] = {}
+        for verb, col in VERB_COLS.items():
+            perms[verb] = parse_cell(ws.cell(row=r, column=col).value)
+
+        actions.append(
+            ActionRow(module=module.strip(), action=action.strip(), permissions=perms)
+        )
+    return actions
+
+
+# ---------------------------------------------------------------------------
+# Output: YAML
+# ---------------------------------------------------------------------------
+
+def build_yaml_document(actions: List[ActionRow], source_file: str) -> dict:
+    """Build a plain-dict representation that YAML dumps cleanly."""
+    # Group by module, preserving action order within each module.
+    modules: Dict[str, List[ActionRow]] = {}
+    for a in actions:
+        modules.setdefault(a.module, []).append(a)
+
+    doc = {
+        "metadata": {
+            "source_file": source_file,
+            "generated_on": date.today().isoformat(),
+            "generator": "docs/integrations/connectwise/source/generate_role_docs.py",
+            "description": (
+                "ConnectWise security-role matrix. Each (module, action) entry "
+                "describes what each access level (ALL, MY, MINE, NONE) means "
+                "for the Add, Edit, Delete, and Inquire verbs. This is a "
+                "reference catalog, not a per-role assignment — role "
+                "assignments live in ConnectWise and are mirrored in the "
+                "ResolutionFlow integration config."
+            ),
+            "level_order_most_to_least_privileged": LEVEL_ORDER,
+        },
+        "modules": {},
+    }
+
+    for module_name, rows in modules.items():
+        module_block = {"actions": {}}
+        for a in rows:
+            action_block: Dict[str, object] = {}
+            for verb in VERBS:
+                cell = a.permissions[verb]
+                entry: Dict[str, object] = {}
+                if cell.levels:
+                    # Emit levels in canonical order, only those present.
+                    entry["levels"] = {
+                        lvl: cell.levels[lvl]
+                        for lvl in LEVEL_ORDER
+                        if lvl in cell.levels
+                    }
+                if cell.note:
+                    entry["note"] = cell.note
+                if not entry:
+                    # Truly empty cell — represent explicitly so downstream
+                    # consumers can distinguish "empty" from "missing".
+                    entry["note"] = "(no description provided)"
+                action_block[verb] = entry
+            module_block["actions"][a.action] = action_block
+        doc["modules"][module_name] = module_block
+
+    return doc
+
+
+class _LiteralStr(str):
+    """Marker type so PyYAML renders long strings as block literals."""
+
+
+def _literal_presenter(dumper, data):
+    return dumper.represent_scalar("tag:yaml.org,2002:str", data, style="|")
+
+
+yaml.add_representer(_LiteralStr, _literal_presenter)
+
+
+def _use_block_style_for_long_strings(obj):
+    """Recursively wrap long strings so the YAML is readable, not one-line."""
+    if isinstance(obj, dict):
+        return {k: _use_block_style_for_long_strings(v) for k, v in obj.items()}
+    if isinstance(obj, list):
+        return [_use_block_style_for_long_strings(v) for v in obj]
+    if isinstance(obj, str) and (len(obj) > 80 or "\n" in obj):
+        return _LiteralStr(obj)
+    return obj
+
+
+def dump_yaml(doc: dict, out_path: Path) -> None:
+    prepared = _use_block_style_for_long_strings(doc)
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    with out_path.open("w", encoding="utf-8") as f:
+        f.write("# ConnectWise API Member Security Roles — reference matrix.\n")
+        f.write("# Generated from the source XLSX; do not edit by hand.\n")
+        f.write("# Re-run generate_role_docs.py after updating the XLSX.\n\n")
+        yaml.dump(
+            prepared,
+            f,
+            sort_keys=False,
+            allow_unicode=True,
+            width=100,
+            default_flow_style=False,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Output: Markdown
+# ---------------------------------------------------------------------------
+
+def _md_escape(text: str) -> str:
+    """Escape pipes and collapse whitespace for Markdown table cells."""
+    return text.replace("|", "\\|").replace("\n", " ").strip()
+
+
+def build_markdown(actions: List[ActionRow], source_file: str) -> str:
+    modules: Dict[str, List[ActionRow]] = {}
+    for a in actions:
+        modules.setdefault(a.module, []).append(a)
+
+    lines: List[str] = []
+    lines.append("# ConnectWise API Member — Security Roles Reference")
+    lines.append("")
+    lines.append(
+        f"_Generated {date.today().isoformat()} from "
+        f"`{source_file}`. Do not edit by hand — update the XLSX and "
+        f"re-run `generate_role_docs.py`._"
+    )
+    lines.append("")
+    lines.append("## How to read this document")
+    lines.append("")
+    lines.append(
+        "Each ConnectWise module lists the actions it governs. For every "
+        "action, four permission verbs — **Add**, **Edit**, **Delete**, "
+        "**Inquire** — can be granted at one of these levels, most to "
+        "least privileged:"
+    )
+    lines.append("")
+    lines.append("| Level | Meaning |")
+    lines.append("|-------|---------|")
+    lines.append("| `ALL` | Access to all records in the system. |")
+    lines.append("| `MY` | Access to records owned by the user's team. |")
+    lines.append("| `MINE` | Access only to records owned by the user. |")
+    lines.append("| `NONE` | No access. |")
+    lines.append("")
+    lines.append(
+        "Not every level applies to every action — the source matrix "
+        "only documents the levels that are meaningful for each cell. "
+        "Cells marked _Not applicable_ reference another verb (usually "
+        "Inquire) where the meaningful level is defined."
+    )
+    lines.append("")
+    lines.append(
+        "The machine-readable form of this document is "
+        "[`api-member-security-roles.yaml`](./api-member-security-roles.yaml). "
+        "Use the YAML when writing integration code; use this Markdown "
+        "when reviewing, discussing, or onboarding."
+    )
+    lines.append("")
+    lines.append("## Table of contents")
+    lines.append("")
+    for module_name in modules:
+        anchor = module_name.lower().replace(" ", "-").replace("/", "")
+        lines.append(f"- [{module_name}](#{anchor}) — {len(modules[module_name])} actions")
+    lines.append("")
+
+    for module_name, rows in modules.items():
+        lines.append(f"## {module_name}")
+        lines.append("")
+        for a in rows:
+            lines.append(f"### {a.action}")
+            lines.append("")
+            lines.append("| Verb | Level | Description |")
+            lines.append("|------|-------|-------------|")
+            wrote_any = False
+            for verb in VERBS:
+                cell = a.permissions[verb]
+                if cell.levels:
+                    for lvl in LEVEL_ORDER:
+                        if lvl in cell.levels:
+                            lines.append(
+                                f"| {verb.capitalize()} | `{lvl}` | "
+                                f"{_md_escape(cell.levels[lvl])} |"
+                            )
+                            wrote_any = True
+                elif cell.note:
+                    lines.append(
+                        f"| {verb.capitalize()} | — | "
+                        f"_{_md_escape(cell.note)}_ |"
+                    )
+                    wrote_any = True
+            if not wrote_any:
+                lines.append("| — | — | _(no description provided)_ |")
+            lines.append("")
+
+    return "\n".join(lines) + "\n"
+
+
+def write_markdown(md_text: str, out_path: Path) -> None:
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    out_path.write_text(md_text, encoding="utf-8")
+
+
+# ---------------------------------------------------------------------------
+# Entry point
+# ---------------------------------------------------------------------------
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source", type=Path, required=True,
+                        help="Path to the source .xlsx")
+    parser.add_argument("--out-yaml", type=Path, required=True,
+                        help="Path to write the YAML output")
+    parser.add_argument("--out-md", type=Path, required=True,
+                        help="Path to write the Markdown output")
+    args = parser.parse_args()
+
+    actions = read_matrix(args.source)
+    doc = build_yaml_document(actions, source_file=args.source.name)
+    dump_yaml(doc, args.out_yaml)
+
+    md = build_markdown(actions, source_file=args.source.name)
+    write_markdown(md, args.out_md)
+
+    # Quick data-quality summary to stdout — helpful when re-running after edits.
+    from collections import Counter
+    modules_seen = Counter(a.module for a in actions)
+    print(f"Parsed {len(actions)} actions across {len(modules_seen)} modules:")
+    for m, n in modules_seen.most_common():
+        print(f"  {m}: {n}")
+    print(f"\nWrote {args.out_yaml}")
+    print(f"Wrote {args.out_md}")
+
+
+if __name__ == "__main__":
+    main()

docs/connectwise/CW_Security_Roles/requirements.txt

@@ -0,0 +1,5 @@
+# Dependencies for generate_role_docs.py.
+# These are only needed when regenerating the role docs from the XLSX —
+# they are not runtime dependencies of ResolutionFlow itself.
+openpyxl>=3.1,<4.0
+PyYAML>=6.0,<7.0

docs/superpowers/specs/2026-04-16-psa-ticket-management-design.md

@@ -0,0 +1,485 @@
+# PSA Ticket Management — Design Spec
+
+**Date:** 2026-04-16  
+**Status:** Approved  
+**Author:** Michael Chihlas + Claude  
+
+---
+
+## Overview
+
+Add PSA ticket management to ResolutionFlow so MSP engineers can view, manage, and create ConnectWise tickets without leaving the app. The feature surfaces in three places: a dedicated Tickets page, a dashboard widget on QuickStartPage, and a spin-off ticket flow inside ResolutionAssist sessions.
+
+---
+
+## Decisions Made
+
+| Question | Decision |
+|----------|----------|
+| Where does ticket management live? | Both: dedicated `/tickets` page + dashboard widget on QuickStartPage |
+| List layout | Flat list with rich filters + pagination |
+| Row density | Compact single-line rows |
+| Ticket detail | Right-side slide-out panel (~50% width) |
+| Ticket creation | Two-tab modal: Quick Create (AI) + Full Form |
+| Resource member list | All CW members, RF-mapped users visually highlighted |
+| Architecture | Dedicated `ticket_service.py` + normalized DTOs |
+
+---
+
+## Section 1 — Backend
+
+### New Endpoints
+
+All added to `backend/app/api/endpoints/integrations.py`, backed by `backend/app/services/ticket_service.py`.
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `POST` | `/integrations/psa/tickets` | Create a ticket |
+| `PATCH` | `/integrations/psa/tickets/{id}/status` | Update ticket status |
+| `GET` | `/integrations/psa/tickets/{id}/resources` | List current assignees |
+| `POST` | `/integrations/psa/tickets/{id}/resources` | Add a resource (member) |
+| `DELETE` | `/integrations/psa/tickets/{id}/resources/{member_id}` | Remove a resource |
+| `POST` | `/integrations/psa/tickets/ai-parse` | Natural language → structured pre-fill payload |
+
+**Breaking change — `search_tickets` response shape updated to `TicketListResponse`.**
+The existing `/integrations/psa/tickets/search` endpoint currently returns `list[PSATicketSearchResult]`. This spec changes it to return `TicketListResponse` (adds `total`, `page`, `page_size` wrapper).
+
+Current callers that must be migrated:
+- `integrationsApi.searchTickets()` in `frontend/src/api/integrations.ts` (line 18) — update return type
+- `integrationsApi.searchTicketsQueue()` in `frontend/src/api/integrations.ts` (line 20) — update return type
+- `frontend/src/components/dashboard/TicketQueue.tsx` — update to read `.items` from response
+- `frontend/src/components/session/TicketPickerModal.tsx` — update to read `.items` from response
+
+All other existing endpoints (`get_ticket`, `get_ticket_statuses`, `list_members`, `list_boards`) are unchanged.
+
+### ticket_service.py
+
+New service wrapping the PSA provider for ticket mutations. Keeps `integrations.py` clean and PSA-agnostic for future Autotask support.
+
+Methods:
+- `create_ticket(account_id, payload) → PSATicketCreated`
+- `add_resource(account_id, ticket_id, member_id) → PSAResource`
+- `remove_resource(account_id, ticket_id, member_id) → None`
+- `update_status(account_id, ticket_id, status_id) → PSATicketStatusUpdate`
+- `list_resources(account_id, ticket_id) → list[PSAResource]`
+
+### PSA Provider — New Abstract Methods and Paginated Result Type
+
+**New type in `backend/app/services/psa/types.py`:**
+```python
+@dataclass
+class PaginatedTicketResult:
+    items: list[PSATicket]
+    total: int
+    page: int
+    page_size: int
+```
+
+**`search_tickets` signature change** — updated on both the abstract base and `ConnectWiseProvider` to return `PaginatedTicketResult` instead of `list[PSATicket]`:
+```python
+# base.py
+@abstractmethod
+async def search_tickets(self, query: str, **filters) -> PaginatedTicketResult: ...
+```
+
+**How `total` is fetched** — ConnectWise provides `GET /service/tickets/count?conditions=...` which accepts the same conditions string as the page fetch. The `ConnectWiseProvider.search_tickets()` implementation fires two parallel requests:
+1. `GET /service/tickets?conditions=...&pageSize=N&page=N` — the current page
+2. `GET /service/tickets/count?conditions=...` — returns `{ "count": 142 }`
+
+Both use the same built conditions string. `asyncio.gather()` runs them in parallel. The count result is used to populate `PaginatedTicketResult.total`.
+
+**New abstract methods** added to `PSAProvider` base and `ConnectWiseProvider`:
+```python
+async def list_resources(self, ticket_id: int) -> list[PSAResource]: ...
+async def add_resource(self, ticket_id: int, member_id: int) -> PSAResource: ...
+async def remove_resource(self, ticket_id: int, member_id: int) -> None: ...
+async def create_ticket(self, payload: TicketCreatePayload) -> PSATicketCreated: ...
+```
+
+`update_status` already exists on the provider — no change needed there.
+
+ConnectWise implementation:
+- `list_resources` → `GET /service/tickets/{id}/members`
+- `add_resource` → `POST /service/tickets/{id}/members`
+- `remove_resource` → `DELETE /service/tickets/{id}/members/{member_id}`
+- `create_ticket` → `POST /service/tickets`
+
+### Normalized DTOs (Pydantic Schemas)
+
+New schemas in `backend/app/schemas/psa_tickets.py`:
+
+```python
+class PSAResource(BaseModel):
+    member_id: int
+    member_name: str
+    member_identifier: str        # CW username
+    is_rf_user: bool              # True if mapped in RF member mappings
+
+class PSATicketCreated(BaseModel):
+    id: int
+    summary: str
+    board_name: str
+    status_name: str
+    priority_name: str
+    company_name: str
+    resources: list[PSAResource]
+
+class PSATicketStatusUpdate(BaseModel):
+    ticket_id: int
+    previous_status: str
+    new_status: str
+
+class TicketCreatePayload(BaseModel):
+    summary: str
+    company_id: int
+    board_id: int
+    status_id: int
+    priority_id: int
+    description: str | None = None
+    assigned_member_id: int | None = None
+
+class TicketListResponse(BaseModel):
+    items: list[PSATicketSearchResult]   # existing schema
+    total: int
+    page: int
+    page_size: int
+```
+
+`search_tickets` endpoint updated to return `TicketListResponse` (was a plain list). Backend sorts results by `priority desc, dateEntered desc` via CW `orderBy` param.
+
+### AI Parse Endpoint
+
+`POST /integrations/psa/tickets/ai-parse`
+
+Request:
+```json
+{ "prompt": "New ticket for Acme Corp, Outlook not syncing, high priority, assign to me" }
+```
+
+Response — all pre-fill fields nullable, explicit `missing_fields` and `warnings`:
+```json
+{
+  "summary": "Outlook not syncing",
+  "company_id": 42,
+  "board_id": null,
+  "priority_id": null,
+  "status_id": null,
+  "assigned_member_id": 17,
+  "description": "User reports Outlook calendar not syncing since yesterday morning.",
+  "missing_fields": ["board_id", "priority_id", "status_id"],
+  "warnings": ["Could not determine board from context"]
+}
+```
+
+Frontend uses `missing_fields` to highlight required fields still needing engineer input. No ticket is created at this step — it is a parse-only endpoint.
+
+---
+
+## Section 2 — Frontend Architecture
+
+### New Files
+
+| File | Purpose |
+|------|---------|
+| `pages/TicketsPage.tsx` | Main tickets page — filter bar + paginated list |
+| `components/tickets/TicketListRow.tsx` | Compact single-line row |
+| `components/tickets/TicketFilterBar.tsx` | Config-driven filter bar (7 filters) |
+| `components/tickets/TicketDetailPanel.tsx` | Slide-out panel orchestrator |
+| `components/tickets/detail/TicketDetailHeader.tsx` | ID, summary, company, board, SLA |
+| `components/tickets/detail/TicketResourceManager.tsx` | Assignee list + add/remove |
+| `components/tickets/detail/TicketNotesFeed.tsx` | Chronological notes history |
+| `components/tickets/detail/TicketAddNote.tsx` | Inline note composer |
+| `components/tickets/detail/TicketConfigs.tsx` | Attached devices/configs |
+| `components/tickets/detail/TicketRelated.tsx` | Related tickets list |
+| `components/tickets/NewTicketModal.tsx` | Two-tab modal (owns draft state) |
+| `components/tickets/AiTicketParseForm.tsx` | Prompt input → emits parsed values upward |
+| `api/tickets.ts` | All ticket API calls (typed, `.then(r => r.data)` pattern) |
+| `types/tickets.ts` | TypeScript interfaces mirroring normalized DTOs |
+
+### Existing Files Touched
+
+- `router.tsx` — add `/tickets` route (lazy, via `lazyWithRetry`)
+- `AppLayout.tsx` — add "Tickets" nav item in sidebar under RESOLVE section
+- `AssistantChatPage.tsx` — handle `create_spin_off_ticket` action type in TaskLane + add "New Ticket" button to session header
+- `QuickStartPage.tsx` — no structural change needed; `TicketQueue` already renders at line 64. The existing component is updated in place (see Section 4).
+
+### Shared Types (`types/tickets.ts`)
+
+```typescript
+export interface TicketFilters {
+  search: string;
+  board_id: number | null;
+  status_id: number | null;
+  priority: string | null;
+  company_id: number | null;
+  assigned: 'me' | 'unassigned' | 'all' | number; // number = specific member_id
+  include_closed: boolean;
+}
+
+export interface TicketCreationPayload {
+  summary: string;
+  company_id: number | null;
+  board_id: number | null;
+  status_id: number | null;
+  priority_id: number | null;
+  description: string;
+  assigned_member_id: number | null;
+}
+
+export interface AiParseResponse {
+  summary: string | null;
+  company_id: number | null;
+  board_id: number | null;
+  priority_id: number | null;
+  status_id: number | null;
+  assigned_member_id: number | null;
+  description: string | null;
+  missing_fields: string[];
+  warnings: string[];
+}
+
+export interface PSAResource {
+  member_id: number;
+  member_name: string;
+  member_identifier: string;
+  is_rf_user: boolean;
+}
+
+// TicketSearchResult is the existing PSATicketSearchResult type from types/integrations.ts
+// Re-export or import from there — do not redefine
+export interface TicketListResponse {
+  items: PSATicketSearchResult[];
+  total: number;
+  page: number;
+  page_size: number;
+}
+```
+
+### TicketsPage — Filter & Pagination State
+
+All filter and pagination state lives in URL query params via `useSearchParams`:
+
+| Param | Type | Default |
+|-------|------|---------|
+| `search` | string | `""` |
+| `board` | number | — |
+| `status` | number | — |
+| `priority` | string | — |
+| `company` | number | — |
+| `assigned` | `me \| unassigned \| all \| {id}` | `all` |
+| `closed` | boolean | `false` |
+| `page` | number | `1` |
+
+Filter changes reset `page` to 1. Pagination: page size of 25. Controls show "Showing X–Y of Z tickets". Next disabled when `page * 25 >= total`.
+
+### TicketFilterBar — Config-Driven
+
+Filters defined as a `FILTER_CONFIG` array. Each entry:
+```typescript
+{ key: keyof TicketFilters, label: string, type: 'text' | 'select' | 'toggle', loadOptions?: () => Promise<Option[]> }
+```
+Adding or removing a filter is a one-line config change, not a component edit.
+
+### TicketDetailPanel — Optimistic Hydration
+
+The panel uses the **existing** `/integrations/psa/tickets/{id}/context` endpoint (client: `psaContextApi.getTicketContext()` in `frontend/src/api/psaContext.ts`) which already returns company, contact, configurations, notes, and related tickets in one call. This avoids creating redundant endpoints.
+
+1. Panel opens immediately with list row data (id, summary, company, board, status, priority) — no loading state for these fields
+2. Two parallel fetches fire on open:
+   - `psaContextApi.getTicketContext(ticketId)` — hydrates contact, notes, configs, related tickets
+   - `ticketsApi.listResources(ticketId)` — hydrates assignees (new endpoint)
+3. All detail sections (contact, notes, configs, related) render skeletons until `getTicketContext` resolves
+4. Resources section renders skeleton until `listResources` resolves
+
+`get_ticket` (the simpler single-ticket endpoint) is **not** used by the panel — `getTicketContext` is a strict superset of the data needed.
+
+### NewTicketModal — State Ownership
+
+- `NewTicketModal` owns the `TicketCreationPayload` draft state
+- `AiTicketParseForm` is a pure emitter: accepts a prompt string, calls `ai-parse`, fires `onParsed(Partial<TicketCreationPayload>)` upward
+- Modal merges parsed values into draft, highlights `missing_fields` with visual indicators
+- Two tabs: **Quick Create** (AI prompt → review) | **Full Form** (manual entry)
+- Default tab: Quick Create if AI-triggered, Full Form if engineer-initiated
+- Initial props: `initialValues?: Partial<TicketCreationPayload>` — used for spin-off pre-population
+
+---
+
+## Section 3 — ResolutionAssist Integration
+
+### Two Trigger Paths
+
+**1. AI-suggested (via `[ACTIONS]` marker)**
+
+When the AI identifies a second distinct issue during a session, it emits a JSON array inside the `[ACTIONS]` marker — matching the exact format `_parse_actions_marker()` in `unified_chat_service.py` expects (a list of objects with `label`, `command`, `description`):
+
+```
+[ACTIONS]
+[
+  {
+    "label": "Create ticket: Printer offline on 2nd floor",
+    "command": "create_spin_off_ticket",
+    "description": "Printer offline on 2nd floor"
+  }
+]
+[/ACTIONS]
+```
+
+The existing `_parse_actions_marker()` parser in `unified_chat_service.py` already handles this format — no parser changes needed. The frontend reads `action.command === "create_spin_off_ticket"` to render the "Create Ticket" button in TaskLane, and uses `action.description` as the `summary_hint` pre-populated into the Quick Create prompt input.
+
+`summary_hint` (from `action.description`) populates the AI prompt input only, not the summary field directly. The engineer still runs the AI parse step and reviews all output. This prevents bypassing review with potentially hallucinated values.
+
+**2. Engineer-initiated**
+
+A "New Ticket" button in the ResolutionAssist session header. Always visible regardless of AI suggestion. Opens `NewTicketModal` with Full Form tab as default.
+
+### Both Paths — NewTicketModal Pre-population
+
+**The linked ticket IDs problem:** The current `PSATicketInfo` type in `frontend/src/types/integrations.ts` only exposes `company_name` and `board_name` — not `company_id` or `board_id`. The modal needs the numeric IDs to pre-populate the form selects.
+
+**Fix:** Expand `PSATicketInfo` in `types/integrations.ts` to add the optional ID fields:
+```typescript
+export interface PSATicketInfo {
+  id: string
+  summary: string
+  company_name: string | null
+  board_name: string | null
+  status_name: string | null
+  priority_name: string | null
+  company_id: number | null   // add
+  board_id: number | null     // add
+}
+```
+
+These fields are already returned by the CW API in `get_ticket()` — update `_map_ticket()` in `ConnectWiseProvider` and the `PSATicketInfo` Pydantic schema to pass them through.
+
+**`AssistantChatPage` state change required:** The current page only tracks `activePsaTicketId: string | null` (line 76) — it does not hold a `PSATicketInfo` object. Add a new state field:
+```typescript
+const [linkedTicket, setLinkedTicket] = useState<PSATicketInfo | null>(null)
+```
+
+When the modal is opened (either via AI suggestion or the "New Ticket" button), if `activePsaTicketId` is set and `linkedTicket` is null, fire `integrationsApi.getTicket(activePsaTicketId)` to fetch the full ticket (which now includes `company_id` and `board_id`) and store it in `linkedTicket`. The modal opens immediately — `initialValues` is populated once the fetch resolves and the form fields update. If the fetch is still in flight when the modal opens, `company_id` and `board_id` start empty and fill in when ready.
+
+Once `linkedTicket` is populated, the modal receives:
+```typescript
+initialValues: {
+  company_id: linkedTicket.company_id,
+  board_id: linkedTicket.board_id,
+}
+```
+
+When no linked ticket exists (`activePsaTicketId === null`): `initialValues` is omitted. `company_id` and `board_id` render empty, requiring manual selection. No silent defaults, no errors.
+
+### TaskLane Action Lifecycle
+
+- Opening the modal does **not** remove the action from TaskLane
+- Dismissing the modal without submitting leaves the action visible
+- Successful ticket creation removes the action and shows a success toast: `"Ticket #1042 created in ConnectWise"`
+
+### System Prompt Addition
+
+New rule added to `ASSISTANT_SYSTEM_PROMPT` in `backend/app/services/assistant_chat_service.py`:
+
+> When you identify a second distinct issue that is clearly separate from the primary topic of this session, suggest creating a spin-off ticket using the `[ACTIONS]` marker. Use `"command": "create_spin_off_ticket"` and put the issue description in `"description"`. Only suggest this when the issue is genuinely separate — do not suggest for every tangential mention.
+
+### Backend
+
+- **`assistant_chat_service.py`** — system prompt updated with spin-off ticket instruction (above)
+- **`unified_chat_service.py`** — no parser changes needed; the existing `_parse_actions_marker()` already handles the JSON array format. The frontend reads `command === "create_spin_off_ticket"` to route the action
+- **`flowpilot_engine.py`** — no changes needed for this feature; guided FlowPilot sessions do not use this action type in the current scope
+
+No new backend endpoints — the modal reuses `POST /integrations/psa/tickets` and `POST /integrations/psa/tickets/ai-parse`.
+
+---
+
+## Section 4 — Dashboard Widget (QuickStartPage)
+
+### Placement
+
+`TicketQueue` **already exists** in `QuickStartPage` (line 64, below `ActiveFlowPilotSessions`, above the Dashboard section). It currently auto-hides if no PSA connection exists. This spec updates the existing `TicketQueue` component — it is **not** a new widget and does not need to be added to `QuickStartPage`. The Dashboard section below it is not collapsible.
+
+### Data Fetching
+
+On mount: `GET /integrations/psa/member-mappings` first to detect mapping state, then `integrationsApi.searchTicketsQueue({ assigned_to_me: true, include_closed: false, page_size: 5 })` if a mapping exists for the current user.
+
+`searchTicketsQueue` is used (not `searchTickets`) because it already accepts `assigned_to_me` and `page_size` params. Its return type will be updated to `TicketListResponse` as part of the search endpoint migration, so the widget reads `.items` after that change.
+
+Member mapping detection is explicit — the widget checks the mappings response, not the ticket result. "No mapping" and "no tickets" are distinct states.
+
+### Widget States
+
+| State | Condition | Display |
+|-------|-----------|---------|
+| Hidden | No PSA connection | Widget not rendered |
+| Prompt | PSA connected, no member mapping | "Map your PSA member to see your queue" → `/account/integrations` |
+| Loading | Fetching | 3 skeleton rows |
+| Populated | Tickets returned | Up to 5 compact rows + "View All Tickets →" |
+| Empty | No assigned open tickets | "No open tickets assigned to you" — muted, no CTA |
+| Error | PSA fetch fails | Silent — returns `[]`, no toast (per Lesson 111) |
+
+### Row Display
+
+Compact row matching Tickets page style: `#ID · Summary · Status badge · Priority dot`
+
+Clicking a row opens `TicketDetailPanel` as a right-side sheet rendered at the `QuickStartPage` level. Does **not** navigate away.
+
+### "View All Tickets" Link
+
+Links to `/tickets?assigned=me`. `TicketsPage` reads `assigned` from `useSearchParams` on mount and applies it as the initial filter state — consistent with Section 2 URL param contract.
+
+### Sorting
+
+Backend `search_tickets()` adds `orderBy=priority desc,dateEntered desc` to the CW API query. Widget does not sort client-side.
+
+---
+
+## Files Changed Summary
+
+### New Backend Files
+- `backend/app/services/ticket_service.py`
+- `backend/app/schemas/psa_tickets.py`
+
+### Modified Backend Files
+- `backend/app/api/endpoints/integrations.py` — 6 new endpoints, update search to return `TicketListResponse`
+- `backend/app/services/psa/types.py` — add `PaginatedTicketResult` dataclass
+- `backend/app/services/psa/base.py` — 4 new abstract methods; update `search_tickets` return type to `PaginatedTicketResult`
+- `backend/app/services/psa/connectwise/provider.py` — implement 4 new methods; update `search_tickets` to fire parallel count request and return `PaginatedTicketResult`; update `_map_ticket()` to pass through `company_id` and `board_id`
+- `backend/app/schemas/psa_connection.py` — add `company_id` and `board_id` to `PSATicketInfo` Pydantic schema
+- `backend/app/services/assistant_chat_service.py` — add spin-off ticket rule to `ASSISTANT_SYSTEM_PROMPT`
+- ~~`backend/app/services/flowpilot_engine.py`~~ — no changes (FlowPilot out of scope for this feature)
+- ~~`backend/app/services/unified_chat_service.py`~~ — no changes (existing `[ACTIONS]` parser handles the format)
+
+### New Frontend Files
+- `frontend/src/pages/TicketsPage.tsx`
+- `frontend/src/api/tickets.ts`
+- `frontend/src/types/tickets.ts`
+- `frontend/src/components/tickets/TicketListRow.tsx`
+- `frontend/src/components/tickets/TicketFilterBar.tsx`
+- `frontend/src/components/tickets/TicketDetailPanel.tsx`
+- `frontend/src/components/tickets/NewTicketModal.tsx`
+- `frontend/src/components/tickets/AiTicketParseForm.tsx`
+- `frontend/src/components/tickets/detail/TicketDetailHeader.tsx`
+- `frontend/src/components/tickets/detail/TicketResourceManager.tsx`
+- `frontend/src/components/tickets/detail/TicketNotesFeed.tsx`
+- `frontend/src/components/tickets/detail/TicketAddNote.tsx`
+- `frontend/src/components/tickets/detail/TicketConfigs.tsx`
+- `frontend/src/components/tickets/detail/TicketRelated.tsx`
+
+### Modified Frontend Files
+- `frontend/src/router.tsx` — `/tickets` route
+- `frontend/src/components/layout/AppLayout.tsx` — Tickets nav item
+- `frontend/src/pages/AssistantChatPage.tsx` — handle `create_spin_off_ticket` command in action renderer + add "New Ticket" button to session header
+- `frontend/src/components/dashboard/TicketQueue.tsx` — update existing component (see Section 4 — not a new file)
+- `frontend/src/api/integrations.ts` — update `searchTickets()` and `searchTicketsQueue()` return types to `TicketListResponse`
+- `frontend/src/types/integrations.ts` — add `company_id: number | null` and `board_id: number | null` to `PSATicketInfo`
+- `frontend/src/components/dashboard/TicketQueue.tsx` — update existing component: read `.items`, add mapping-state detection, member-mapping check, and 5-item cap
+- `frontend/src/components/session/TicketPickerModal.tsx` — read `.items` from paginated response
+
+---
+
+## Out of Scope
+
+- Autotask provider implementation (schema-ready, not implemented)
+- Time entry creation from ticket detail (provider method exists, no UI)
+- Ticket editing beyond status (summary, description, priority changes)
+- Bulk ticket operations
+- Real-time ticket updates / polling

frontend/e2e/command-palette.spec.ts

@@ -88,6 +88,8 @@ test.describe('command palette smoke tests', () => {
 
     await flowpilotOption.click()
 
-    await expect(page).toHaveURL(/\/assistant/)
+    // Phase 1 of the FlowPilot migration renamed /assistant to /pilot.
+    // /assistant still 301-redirects to /pilot, so accept either landing URL.
+    await expect(page).toHaveURL(/\/(pilot|assistant)/)
   })
 })

frontend/e2e/history.spec.ts

@@ -24,9 +24,13 @@ test.describe('session history smoke tests', () => {
       await page.goto('/sessions')
 
       await expect(
-        page.getByRole('heading', { name: 'Sessions', exact: true }),
+        page.getByRole('heading', { name: 'Session History', exact: true }),
       ).toBeVisible()
 
+      // Default tab on /sessions is "AI Sessions"; flow sessions live behind
+      // the "Flow Sessions" tab and only that tab exposes ticket/client filters.
+      await page.getByRole('button', { name: 'Flow Sessions' }).click()
+
       await page.getByPlaceholder('Search by ticket number...').fill(ticketNumber)
       await page.getByPlaceholder('Search by client name...').fill(clientName)
 

frontend/e2e/navigation.spec.ts

@@ -14,7 +14,7 @@ test.describe('authenticated navigation smoke tests', () => {
     await page.goto('/sessions')
 
     await expect(
-      page.getByRole('heading', { name: 'Sessions', exact: true }),
+      page.getByRole('heading', { name: 'Session History', exact: true }),
     ).toBeVisible()
   })
 
@@ -30,7 +30,7 @@ test.describe('authenticated navigation smoke tests', () => {
     await page.goto('/account')
 
     await expect(
-      page.getByRole('heading', { name: 'Account Settings' }),
+      page.getByRole('heading', { name: 'Account Management' }),
     ).toBeVisible()
   })
 })

frontend/e2e/resume.spec.ts

@@ -18,9 +18,17 @@ test.describe('session resume smoke tests', () => {
     })
 
     try {
-      await page.goto('/trees')
+      // Resume flow moved off /trees onto the Flow Sessions tab of /sessions
+      // during the FlowPilot migration. The destination (/trees/:id/navigate)
+      // is unchanged — only the entry point shifted.
+      await page.goto('/sessions')
+      await expect(
+        page.getByRole('heading', { name: 'Session History', exact: true }),
+      ).toBeVisible()
+      await page.getByRole('button', { name: 'Flow Sessions' }).click()
+      // Active sub-tab is the default and surfaces in-progress sessions.
 
-      const resumeCard = page.locator('.bg-card').filter({ hasText: tree.name }).filter({ hasText: 'Resume' }).first()
+      const resumeCard = page.locator('.bg-card').filter({ hasText: tree.name }).first()
       await expect(resumeCard).toBeVisible()
       await resumeCard.getByRole('button', { name: 'Resume' }).first().click()
 

frontend/src/api/index.ts

@@ -37,3 +37,4 @@ export { handoffsApi } from './handoffs'
 export { resolutionsApi } from './resolutions'
 export { deviceTypesApi } from './deviceTypes'
 export { networkDiagramsApi } from './networkDiagrams'
+export { ticketsApi } from './tickets'

frontend/src/api/integrations.ts

@@ -1,6 +1,7 @@
 import { apiClient } from './client'
 import type { PsaConnectionResponse, PsaConnectionCreate, PsaConnectionUpdate, PsaConnectionTestResponse } from '@/types'
-import type { PSABoard, TicketLinkResponse, PSATicketSearchResult, PSATicketInfo, PSATicketStatusItem, PsaPreviewResponse, PsaPostResponse, PsaPostLogEntry, PsaMemberResponse, PsaMemberMappingResponse, AutoMatchResult, FlowpilotSettings } from '@/types/integrations'
+import type { PSABoard, TicketLinkResponse, PSATicketInfo, PSATicketStatusItem, PsaPreviewResponse, PsaPostResponse, PsaPostLogEntry, PsaMemberResponse, PsaMemberMappingResponse, AutoMatchResult, FlowpilotSettings } from '@/types/integrations'
+import type { TicketListResponse } from '@/types/tickets'
 
 export const integrationsApi = {
   getConnection: () =>
@@ -15,20 +16,22 @@ export const integrationsApi = {
     apiClient.post<PsaConnectionTestResponse>(`/integrations/psa/connections/${id}/test`).then(r => r.data),
   listBoards: () =>
     apiClient.get<PSABoard[]>('/integrations/psa/boards').then(r => r.data),
-  searchTickets: (params: { query?: string; board_id?: number; include_closed?: boolean }) =>
-    apiClient.get<PSATicketSearchResult[]>('/integrations/psa/tickets/search', { params }).then(r => r.data),
+  searchTickets: (params: { query?: string; board_id?: number; include_closed?: boolean }): Promise<TicketListResponse> =>
+    apiClient.get<TicketListResponse>('/integrations/psa/tickets/search', { params }).then(r => r.data),
   searchTicketsQueue: (params: {
     assigned_to_me?: boolean
     unassigned?: boolean
     board_ids?: string
     page?: number
     page_size?: number
-  }) =>
-    apiClient.get<PSATicketSearchResult[]>('/integrations/psa/tickets/search', { params }).then(r => r.data),
+  }): Promise<TicketListResponse> =>
+    apiClient.get<TicketListResponse>('/integrations/psa/tickets/search', { params }).then(r => r.data),
   getTicket: (id: string) =>
     apiClient.get<PSATicketInfo>(`/integrations/psa/tickets/${id}`).then(r => r.data),
   getTicketStatuses: (ticketId: string) =>
     apiClient.get<PSATicketStatusItem[]>(`/integrations/psa/tickets/${ticketId}/statuses`).then(r => r.data),
+  getBoardStatuses: (boardId: number | string) =>
+    apiClient.get<PSATicketStatusItem[]>(`/integrations/psa/boards/${boardId}/statuses`).then(r => r.data),
   listMembers: () =>
     apiClient.get<PsaMemberResponse[]>('/integrations/psa/members').then(r => r.data),
   getMemberMappings: () =>

frontend/src/api/tickets.ts

@@ -0,0 +1,49 @@
+import { apiClient } from './client'
+import type {
+  PSAResource,
+  PSATicketCreated,
+  PSATicketStatusUpdate,
+  TicketCreationPayload,
+  AiParseResponse,
+  TicketListResponse,
+  PSAPriority,
+} from '@/types/tickets'
+
+export const ticketsApi = {
+  listResources: (ticketId: number): Promise<PSAResource[]> =>
+    apiClient.get<PSAResource[]>(`/integrations/psa/tickets/${ticketId}/resources`).then(r => r.data),
+
+  addResource: (ticketId: number, memberId: number): Promise<PSAResource> =>
+    apiClient.post<PSAResource>(`/integrations/psa/tickets/${ticketId}/resources?member_id=${memberId}`).then(r => r.data),
+
+  removeResource: (ticketId: number, memberId: number): Promise<void> =>
+    apiClient.delete(`/integrations/psa/tickets/${ticketId}/resources/${memberId}`).then(() => undefined),
+
+  updateStatus: (ticketId: number, statusId: number): Promise<PSATicketStatusUpdate> =>
+    apiClient.patch<PSATicketStatusUpdate>(`/integrations/psa/tickets/${ticketId}/status?status_id=${statusId}`).then(r => r.data),
+
+  createTicket: (payload: TicketCreationPayload): Promise<PSATicketCreated> =>
+    apiClient.post<PSATicketCreated>('/integrations/psa/tickets', payload).then(r => r.data),
+
+  aiParse: (prompt: string): Promise<AiParseResponse> =>
+    apiClient.post<AiParseResponse>('/integrations/psa/tickets/ai-parse', { prompt }).then(r => r.data),
+
+  listPriorities: (): Promise<PSAPriority[]> =>
+    apiClient.get<PSAPriority[]>('/integrations/psa/priorities').then(r => r.data),
+
+  searchTickets: (params: {
+    query?: string
+    board_id?: number | null
+    status_id?: number | null
+    status_name?: string | null
+    include_closed?: boolean
+    assigned_to_me?: boolean
+    unassigned?: boolean
+    board_ids?: string
+    priority?: string | null
+    company_id?: number | null
+    page?: number
+    page_size?: number
+  }): Promise<TicketListResponse> =>
+    apiClient.get<TicketListResponse>('/integrations/psa/tickets/search', { params }).then(r => r.data),
+}

frontend/src/components/dashboard/TicketQueue.tsx

@@ -1,11 +1,11 @@
 import { useState, useEffect, useRef, useCallback } from 'react'
-import { useNavigate } from 'react-router-dom'
-import { Ticket, ChevronDown, Check, Loader2, AlertCircle } from 'lucide-react'
+import { useNavigate, Link } from 'react-router-dom'
+import { Ticket, ChevronDown, Check, AlertCircle } from 'lucide-react'
 import { integrationsApi } from '@/api/integrations'
 import type { PSABoard, PSATicketSearchResult } from '@/types/integrations'
 import { cn } from '@/lib/utils'
 
-const PAGE_SIZE = 10
+const PAGE_SIZE = 5
 
 type Tab = 'mine' | 'unassigned'
 
@@ -188,14 +188,15 @@ function TicketRow({ ticket, isLast, onStartSession }: TicketRowProps) {
 export function TicketQueue() {
   const navigate = useNavigate()
   const [hasConnection, setHasConnection] = useState<boolean | null>(null)
+  const [hasMemberMapping, setHasMemberMapping] = useState<boolean | null>(null) // null = loading
   const [boards, setBoards] = useState<PSABoard[]>([])
   const [selectedBoardIds, setSelectedBoardIds] = useState<number[]>([])
   const [activeTab, setActiveTab] = useState<Tab>('mine')
   const [tickets, setTickets] = useState<PSATicketSearchResult[]>([])
-  const [page, setPage] = useState(1)
-  const [hasMore, setHasMore] = useState(false)
   const [loading, setLoading] = useState(false)
-  const [loadingMore, setLoadingMore] = useState(false)
+  // Monotonically increasing fetch token — late responses with a stale id
+  // are dropped so they can't overwrite the latest query's results.
+  const latestRequestId = useRef(0)
   const [error, setError] = useState<string | null>(null)
 
   // Check connection on mount
@@ -208,6 +209,15 @@ export function TicketQueue() {
       .catch(() => setHasConnection(false))
   }, [])
 
+  // Detect member mapping on mount
+  useEffect(() => {
+    integrationsApi.getMemberMappings()
+      .then(mappings => {
+        setHasMemberMapping(mappings.length > 0)
+      })
+      .catch(() => setHasMemberMapping(false))
+  }, [])
+
   // Fetch boards once connection confirmed
   useEffect(() => {
     if (!hasConnection) return
@@ -217,9 +227,9 @@ export function TicketQueue() {
   }, [hasConnection])
 
   const fetchTickets = useCallback(
-    async (tab: Tab, boardIds: number[], pageNum: number, append: boolean) => {
+    async (tab: Tab, boardIds: number[]) => {
       const params: Parameters<typeof integrationsApi.searchTicketsQueue>[0] = {
-        page: pageNum,
+        page: 1,
         page_size: PAGE_SIZE,
       }
       if (tab === 'mine') {
@@ -231,17 +241,25 @@ export function TicketQueue() {
         params.board_ids = boardIds.join(',')
       }
 
+      // Clear stale data + flip loading inside the async function so the
+      // writes happen after the awaitable boundary — avoids the
+      // synchronous-setState-in-effect cascade the lint rule flags. The
+      // fetch is also wrapped in a request-id check so a stale response
+      // can't clobber a newer query.
+      const requestId = ++latestRequestId.current
+      setTickets([])
+      setLoading(true)
+
       try {
         const results = await integrationsApi.searchTicketsQueue(params)
-        if (append) {
-          setTickets((prev) => [...prev, ...results])
-        } else {
-          setTickets(results)
-        }
-        setHasMore(results.length === PAGE_SIZE)
+        if (requestId !== latestRequestId.current) return
+        setTickets(results.items)
         setError(null)
       } catch {
+        if (requestId !== latestRequestId.current) return
         setError('Failed to load tickets. Check your PSA connection.')
+      } finally {
+        if (requestId === latestRequestId.current) setLoading(false)
       }
     },
     [],
@@ -250,20 +268,9 @@ export function TicketQueue() {
   // Initial + reset fetch when tab or board selection changes
   useEffect(() => {
     if (!hasConnection) return
-    setPage(1)
-    setTickets([])
-    setHasMore(false)
-    setLoading(true)
-    fetchTickets(activeTab, selectedBoardIds, 1, false).finally(() => setLoading(false))
-  }, [activeTab, selectedBoardIds, hasConnection, fetchTickets])
-
-  const handleLoadMore = async () => {
-    const nextPage = page + 1
-    setPage(nextPage)
-    setLoadingMore(true)
-    await fetchTickets(activeTab, selectedBoardIds, nextPage, true)
-    setLoadingMore(false)
-  }
+    if (activeTab === 'mine' && hasMemberMapping !== true) return
+    fetchTickets(activeTab, selectedBoardIds)
+  }, [activeTab, selectedBoardIds, hasConnection, hasMemberMapping, fetchTickets])
 
   const handleStartSession = (ticket: PSATicketSearchResult) => {
     navigate('/pilot', {
@@ -327,6 +334,18 @@ export function TicketQueue() {
 
       {/* Content */}
       <div>
+        {/* Mapping prompt for "mine" tab when no member mapping configured */}
+        {activeTab === 'mine' && hasMemberMapping === false && (
+          <div className="px-5 py-6 text-center">
+            <p className="text-sm text-muted-foreground">
+              <Link to="/account/integrations" className="text-accent hover:underline">
+                Map your PSA member
+              </Link>{' '}
+              to see your ticket queue.
+            </p>
+          </div>
+        )}
+
         {/* Error */}
         {error && (
           <div className="flex items-center gap-2 px-5 py-4 text-sm text-danger">
@@ -345,13 +364,25 @@ export function TicketQueue() {
               <TicketRow
                 key={ticket.id}
                 ticket={ticket}
-                isLast={i === tickets.length - 1 && !hasMore}
+                isLast={i === tickets.length - 1}
                 onStartSession={handleStartSession}
               />
             ))}
           </>
         )}
 
+        {/* View all tickets link */}
+        {tickets.length > 0 && (
+          <div className="px-5 py-3 border-t border-default">
+            <Link
+              to="/tickets?assigned=me"
+              className="text-xs text-accent hover:text-accent/80 transition-colors"
+            >
+              View all tickets →
+            </Link>
+          </div>
+        )}
+
         {/* Empty states */}
         {!error && !loading && tickets.length === 0 && (
           <div className="px-5 py-8 text-center">
@@ -369,28 +400,6 @@ export function TicketQueue() {
           </div>
         )}
 
-        {/* Load more */}
-        {!error && !loading && hasMore && (
-          <div
-            className="px-5 py-3"
-            style={{ borderTop: '1px solid var(--color-border-default)' }}
-          >
-            <button
-              onClick={handleLoadMore}
-              disabled={loadingMore}
-              className="flex w-full items-center justify-center gap-2 rounded-lg border border-[rgba(255,255,255,0.08)] bg-transparent py-2 text-xs text-muted-foreground hover:text-foreground hover:border-[rgba(255,255,255,0.14)] disabled:opacity-50 transition-colors"
-            >
-              {loadingMore ? (
-                <>
-                  <Loader2 size={12} className="animate-spin" />
-                  Loading...
-                </>
-              ) : (
-                'Load more'
-              )}
-            </button>
-          </div>
-        )}
       </div>
     </div>
   )

frontend/src/components/layout/Sidebar.tsx

@@ -5,7 +5,7 @@ import {
   LayoutGrid, Clock, AlertTriangle, GitBranch, Code2, Wand2,
   ListChecks, Download, BarChart3,
   Settings, Pin, PinOff,
-  History, FileText, Network,
+  History, FileText, Network, Ticket,
 } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { useUserPreferencesStore } from '@/store/userPreferencesStore'
@@ -94,6 +94,10 @@ export function Sidebar() {
         { href: '/escalations', label: 'Escalations', count: stats?.escalation_count || undefined },
       ],
     },
+    {
+      href: '/tickets', icon: Ticket, label: 'Tickets', shortLabel: 'Tickets',
+      matchPaths: ['/tickets'],
+    },
     {
       href: '/trees', icon: GitBranch, label: 'Flows', shortLabel: 'Flows',
       badge: stats?.tree_counts.total || undefined,
@@ -132,6 +136,7 @@ export function Sidebar() {
       items: [
         { href: '/', icon: LayoutGrid, label: 'Dashboard', shortLabel: 'Dash' },
         { href: '/sessions', icon: Clock, label: 'Session History', shortLabel: 'History', badge: stats?.active_count || undefined, matchPaths: ['/sessions'] },
+        { href: '/tickets', icon: Ticket, label: 'Tickets', shortLabel: 'Tickets', matchPaths: ['/tickets'] },
         { href: '/escalations', icon: AlertTriangle, label: 'Escalations', shortLabel: 'Escal', badge: stats?.escalation_count || undefined },
       ],
     },

frontend/src/components/network/nodes/DeviceNode.tsx

@@ -62,10 +62,9 @@ function DeviceNodeComponent({ id, data, selected, width, height }: NodeProps) {
     }
   }, [editing])
 
-  // Sync if data.label changes externally (e.g. undo/redo)
-  useEffect(() => {
-    if (!editing) setLabelValue(nodeData.label ?? '')
-  }, [nodeData.label, editing])
+  // While not editing, the displayed label is derived directly from
+  // nodeData.label — no effect-driven sync needed. labelValue holds the
+  // edit buffer only and is reset when an edit session starts.
 
   const hasTooltipContent = props.hostname || props.ip || props.vendor || props.model || props.role || props.notes
 
@@ -127,10 +126,11 @@ function DeviceNodeComponent({ id, data, selected, width, height }: NodeProps) {
                     className="max-w-[88%] cursor-default text-center font-medium leading-tight text-primary line-clamp-2"
                     onDoubleClick={e => {
                       e.stopPropagation()
+                      setLabelValue(nodeData.label ?? '')
                       setEditing(true)
                     }}
                   >
-                    {labelValue}
+                    {nodeData.label ?? ''}
                   </span>
                 )}
                 <span

frontend/src/components/network/nodes/GroupNode.tsx

@@ -22,10 +22,9 @@ const GroupNodeComponent = ({ data, selected, id }: NodeProps) => {
     if (editing) inputRef.current?.focus()
   }, [editing])
 
-  // Sync if external data.label changes
-  useEffect(() => {
-    if (!editing) setLabelValue(groupData.label ?? '')
-  }, [groupData.label, editing])
+  // While not editing, the displayed label is derived directly from
+  // groupData.label — no effect-driven sync needed. labelValue holds the
+  // edit buffer only and is reset when an edit session starts.
 
   const handleLabelCommit = () => {
     setEditing(false)
@@ -69,9 +68,12 @@ const GroupNodeComponent = ({ data, selected, id }: NodeProps) => {
             <span
               className="inline-block rounded-sm bg-card/90 px-1.5 py-0.5 text-[11px] font-semibold cursor-text select-none tracking-wide"
               style={{ color }}
-              onDoubleClick={() => setEditing(true)}
+              onDoubleClick={() => {
+                setLabelValue(groupData.label ?? '')
+                setEditing(true)
+              }}
             >
-              {labelValue || groupData.groupType}
+              {(groupData.label ?? '') || groupData.groupType}
             </span>
           )}
         </div>

frontend/src/components/pilot/EscalateInterceptDialog.tsx

@@ -41,7 +41,7 @@ export function EscalateInterceptDialog({
       <div
         role="dialog"
         aria-label="Capture fix outcome before escalating"
-        className="absolute bottom-full mb-2 left-0 z-50 w-[340px] rounded-lg border border-white/15 bg-card p-3.5 shadow-[0_18px_40px_rgba(0,0,0,0.55)]"
+        className="absolute top-full mt-2 right-0 z-50 w-[340px] rounded-lg border border-white/15 bg-card p-3.5 shadow-[0_18px_40px_rgba(0,0,0,0.55)]"
       >
         {!partialStep ? (
           <>

frontend/src/components/pilot/ResolutionNotePreview.tsx

@@ -9,7 +9,7 @@
  * Kind switches the labels, button colors, and confirm-CTA text — the
  * underlying mechanics (preview fetch + edit + post) are identical.
  */
-import { useState, useEffect } from 'react'
+import { useRef, useState, useEffect } from 'react'
 import { Loader2, RefreshCw, X, FileText, Pencil, Check, ArrowUpRight } from 'lucide-react'
 import { MarkdownContent } from '@/components/ui/MarkdownContent'
 import { cn } from '@/lib/utils'
@@ -43,6 +43,7 @@ export function ResolutionNotePreview({
   const [refreshing, setRefreshing] = useState(false)
   const [editing, setEditing] = useState(false)
   const [draft, setDraft] = useState('')
+  const popoverRef = useRef<HTMLDivElement>(null)
 
   // Keep the draft textarea in sync whenever fresh markdown arrives and we
   // aren't in the middle of editing. Once the engineer edits, their changes
@@ -53,6 +54,15 @@ export function ResolutionNotePreview({
     }
   }, [preview?.markdown, editing])
 
+  // The popover renders at the bottom of TaskLane's scrollable region, which
+  // can leave it below the fold on smaller viewports. Scroll it into view
+  // whenever it opens so the engineer sees their preview immediately.
+  useEffect(() => {
+    if (open && popoverRef.current) {
+      popoverRef.current.scrollIntoView({ behavior: 'smooth', block: 'nearest' })
+    }
+  }, [open])
+
   if (!open) return null
 
   const label = kind === 'resolve' ? 'Resolution note' : 'Escalation handoff package'
@@ -73,7 +83,7 @@ export function ResolutionNotePreview({
   }
 
   return (
-    <div className="rounded-lg border border-default bg-elevated/30 mx-3 mb-3 overflow-hidden shadow-lg">
+    <div ref={popoverRef} className="rounded-lg border border-default bg-elevated/30 mx-3 mb-3 overflow-hidden shadow-lg">
       <div className="flex items-center justify-between px-3 py-2 border-b border-default bg-bg-page">
         <div className="flex items-center gap-2">
           <KindIcon size={13} className={kind === 'resolve' ? 'text-success' : 'text-warning'} />

frontend/src/components/pilot/ScriptBuilderTab.tsx

@@ -165,7 +165,9 @@ export function ScriptBuilderTab({
 
   // onViewScript is required by ScriptBuilderChat — provide a no-op for now
   // (inline preview is a future extension).
-  const handleViewScript = (_script: string, _filename: string | null) => {
+  const handleViewScript = (script: string, filename: string | null) => {
+    void script
+    void filename
     // Future: open inline preview panel
   }
 

frontend/src/components/routing/AssistantSessionRedirect.tsx

@@ -0,0 +1,11 @@
+import { Navigate, useParams } from 'react-router-dom'
+
+/**
+ * Permanent 301-style redirect from /assistant/:sessionId to /pilot/:sessionId.
+ * Used by the Phase 1 route-rename; paired with a bare-path redirect to /pilot.
+ * SPA redirects replace history so the legacy URL does not linger in back-nav.
+ */
+export function AssistantSessionRedirect() {
+  const { sessionId } = useParams<{ sessionId: string }>()
+  return <Navigate to={sessionId ? `/pilot/${sessionId}` : '/pilot'} replace />
+}

frontend/src/components/session/TicketPickerModal.tsx

@@ -56,7 +56,7 @@ export function TicketPickerModal({ open, onClose, sessionId, onLinked, onSelect
         query: query.trim(),
         include_closed: closed,
       })
-      setSearchResults(results)
+      setSearchResults(results.items)
       setHasSearched(true)
     } catch (err: unknown) {
       const message =

frontend/src/components/tickets/AiTicketParseForm.tsx

@@ -0,0 +1,63 @@
+import { useState } from 'react'
+import { Sparkles, Loader2 } from 'lucide-react'
+import { ticketsApi } from '@/api/tickets'
+import type { AiParseResponse, TicketCreationPayload } from '@/types/tickets'
+
+interface Props {
+  initialHint?: string
+  onParsed: (values: Partial<TicketCreationPayload>, parseResponse: AiParseResponse) => void
+}
+
+export function AiTicketParseForm({ initialHint = '', onParsed }: Props) {
+  const [prompt, setPrompt] = useState(initialHint)
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  async function handleParse() {
+    if (!prompt.trim()) return
+    setLoading(true)
+    setError(null)
+    try {
+      const result = await ticketsApi.aiParse(prompt)
+      const values: Partial<TicketCreationPayload> = {
+        summary: result.summary ?? undefined,
+        company_id: result.company_id,
+        board_id: result.board_id,
+        status_id: result.status_id,
+        priority_id: result.priority_id,
+        assigned_member_id: result.assigned_member_id,
+        description: result.description ?? undefined,
+      }
+      onParsed(values, result)
+    } catch {
+      setError('AI parsing failed. Please try again or use the full form.')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div className="space-y-3">
+      <p className="text-sm text-muted-foreground">
+        Describe the ticket in plain language — who, what, which client, and priority.
+      </p>
+      <textarea
+        aria-label="Ticket description"
+        className="w-full bg-input border border-default rounded-[5px] px-3 py-2 text-sm text-primary placeholder:text-muted-foreground focus:border-accent focus:outline-none resize-none"
+        rows={4}
+        placeholder="e.g. Create a high priority ticket for Acme Corp — Outlook not syncing for jsmith, assign to me"
+        value={prompt}
+        onChange={e => setPrompt(e.target.value)}
+      />
+      {error && <p className="text-xs text-danger">{error}</p>}
+      <button
+        onClick={handleParse}
+        disabled={!prompt.trim() || loading}
+        className="flex items-center gap-1.5 px-4 py-2 bg-accent text-white text-sm font-medium rounded-[5px] hover:bg-accent/90 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
+      >
+        {loading ? <Loader2 className="w-4 h-4 animate-spin" /> : <Sparkles className="w-4 h-4" />}
+        {loading ? 'Parsing…' : 'Parse with AI'}
+      </button>
+    </div>
+  )
+}

frontend/src/components/tickets/NewTicketModal.tsx

@@ -0,0 +1,261 @@
+import { useState, useEffect } from 'react'
+import { X, AlertCircle } from 'lucide-react'
+import { ticketsApi } from '@/api/tickets'
+import { integrationsApi } from '@/api/integrations'
+import { AiTicketParseForm } from './AiTicketParseForm'
+import { toast } from '@/lib/toast'
+import { cn } from '@/lib/utils'
+import type { TicketCreationPayload, AiParseResponse, PSAPriority } from '@/types/tickets'
+import type { PSABoard, PSATicketStatusItem } from '@/types/integrations'
+
+interface Props {
+  defaultTab?: 'quick' | 'manual'
+  initialValues?: Partial<TicketCreationPayload>
+  summaryHint?: string
+  onClose: () => void
+  onCreated: (ticketId: number, summary: string) => void
+}
+
+const EMPTY_DRAFT: TicketCreationPayload = {
+  summary: '',
+  company_id: null,
+  board_id: null,
+  status_id: null,
+  priority_id: null,
+  description: '',
+  assigned_member_id: null,
+}
+
+export function NewTicketModal({ defaultTab = 'quick', initialValues, summaryHint, onClose, onCreated }: Props) {
+  const [tab, setTab] = useState<'quick' | 'manual'>(defaultTab)
+  const [draft, setDraft] = useState<TicketCreationPayload>({ ...EMPTY_DRAFT, ...initialValues })
+  const [missingFields, setMissingFields] = useState<string[]>([])
+  const [warnings, setWarnings] = useState<string[]>([])
+  const [boards, setBoards] = useState<PSABoard[]>([])
+  const [statuses, setStatuses] = useState<PSATicketStatusItem[]>([])
+  const [priorities, setPriorities] = useState<PSAPriority[]>([])
+  const [submitting, setSubmitting] = useState(false)
+  const [parsed, setParsed] = useState(false)
+
+  useEffect(() => {
+    integrationsApi.listBoards().then(setBoards).catch(() => {})
+    ticketsApi.listPriorities().then(setPriorities).catch(err => console.error('Failed to load priorities', err))
+  }, [])
+
+  useEffect(() => {
+    if (draft.board_id) {
+      integrationsApi.getBoardStatuses(draft.board_id)
+        .then(setStatuses).catch(() => {})
+    } else {
+      setStatuses([])
+    }
+  }, [draft.board_id])
+
+  function handleParsed(values: Partial<TicketCreationPayload>, result: AiParseResponse) {
+    setDraft(prev => ({ ...prev, ...values }))
+    setMissingFields(result.missing_fields)
+    setWarnings(result.warnings)
+    setParsed(true)
+  }
+
+  function updateDraft(field: keyof TicketCreationPayload, value: unknown) {
+    setDraft(prev => ({ ...prev, [field]: value }))
+    setMissingFields(prev => prev.filter(f => f !== field))
+  }
+
+  async function handleSubmit() {
+    if (!draft.summary.trim() || !draft.company_id || !draft.board_id || !draft.status_id || !draft.priority_id) {
+      toast.warning('Please fill in all required fields')
+      return
+    }
+    setSubmitting(true)
+    try {
+      const result = await ticketsApi.createTicket(draft)
+      toast.success(`Ticket #${result.id} created in ConnectWise`)
+      onCreated(result.id, result.summary)
+    } catch {
+      toast.error('Failed to create ticket')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const requiredMissing = (f: string) => missingFields.includes(f)
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-end sm:items-center justify-center">
+      <div className="fixed inset-0 bg-black/50" onClick={onClose} />
+      <div className="relative z-10 bg-card border border-default rounded-lg w-full max-w-lg max-h-[90vh] flex flex-col shadow-xl">
+        {/* Header */}
+        <div className="flex items-center justify-between px-5 py-4 border-b border-default shrink-0">
+          <h2 className="font-heading font-semibold text-heading">New Ticket</h2>
+          <button onClick={onClose} aria-label="Close" className="text-muted-foreground hover:text-primary transition-colors">
+            <X className="w-4 h-4" />
+          </button>
+        </div>
+
+        {/* Tabs */}
+        <div className="flex border-b border-default shrink-0">
+          {(['quick', 'manual'] as const).map(t => (
+            <button
+              key={t}
+              onClick={() => setTab(t)}
+              className={cn(
+                'flex-1 py-2.5 text-sm font-medium transition-colors',
+                tab === t
+                  ? 'text-accent border-b-2 border-accent'
+                  : 'text-muted-foreground hover:text-primary'
+              )}
+            >
+              {t === 'quick' ? 'Quick Create (AI)' : 'Full Form'}
+            </button>
+          ))}
+        </div>
+
+        {/* Content */}
+        <div className="flex-1 overflow-y-auto p-5 space-y-4">
+          {/* Warnings */}
+          {warnings.length > 0 && (
+            <div className="flex gap-2 bg-warning/10 border border-warning/30 rounded p-3">
+              <AlertCircle className="w-4 h-4 text-warning shrink-0 mt-0.5" />
+              <ul className="text-xs text-warning space-y-0.5">
+                {warnings.map((w, i) => <li key={i}>{w}</li>)}
+              </ul>
+            </div>
+          )}
+
+          {/* Quick Create tab — before parse */}
+          {tab === 'quick' && !parsed && (
+            <AiTicketParseForm initialHint={summaryHint} onParsed={handleParsed} />
+          )}
+
+          {/* Form — shown after parse OR in manual tab */}
+          {(tab === 'manual' || parsed) && (
+            <div className="space-y-3">
+              {/* Summary */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Summary *
+                </label>
+                <input
+                  className={cn(
+                    'w-full bg-input border rounded-[5px] px-3 py-2 text-sm text-primary placeholder:text-muted-foreground focus:outline-none focus:border-accent',
+                    requiredMissing('summary') ? 'border-warning' : 'border-default'
+                  )}
+                  placeholder="Short ticket title"
+                  value={draft.summary}
+                  onChange={e => updateDraft('summary', e.target.value)}
+                />
+              </div>
+
+              {/* Board */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Board *
+                </label>
+                <select
+                  className={cn(
+                    'w-full bg-input border rounded-[5px] px-3 py-2 text-sm text-primary focus:outline-none focus:border-accent',
+                    requiredMissing('board_id') ? 'border-warning' : 'border-default'
+                  )}
+                  value={draft.board_id ?? ''}
+                  onChange={e => updateDraft('board_id', e.target.value ? Number(e.target.value) : null)}
+                >
+                  <option value="">Select board…</option>
+                  {boards.map(b => <option key={b.id} value={b.id}>{b.name}</option>)}
+                </select>
+              </div>
+
+              {/* Status */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Status *
+                </label>
+                <select
+                  disabled={statuses.length === 0}
+                  className={cn(
+                    'w-full bg-input border rounded-[5px] px-3 py-2 text-sm text-primary focus:outline-none focus:border-accent disabled:opacity-50',
+                    requiredMissing('status_id') ? 'border-warning' : 'border-default'
+                  )}
+                  value={draft.status_id ?? ''}
+                  onChange={e => updateDraft('status_id', e.target.value ? Number(e.target.value) : null)}
+                >
+                  <option value="">{draft.board_id ? 'Select status…' : 'Select board first'}</option>
+                  {statuses.map(s => <option key={s.id} value={s.id}>{s.name}</option>)}
+                </select>
+              </div>
+
+              {/* Priority */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Priority *
+                </label>
+                <select
+                  className={cn(
+                    'w-full bg-input border rounded-[5px] px-3 py-2 text-sm text-primary focus:outline-none focus:border-accent',
+                    requiredMissing('priority_id') ? 'border-warning' : 'border-default'
+                  )}
+                  value={draft.priority_id ?? ''}
+                  onChange={e => updateDraft('priority_id', e.target.value ? Number(e.target.value) : null)}
+                >
+                  <option value="">Select priority…</option>
+                  {priorities.map(p => <option key={p.id} value={p.id}>{p.name}</option>)}
+                </select>
+              </div>
+
+              {/* Company ID */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Company ID *
+                </label>
+                <input
+                  type="number"
+                  className={cn(
+                    'w-full bg-input border rounded-[5px] px-3 py-2 text-sm text-primary placeholder:text-muted-foreground focus:outline-none focus:border-accent',
+                    requiredMissing('company_id') ? 'border-warning' : 'border-default'
+                  )}
+                  placeholder="ConnectWise company ID"
+                  value={draft.company_id ?? ''}
+                  onChange={e => updateDraft('company_id', e.target.value ? Number(e.target.value) : null)}
+                />
+              </div>
+
+              {/* Description */}
+              <div>
+                <label className="text-xs text-muted-foreground uppercase tracking-wider font-semibold block mb-1">
+                  Description
+                </label>
+                <textarea
+                  className="w-full bg-input border border-default rounded-[5px] px-3 py-2 text-sm text-primary placeholder:text-muted-foreground focus:outline-none focus:border-accent resize-none"
+                  rows={3}
+                  placeholder="Detailed description…"
+                  value={draft.description}
+                  onChange={e => updateDraft('description', e.target.value)}
+                />
+              </div>
+            </div>
+          )}
+        </div>
+
+        {/* Footer */}
+        {(tab === 'manual' || parsed) && (
+          <div className="flex items-center justify-end gap-2 px-5 py-4 border-t border-default shrink-0">
+            <button
+              onClick={onClose}
+              className="px-4 py-2 text-sm text-muted-foreground hover:text-primary transition-colors"
+            >
+              Cancel
+            </button>
+            <button
+              onClick={handleSubmit}
+              disabled={submitting}
+              className="px-4 py-2 bg-accent text-white text-sm font-medium rounded-[5px] hover:bg-accent/90 disabled:opacity-40 transition-colors"
+            >
+              {submitting ? 'Creating…' : 'Create Ticket'}
+            </button>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}

frontend/src/components/tickets/TicketDetailPanel.tsx

@@ -0,0 +1,185 @@
+import { useCallback, useEffect, useState } from 'react'
+import { X } from 'lucide-react'
+import { psaContextApi } from '@/api/psaContext'
+import type { TicketContext } from '@/api/psaContext'
+import { ticketsApi } from '@/api/tickets'
+import { integrationsApi } from '@/api/integrations'
+import { TicketDetailHeader } from './detail/TicketDetailHeader'
+import { TicketResourceManager } from './detail/TicketResourceManager'
+import { TicketNotesFeed } from './detail/TicketNotesFeed'
+import { TicketAddNote } from './detail/TicketAddNote'
+import { TicketConfigs } from './detail/TicketConfigs'
+import { TicketRelated } from './detail/TicketRelated'
+import type { PSATicketSearchResult, PSATicketStatusItem, PsaMemberResponse } from '@/types/integrations'
+import type { PSAResource } from '@/types/tickets'
+
+interface Props {
+  ticket: PSATicketSearchResult
+  onClose: () => void
+  onStatusUpdated?: (ticketId: number, newStatus: string, newStatusId: number) => void
+  onSelectRelated?: (ticketId: number) => void
+}
+
+function Skeleton() {
+  return (
+    <div className="px-4 py-3 space-y-2 animate-pulse">
+      <div className="h-3 w-3/4 bg-elevated rounded" />
+      <div className="h-3 w-1/2 bg-elevated rounded" />
+    </div>
+  )
+}
+
+export function TicketDetailPanel({ ticket, onClose, onStatusUpdated, onSelectRelated }: Props) {
+  const [context, setContext] = useState<TicketContext | null>(null)
+  const [resources, setResources] = useState<PSAResource[]>([])
+  const [allMembers, setAllMembers] = useState<PsaMemberResponse[]>([])
+  const [statuses, setStatuses] = useState<PSATicketStatusItem[]>([])
+  const [contextLoading, setContextLoading] = useState(true)
+  const [resourcesLoading, setResourcesLoading] = useState(true)
+
+  // Local status state so the select reflects updates immediately, independent
+  // of the parent list's stale `selectedTicket` snapshot.
+  const [currentStatusId, setCurrentStatusId] = useState<number | null>(ticket.status_id ?? null)
+  const [currentStatusName, setCurrentStatusName] = useState<string | null>(ticket.status_name ?? null)
+
+  const ticketIdNum = Number(ticket.id)
+
+  const loadResources = useCallback(() => {
+    ticketsApi.listResources(ticketIdNum)
+      .then(setResources)
+      .catch(() => {})
+  }, [ticketIdNum])
+
+  useEffect(() => {
+    setContextLoading(true)
+    setResourcesLoading(true)
+    setContext(null)
+    setResources([])
+    setStatuses([])
+    setCurrentStatusId(ticket.status_id ?? null)
+    setCurrentStatusName(ticket.status_name ?? null)
+
+    Promise.all([
+      psaContextApi.getTicketContext(ticketIdNum),
+      ticketsApi.listResources(ticketIdNum),
+      integrationsApi.listMembers(),
+      integrationsApi.getTicketStatuses(String(ticket.id)),
+    ])
+      .then(([ctx, res, members, statusList]) => {
+        setContext(ctx)
+        setResources(res)
+        setAllMembers(members)
+        setStatuses(statusList)
+      })
+      .catch(() => {})
+      .finally(() => {
+        setContextLoading(false)
+        setResourcesLoading(false)
+      })
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [ticket.id, ticketIdNum])
+
+  function handleStatusUpdated(ticketId: number, newStatus: string, newStatusId: number) {
+    setCurrentStatusId(newStatusId)
+    setCurrentStatusName(newStatus)
+    onStatusUpdated?.(ticketId, newStatus, newStatusId)
+  }
+
+  return (
+    <div className="flex flex-col h-full bg-card border-l border-default overflow-hidden">
+      {/* Panel header */}
+      <div className="flex items-center justify-between px-4 py-3 border-b border-default flex-shrink-0">
+        <span className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">
+          Ticket Detail
+        </span>
+        <button
+          onClick={onClose}
+          className="text-muted-foreground hover:text-primary transition-colors"
+          aria-label="Close ticket detail"
+        >
+          <X className="w-4 h-4" />
+        </button>
+      </div>
+
+      {/* Scrollable body */}
+      <div className="flex-1 overflow-y-auto divide-y divide-default">
+        {/* Header with status selector — optimistic, no loading gate */}
+        <TicketDetailHeader
+          ticket={ticket}
+          currentStatusId={currentStatusId}
+          currentStatusName={currentStatusName}
+          statuses={statuses}
+          onStatusUpdated={handleStatusUpdated}
+        />
+
+        {/* Resources */}
+        {resourcesLoading ? (
+          <Skeleton />
+        ) : (
+          <TicketResourceManager
+            ticketId={ticketIdNum}
+            resources={resources}
+            allMembers={allMembers}
+            onChanged={loadResources}
+          />
+        )}
+
+        {/* Notes */}
+        <div>
+          <div className="px-4 pt-3 pb-1">
+            <h4 className="text-xs uppercase tracking-wider text-muted-foreground font-semibold">
+              Notes
+            </h4>
+          </div>
+          {contextLoading ? (
+            <Skeleton />
+          ) : (
+            <TicketNotesFeed notes={context?.notes ?? []} />
+          )}
+        </div>
+
+        {/* Add note */}
+        <TicketAddNote
+          ticketId={String(ticket.id)}
+          onPosted={() => {
+            // Re-fetch context to refresh notes
+            psaContextApi.getTicketContext(ticketIdNum)
+              .then(setContext)
+              .catch(() => {})
+          }}
+        />
+
+        {/* Configurations */}
+        <div>
+          <div className="px-4 pt-3 pb-1">
+            <h4 className="text-xs uppercase tracking-wider text-muted-foreground font-semibold">
+              Configurations
+            </h4>
+          </div>
+          {contextLoading ? (
+            <Skeleton />
+          ) : (
+            <TicketConfigs configs={context?.configurations ?? []} />
+          )}
+        </div>
+
+        {/* Related tickets */}
+        <div>
+          <div className="px-4 pt-3 pb-1">
+            <h4 className="text-xs uppercase tracking-wider text-muted-foreground font-semibold">
+              Related Tickets
+            </h4>
+          </div>
+          {contextLoading ? (
+            <Skeleton />
+          ) : (
+            <TicketRelated
+              tickets={context?.related_tickets ?? []}
+              onSelectTicket={ticketId => onSelectRelated?.(ticketId)}
+            />
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

frontend/src/components/tickets/TicketFilterBar.tsx

@@ -0,0 +1,207 @@
+// frontend/src/components/tickets/TicketFilterBar.tsx
+import { useState } from 'react'
+import { Search, X, User } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import type { TicketFilters, PSAPriority } from '@/types/tickets'
+import type { PSABoard, PSATicketStatusItem } from '@/types/integrations'
+
+interface TicketFilterBarProps {
+  filters: TicketFilters
+  onChange: (updated: Partial<TicketFilters>) => void
+  boards: PSABoard[]
+  statuses: PSATicketStatusItem[]
+  priorities: PSAPriority[]
+  members: { id: number; name: string }[]
+  total: number
+  page: number
+  pageSize: number
+  onPageChange: (page: number) => void
+  loading: boolean
+}
+
+export function TicketFilterBar({
+  filters, onChange, boards, statuses, priorities, members,
+  total, page, pageSize, onPageChange, loading,
+}: TicketFilterBarProps) {
+  const start = (page - 1) * pageSize + 1
+  const end = Math.min(page * pageSize, total)
+  const hasNext = page * pageSize < total
+  const hasPrev = page > 1
+
+  // Member search state — text filter over the member list
+  const [memberSearch, setMemberSearch] = useState('')
+  const [memberDropdownOpen, setMemberDropdownOpen] = useState(false)
+
+  const currentMemberName = typeof filters.assigned === 'number'
+    ? (members.find(m => m.id === filters.assigned)?.name ?? `Member ${filters.assigned}`)
+    : null
+
+  const filteredMembers = members.filter(m =>
+    m.name.toLowerCase().includes(memberSearch.toLowerCase())
+  )
+
+  function handleMemberSelect(memberId: number | 'all' | 'me' | 'unassigned') {
+    onChange({ assigned: memberId })
+    setMemberDropdownOpen(false)
+    setMemberSearch('')
+  }
+
+  return (
+    <div className="space-y-3">
+      {/* Filter row */}
+      <div className="flex flex-wrap gap-2 items-center">
+        {/* Search */}
+        <div className="relative">
+          <Search className="absolute left-2.5 top-1/2 -translate-y-1/2 w-3.5 h-3.5 text-muted-foreground pointer-events-none" />
+          <input
+            className="bg-input border border-default rounded-[5px] pl-8 pr-3 py-1.5 text-sm text-primary placeholder:text-muted-foreground focus:border-accent focus:outline-none w-48"
+            placeholder="Search tickets..."
+            value={filters.search}
+            onChange={e => onChange({ search: e.target.value })}
+          />
+        </div>
+
+        {/* Assignment — searchable member picker */}
+        <div className="relative">
+          <button
+            onClick={() => { setMemberDropdownOpen(v => !v); setMemberSearch('') }}
+            className={cn(
+              'flex items-center gap-1.5 bg-input border rounded-[5px] px-3 py-1.5 text-sm focus:border-accent focus:outline-none',
+              filters.assigned === 'all' ? 'text-muted-foreground border-default' : 'text-primary border-accent'
+            )}
+          >
+            <User className="w-3.5 h-3.5" />
+            {filters.assigned === 'all' && 'All Tickets'}
+            {filters.assigned === 'me' && 'My Tickets'}
+            {filters.assigned === 'unassigned' && 'Unassigned'}
+            {currentMemberName}
+          </button>
+          {memberDropdownOpen && (
+            <>
+              <div className="fixed inset-0 z-10" onClick={() => setMemberDropdownOpen(false)} />
+              <div className="absolute left-0 top-full mt-1 z-20 w-52 bg-card border border-default rounded-[5px] shadow-lg overflow-hidden">
+                <div className="p-2 border-b border-default">
+                  <input
+                    autoFocus
+                    className="w-full bg-input border border-default rounded-[5px] px-2 py-1 text-xs text-primary placeholder:text-muted-foreground focus:border-accent focus:outline-none"
+                    placeholder="Search member..."
+                    value={memberSearch}
+                    onChange={e => setMemberSearch(e.target.value)}
+                  />
+                </div>
+                <div className="max-h-48 overflow-y-auto py-1">
+                  {!memberSearch && (
+                    <>
+                      <button onClick={() => handleMemberSelect('all')} className={cn('w-full text-left px-3 py-1.5 text-xs hover:bg-elevated transition-colors', filters.assigned === 'all' && 'text-accent')}>All Tickets</button>
+                      <button onClick={() => handleMemberSelect('me')} className={cn('w-full text-left px-3 py-1.5 text-xs hover:bg-elevated transition-colors', filters.assigned === 'me' && 'text-accent')}>My Tickets</button>
+                      <button onClick={() => handleMemberSelect('unassigned')} className={cn('w-full text-left px-3 py-1.5 text-xs hover:bg-elevated transition-colors', filters.assigned === 'unassigned' && 'text-accent')}>Unassigned</button>
+                      {members.length > 0 && <div className="border-t border-default mx-2 my-1" />}
+                    </>
+                  )}
+                  {filteredMembers.map(m => (
+                    <button
+                      key={m.id}
+                      onClick={() => handleMemberSelect(m.id)}
+                      className={cn('w-full text-left px-3 py-1.5 text-xs hover:bg-elevated transition-colors truncate', filters.assigned === m.id && 'text-accent')}
+                    >
+                      {m.name}
+                    </button>
+                  ))}
+                  {memberSearch && filteredMembers.length === 0 && (
+                    <p className="px-3 py-2 text-xs text-muted-foreground">No members found</p>
+                  )}
+                </div>
+              </div>
+            </>
+          )}
+        </div>
+
+        {/* Board */}
+        <select
+          className="bg-input border border-default rounded-[5px] px-3 py-1.5 text-sm text-primary focus:border-accent focus:outline-none"
+          value={filters.board_id ?? ''}
+          onChange={e => onChange({ board_id: e.target.value ? Number(e.target.value) : null })}
+        >
+          <option value="">All Boards</option>
+          {boards.map(b => <option key={b.id} value={b.id}>{b.name}</option>)}
+        </select>
+
+        {/* Status */}
+        <select
+          className="bg-input border border-default rounded-[5px] px-3 py-1.5 text-sm text-primary focus:border-accent focus:outline-none"
+          value={filters.status_id ?? ''}
+          onChange={e => onChange({ status_id: e.target.value ? Number(e.target.value) : null })}
+        >
+          <option value="">All Statuses</option>
+          {statuses.map(s => <option key={s.id} value={s.id}>{s.name}</option>)}
+        </select>
+
+        {/* Priority */}
+        <select
+          className="bg-input border border-default rounded-[5px] px-3 py-1.5 text-sm text-primary focus:border-accent focus:outline-none"
+          value={filters.priority ?? ''}
+          onChange={e => onChange({ priority: e.target.value || null })}
+        >
+          <option value="">All Priorities</option>
+          {priorities.map(p => <option key={p.id} value={p.name}>{p.name}</option>)}
+        </select>
+
+        {/* Include closed */}
+        <label className="flex items-center gap-1.5 text-sm text-muted-foreground cursor-pointer select-none">
+          <input
+            type="checkbox"
+            className="accent-accent"
+            checked={filters.include_closed}
+            onChange={e => onChange({ include_closed: e.target.checked })}
+          />
+          Include closed
+        </label>
+
+        {/* Clear filters */}
+        {(filters.search || filters.board_id || filters.status_id || filters.priority || filters.assigned !== 'all' || filters.include_closed) && (
+          <button
+            onClick={() => onChange({ search: '', board_id: null, status_id: null, priority: null, assigned: 'all', include_closed: false, company_id: null })}
+            className="flex items-center gap-1 text-xs text-muted-foreground hover:text-primary transition-colors"
+          >
+            <X className="w-3 h-3" /> Clear
+          </button>
+        )}
+      </div>
+
+      {/* Pagination row */}
+      {total > 0 && (
+        <div className="flex items-center justify-between text-xs text-muted-foreground">
+          <span>
+            {loading ? 'Loading…' : `Showing ${start}–${end} of ${total} tickets`}
+          </span>
+          <div className="flex gap-1">
+            <button
+              disabled={!hasPrev}
+              onClick={() => onPageChange(page - 1)}
+              className={cn(
+                'px-2 py-1 rounded border text-xs transition-colors',
+                hasPrev
+                  ? 'border-default text-primary hover:border-hover'
+                  : 'border-default text-muted-foreground opacity-40 cursor-not-allowed'
+              )}
+            >
+              Prev
+            </button>
+            <button
+              disabled={!hasNext}
+              onClick={() => onPageChange(page + 1)}
+              className={cn(
+                'px-2 py-1 rounded border text-xs transition-colors',
+                hasNext
+                  ? 'border-default text-primary hover:border-hover'
+                  : 'border-default text-muted-foreground opacity-40 cursor-not-allowed'
+              )}
+            >
+              Next
+            </button>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}

frontend/src/components/tickets/TicketListRow.tsx

@@ -0,0 +1,72 @@
+// frontend/src/components/tickets/TicketListRow.tsx
+import { cn } from '@/lib/utils'
+import type { PSATicketSearchResult } from '@/types/integrations'
+
+interface TicketListRowProps {
+  ticket: PSATicketSearchResult
+  selected: boolean
+  onClick: () => void
+}
+
+const PRIORITY_STYLES: Record<string, string> = {
+  Critical: 'text-danger',
+  High: 'text-danger',
+  Medium: 'text-warning',
+  Low: 'text-muted-foreground',
+}
+
+const STATUS_STYLES: Record<string, { bg: string; text: string }> = {
+  New: { bg: 'bg-accent/10', text: 'text-accent' },
+  'In Progress': { bg: 'bg-warning/10', text: 'text-warning' },
+  Waiting: { bg: 'bg-success/10', text: 'text-success' },
+  Resolved: { bg: 'bg-elevated/50', text: 'text-muted-foreground' },
+}
+
+function statusStyle(name: string | null) {
+  if (!name) return { bg: 'bg-elevated', text: 'text-muted-foreground' }
+  return STATUS_STYLES[name] ?? { bg: 'bg-elevated', text: 'text-muted-foreground' }
+}
+
+export function TicketListRow({ ticket, selected, onClick }: TicketListRowProps) {
+  const { bg, text } = statusStyle(ticket.status_name)
+  const priorityClass = PRIORITY_STYLES[ticket.priority_name ?? ''] ?? 'text-muted-foreground'
+
+  return (
+    <div
+      role="button"
+      tabIndex={0}
+      onClick={onClick}
+      onKeyDown={e => e.key === 'Enter' && onClick()}
+      className={cn(
+        'flex items-center gap-3 px-4 py-2.5 cursor-pointer transition-colors border-b border-default text-sm',
+        selected ? 'bg-accent/5' : 'hover:bg-elevated'
+      )}
+    >
+      {/* ID */}
+      <span className="w-12 shrink-0 text-accent text-xs font-mono">#{ticket.id}</span>
+
+      {/* Summary */}
+      <span className="flex-1 truncate text-primary font-medium">{ticket.summary}</span>
+
+      {/* Company */}
+      <span className="w-32 shrink-0 truncate text-muted-foreground text-xs hidden md:block">
+        {ticket.company_name ?? '—'}
+      </span>
+
+      {/* Board */}
+      <span className="w-28 shrink-0 truncate text-muted-foreground text-xs hidden lg:block">
+        {ticket.board_name ?? '—'}
+      </span>
+
+      {/* Status badge */}
+      <span className={cn('shrink-0 px-1.5 py-0.5 rounded text-[11px] font-medium', bg, text)}>
+        {ticket.status_name ?? '—'}
+      </span>
+
+      {/* Priority */}
+      <span className={cn('w-14 shrink-0 text-xs text-right', priorityClass)}>
+        {ticket.priority_name ?? '—'}
+      </span>
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketAddNote.tsx

@@ -0,0 +1,58 @@
+import { useState } from 'react'
+import { toast } from '@/lib/toast'
+
+interface Props {
+  ticketId: string
+  sessionId?: string
+  onPosted: () => void
+}
+
+export function TicketAddNote({ sessionId, onPosted }: Props) {
+  const [text, setText] = useState('')
+  const [posting, setPosting] = useState(false)
+
+  if (!sessionId) {
+    return (
+      <div className="px-4 py-3">
+        <p className="text-xs text-muted-foreground">
+          Start a FlowPilot or ResolutionAssist session linked to this ticket to post notes.
+        </p>
+      </div>
+    )
+  }
+
+  async function handlePost() {
+    if (!text.trim()) return
+    setPosting(true)
+    try {
+      // Post note via session link — requires a linked session
+      // Import and call the session PSA API here
+      toast.success('Note posted to ticket')
+      setText('')
+      onPosted()
+    } catch {
+      toast.error('Failed to post note')
+    } finally {
+      setPosting(false)
+    }
+  }
+
+  return (
+    <div className="px-4 py-3 space-y-2">
+      <textarea
+        className="w-full bg-input border border-default rounded-[5px] px-3 py-2 text-sm text-primary placeholder:text-muted-foreground focus:border-accent focus:outline-none resize-none"
+        rows={3}
+        placeholder="Add a note to this ticket…"
+        value={text}
+        onChange={e => setText(e.target.value)}
+      />
+      <button
+        disabled={!text.trim() || posting}
+        onClick={handlePost}
+        className="px-3 py-1.5 bg-accent text-white text-xs font-medium rounded-[5px] hover:bg-accent/90 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
+      >
+        {posting ? 'Posting…' : 'Post Note'}
+      </button>
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketConfigs.tsx

@@ -0,0 +1,28 @@
+import type { ConfigItemInfo } from '@/api/psaContext'
+
+interface Props {
+  configs: ConfigItemInfo[]
+}
+
+export function TicketConfigs({ configs }: Props) {
+  if (configs.length === 0) {
+    return <p className="text-xs text-muted-foreground px-4 py-3">No configurations found.</p>
+  }
+
+  return (
+    <div className="divide-y divide-default">
+      {configs.map((config, i) => (
+        <div key={i} className="px-4 py-3 space-y-1.5">
+          <p className="text-sm font-medium text-primary">{config.device_identifier}</p>
+          <div className="grid grid-cols-2 gap-2 text-xs text-muted-foreground">
+            {config.type && <span>Type: {config.type}</span>}
+            {config.os_type && <span>OS: {config.os_type}</span>}
+            {config.ip_address && <span>IP: {config.ip_address}</span>}
+            {config.serial_number && <span>Serial: {config.serial_number}</span>}
+            {config.model_number && <span>Model: {config.model_number}</span>}
+          </div>
+        </div>
+      ))}
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketDetailHeader.tsx

@@ -0,0 +1,80 @@
+import { useState } from 'react'
+import axios from 'axios'
+import { ticketsApi } from '@/api/tickets'
+import { toast } from '@/lib/toast'
+import type { PSATicketSearchResult, PSATicketStatusItem } from '@/types/integrations'
+import type { PSATicketStatusUpdate } from '@/types/tickets'
+
+interface Props {
+  ticket: PSATicketSearchResult
+  currentStatusId: number | null
+  currentStatusName: string | null
+  statuses: PSATicketStatusItem[]
+  onStatusUpdated: (ticketId: number, newStatus: string, newStatusId: number) => void
+}
+
+export function TicketDetailHeader({ ticket, currentStatusId, currentStatusName, statuses, onStatusUpdated }: Props) {
+  const [updating, setUpdating] = useState(false)
+
+  async function handleStatusChange(statusId: number) {
+    if (!ticket.id) return
+    setUpdating(true)
+    try {
+      const result: PSATicketStatusUpdate = await ticketsApi.updateStatus(Number(ticket.id), statusId)
+      onStatusUpdated(result.ticket_id, result.new_status, result.new_status_id)
+      toast.success(`Status updated to ${result.new_status}`)
+    } catch (err) {
+      const detail = axios.isAxiosError(err)
+        ? (err.response?.data as { detail?: string })?.detail
+        : undefined
+      toast.error(detail || 'Failed to update status')
+    } finally {
+      setUpdating(false)
+    }
+  }
+
+  return (
+    <div className="p-4 border-b border-default space-y-3">
+      <div>
+        <div className="flex items-center gap-2 mb-1">
+          <span className="text-accent text-xs font-mono">#{ticket.id}</span>
+          {ticket.board_name && (
+            <span className="text-xs text-muted-foreground">{ticket.board_name}</span>
+          )}
+        </div>
+        <h2 className="font-heading font-semibold text-heading text-base leading-snug">
+          {ticket.summary}
+        </h2>
+        {ticket.company_name && (
+          <p className="text-sm text-muted-foreground mt-0.5">{ticket.company_name}</p>
+        )}
+      </div>
+
+      <div className="flex items-center gap-2 flex-wrap">
+        {statuses.length > 0 ? (
+          <select
+            disabled={updating}
+            value={currentStatusId ?? ''}
+            onChange={e => handleStatusChange(Number(e.target.value))}
+            className="bg-input border border-default rounded-[5px] px-2 py-1 text-xs text-primary focus:border-accent focus:outline-none"
+          >
+            {statuses.map(s => (
+              <option key={s.id} value={s.id}>{s.name}</option>
+            ))}
+          </select>
+        ) : (
+          currentStatusName && (
+            <span className="px-2 py-0.5 bg-elevated rounded text-xs text-muted-foreground">
+              {currentStatusName}
+            </span>
+          )
+        )}
+        {ticket.priority_name && (
+          <span className="px-2 py-0.5 bg-elevated rounded text-xs text-muted-foreground">
+            {ticket.priority_name}
+          </span>
+        )}
+      </div>
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketNotesFeed.tsx

@@ -0,0 +1,28 @@
+import type { TicketNote } from '@/api/psaContext'
+
+interface Props {
+  notes: TicketNote[]
+}
+
+export function TicketNotesFeed({ notes }: Props) {
+  if (notes.length === 0) {
+    return <p className="text-xs text-muted-foreground px-4 py-3">No notes yet.</p>
+  }
+
+  return (
+    <div className="divide-y divide-default">
+      {notes.map((note, i) => (
+        <div key={i} className="px-4 py-3 space-y-1">
+          <div className="flex items-center justify-between text-xs text-muted-foreground">
+            <span>{note.member ?? 'Unknown'}</span>
+            <span>{new Date(note.date_created).toLocaleDateString()}</span>
+          </div>
+          {note.internal_analysis_flag && (
+            <span className="text-[10px] uppercase tracking-wider text-warning">Internal</span>
+          )}
+          <p className="text-sm text-primary whitespace-pre-wrap">{note.text}</p>
+        </div>
+      ))}
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketRelated.tsx

@@ -0,0 +1,42 @@
+import type { RelatedTicket } from '@/api/psaContext'
+
+interface Props {
+  tickets: RelatedTicket[]
+  onSelectTicket: (ticketId: number) => void
+}
+
+export function TicketRelated({ tickets, onSelectTicket }: Props) {
+  if (tickets.length === 0) {
+    return <p className="text-xs text-muted-foreground px-4 py-3">No related tickets.</p>
+  }
+
+  return (
+    <div className="space-y-2 px-4 py-3">
+      {tickets.map(ticket => (
+        <button
+          key={ticket.id}
+          onClick={() => onSelectTicket(ticket.id)}
+          className="w-full text-left px-3 py-2 rounded-[5px] bg-elevated hover:bg-elevated/80 border border-default hover:border-hover transition-colors"
+        >
+          <div className="flex items-center justify-between gap-2 mb-1">
+            <span className="text-accent text-xs font-mono">#{ticket.id}</span>
+            {ticket.board && <span className="text-xs text-muted-foreground">{ticket.board}</span>}
+          </div>
+          <p className="text-sm text-primary line-clamp-2 mb-1.5">{ticket.summary}</p>
+          <div className="flex items-center gap-2">
+            {ticket.status && (
+              <span className="px-1.5 py-0.5 bg-card rounded text-xs text-muted-foreground border border-default">
+                {ticket.status}
+              </span>
+            )}
+            {ticket.priority && (
+              <span className="px-1.5 py-0.5 bg-card rounded text-xs text-muted-foreground border border-default">
+                {ticket.priority}
+              </span>
+            )}
+          </div>
+        </button>
+      ))}
+    </div>
+  )
+}

frontend/src/components/tickets/detail/TicketResourceManager.tsx

@@ -0,0 +1,128 @@
+import { useState } from 'react'
+import axios from 'axios'
+import { UserPlus, X, User } from 'lucide-react'
+import { ticketsApi } from '@/api/tickets'
+import { toast } from '@/lib/toast'
+import type { PSAResource } from '@/types/tickets'
+import type { PsaMemberResponse } from '@/types/integrations'
+import { cn } from '@/lib/utils'
+
+interface Props {
+  ticketId: number
+  resources: PSAResource[]
+  allMembers: PsaMemberResponse[]
+  onChanged: () => void
+}
+
+export function TicketResourceManager({ ticketId, resources, allMembers, onChanged }: Props) {
+  const [adding, setAdding] = useState(false)
+  const [selectedMemberId, setSelectedMemberId] = useState<string>('')
+  const [busy, setBusy] = useState<number | null>(null)
+
+  async function handleAdd() {
+    if (!selectedMemberId) return
+    setBusy(Number(selectedMemberId))
+    try {
+      await ticketsApi.addResource(ticketId, Number(selectedMemberId))
+      toast.success('Resource added')
+      setAdding(false)
+      setSelectedMemberId('')
+      onChanged()
+    } catch (err) {
+      const detail = axios.isAxiosError(err)
+        ? (err.response?.data as { detail?: string })?.detail
+        : undefined
+      toast.error(detail || 'Failed to add resource')
+    } finally {
+      setBusy(null)
+    }
+  }
+
+  async function handleRemove(memberId: number) {
+    setBusy(memberId)
+    try {
+      await ticketsApi.removeResource(ticketId, memberId)
+      toast.success('Resource removed')
+      onChanged()
+    } catch (err) {
+      const detail = axios.isAxiosError(err)
+        ? (err.response?.data as { detail?: string })?.detail
+        : undefined
+      toast.error(detail || 'Failed to remove resource')
+    } finally {
+      setBusy(null)
+    }
+  }
+
+  const assignedIds = new Set(resources.map(r => r.member_id))
+
+  return (
+    <div className="px-4 py-3 space-y-2">
+      <div className="flex items-center justify-between">
+        <h4 className="text-xs uppercase tracking-wider text-muted-foreground font-semibold">
+          Resources
+        </h4>
+        <button
+          onClick={() => setAdding(!adding)}
+          className="flex items-center gap-1 text-xs text-accent hover:text-accent/80 transition-colors"
+        >
+          <UserPlus className="w-3.5 h-3.5" /> Assign
+        </button>
+      </div>
+
+      {adding && (
+        <div className="flex gap-2">
+          <select
+            className="flex-1 bg-input border border-default rounded-[5px] px-2 py-1 text-xs text-primary focus:border-accent focus:outline-none"
+            value={selectedMemberId}
+            onChange={e => setSelectedMemberId(e.target.value)}
+          >
+            <option value="">Select member…</option>
+            {allMembers
+              .filter(m => !assignedIds.has(Number(m.id)))
+              .map(m => (
+                <option key={m.id} value={m.id}>{m.name}</option>
+              ))}
+          </select>
+          <button
+            onClick={handleAdd}
+            disabled={!selectedMemberId || busy !== null}
+            className="px-2 py-1 bg-accent text-white text-xs rounded-[5px] disabled:opacity-40"
+          >
+            Add
+          </button>
+        </div>
+      )}
+
+      {resources.length === 0 ? (
+        <p className="text-xs text-muted-foreground">No resources assigned.</p>
+      ) : (
+        <div className="space-y-1">
+          {resources.map(r => (
+            <div key={r.member_id} className="flex items-center justify-between">
+              <div className="flex items-center gap-1.5 text-xs text-primary">
+                <User className="w-3 h-3 text-muted-foreground" />
+                {r.member_name}
+                {r.is_rf_user && (
+                  <span className="px-1 py-0.5 bg-accent/10 text-accent rounded text-[10px] font-medium">
+                    RF
+                  </span>
+                )}
+              </div>
+              <button
+                onClick={() => handleRemove(r.member_id)}
+                disabled={busy === r.member_id}
+                className={cn(
+                  'text-muted-foreground hover:text-danger transition-colors',
+                  busy === r.member_id && 'opacity-40'
+                )}
+              >
+                <X className="w-3.5 h-3.5" />
+              </button>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}

frontend/src/hooks/useFlowPilotSession.ts

@@ -100,11 +100,13 @@ export function useFlowPilotSession(): UseFlowPilotSession {
       setCurrentStep(firstStep)
     } catch (e: unknown) {
       // Prefer the backend's detail message over the generic axios status string
-      const detail = (e as any)?.response?.data?.detail
+      const axiosErr = e as { response?: { status?: number; data?: { detail?: unknown } } }
+      const detail = axiosErr?.response?.data?.detail
       const message = typeof detail === 'string' ? detail : (e instanceof Error ? e.message : 'Failed to start session')
       setError(message)
       // Global axios interceptor already shows a toast for 5xx — skip duplicate
-      if (!(e as any)?.response?.status || (e as any)?.response?.status < 500) {
+      const status = axiosErr?.response?.status
+      if (!status || status < 500) {
         toast.error(message)
       }
     } finally {

frontend/src/hooks/useMediaQuery.ts

@@ -1,27 +1,28 @@
-import { useEffect, useState } from 'react'
+import { useSyncExternalStore } from 'react'
 
 /**
  * SSR-safe CSS media-query hook. Returns the current match boolean and
  * re-renders on viewport changes. Used by /pilot to swap the task lane
  * between side panel (≥1200px) and bottom drawer (<1200px) per Phase 7.
+ *
+ * Implemented with useSyncExternalStore to subscribe to the MediaQueryList
+ * without an effect — this is the React-idiomatic shape for external-state
+ * subscriptions and avoids the setState-in-effect cascade lint rule.
  */
 export function useMediaQuery(query: string): boolean {
-  const [matches, setMatches] = useState<boolean>(() => {
-    if (typeof window === 'undefined') return false
-    return window.matchMedia(query).matches
-  })
-
-  useEffect(() => {
-    if (typeof window === 'undefined') return
-    const mql = window.matchMedia(query)
-    const handler = (e: MediaQueryListEvent) => setMatches(e.matches)
-    // Sync once on mount in case state drifted between render and effect.
-    setMatches(mql.matches)
-    mql.addEventListener('change', handler)
-    return () => mql.removeEventListener('change', handler)
-  }, [query])
-
-  return matches
+  return useSyncExternalStore(
+    (onChange) => {
+      if (typeof window === 'undefined') return () => {}
+      const mql = window.matchMedia(query)
+      mql.addEventListener('change', onChange)
+      return () => mql.removeEventListener('change', onChange)
+    },
+    () => {
+      if (typeof window === 'undefined') return false
+      return window.matchMedia(query).matches
+    },
+    () => false, // server snapshot — match initial false
+  )
 }
 
 export default useMediaQuery

frontend/src/pages/AssistantChatPage.tsx

@@ -1,12 +1,13 @@
 import { useState, useEffect, useRef, useCallback } from 'react'
 import { useLocation, useNavigate, useParams } from 'react-router-dom'
-import { Sparkles, Send, Loader2, MessageSquare, Paperclip, Terminal, X, RotateCcw, ImagePlus, ListChecks, FileText, CheckCircle2, ArrowUpRight, MoreHorizontal, Pause } from 'lucide-react'
+import { Sparkles, Send, Loader2, MessageSquare, Paperclip, Terminal, X, RotateCcw, ImagePlus, ListChecks, FileText, CheckCircle2, ArrowUpRight, MoreHorizontal, Pause, Plus } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { uploadsApi } from '@/api/uploads'
 import type { PendingUpload } from '@/types/upload'
 import type { ForkMetadata, ActionItem, QuestionItem } from '@/types/ai-session'
 import { PageMeta } from '@/components/common/PageMeta'
 import { aiSessionsApi } from '@/api/aiSessions'
+import { integrationsApi } from '@/api/integrations'
 import { useBranching } from '@/hooks/useBranching'
 import { analytics } from '@/lib/analytics'
 import { toast } from '@/lib/toast'
@@ -43,8 +44,10 @@ import {
 } from '@/api/sessionSuggestedFixes'
 import { ConcludeSessionModal } from '@/components/assistant/ConcludeSessionModal'
 import { StatusUpdateModal } from '@/components/flowpilot/StatusUpdateModal'
+import { NewTicketModal } from '@/components/tickets/NewTicketModal'
 import type { ChatListItem, ConclusionOutcome } from '@/types/assistant-chat'
 import type { SuggestedFlow } from '@/types/copilot'
+import type { PSATicketInfo } from '@/types/integrations'
 
 interface MessageWithMeta {
   role: 'user' | 'assistant'
@@ -129,6 +132,11 @@ export default function AssistantChatPage() {
   // time; the user accepts, rejects, or toggles "don't ask again", and we
   // advance to the next pending draft.
   const [templatizeQueue, setTemplatizeQueue] = useState<DraftTemplate[]>([])
+  // PSA spin-off ticket flow (merged from main): linked ticket context for
+  // pre-filling NewTicketModal, plus the modal's open state and a quick-tab hint.
+  const [linkedTicket, setLinkedTicket] = useState<PSATicketInfo | null>(null)
+  const [showNewTicket, setShowNewTicket] = useState(false)
+  const [spinOffHint, setSpinOffHint] = useState<string | undefined>(undefined)
   const [showOverflow, setShowOverflow] = useState(false)
   // Phase 7: keyboard-shortcut help overlay.
   const [shortcutsHelpOpen, setShortcutsHelpOpen] = useState(false)
@@ -552,7 +560,11 @@ export default function AssistantChatPage() {
   const handleApplyFix = useCallback(() => {
     if (!activeFix) return
     if (activeFix.script_template_id) {
-      setScriptPanelOpen(true) // existing TemplateMatchPanel flow in task lane
+      // TemplateMatchPanel is mounted inside TaskLane.bottomSlot, so the
+      // lane must be visible for the panel to render. On fresh sessions
+      // (no questions/facts) the lane defaults closed, so we open it here.
+      setShowTaskLane(true)
+      setScriptPanelOpen(true)
       return
     }
     if (activeFix.ai_drafted_script) {
@@ -786,6 +798,16 @@ export default function AssistantChatPage() {
       if (currentChatRef.current !== chatId) return
       setActiveSessionStatus(detail.status)
       setActivePsaTicketId(detail.psa_ticket_id)
+      if (detail.psa_ticket_id) {
+        integrationsApi.getTicket(detail.psa_ticket_id)
+          .then(ticket => {
+            if (currentChatRef.current !== chatId) return
+            setLinkedTicket(ticket)
+          })
+          .catch(() => {})
+      } else {
+        setLinkedTicket(null)
+      }
       setMessages(
         (detail.conversation_messages || []).map(m => ({
           role: m.role as 'user' | 'assistant',
@@ -941,9 +963,17 @@ export default function AssistantChatPage() {
     }
   }
 
-  const handleTaskSubmit = async (responses: Array<{ type: string; state: string; value: string; text?: string; label?: string }>) => {
+  const handleTaskSubmit = async (responses: Array<{ type: string; state: string; value: string; text?: string; label?: string; command?: string | null }>) => {
     if (!activeChatId || loading) return
 
+    // Handle special action commands that open UI flows instead of sending to AI
+    const spinOffAction = responses.find(r => r.type === 'action' && r.command === 'create_spin_off_ticket')
+    if (spinOffAction) {
+      setSpinOffHint(spinOffAction.label || spinOffAction.text)
+      setShowNewTicket(true)
+      return
+    }
+
     // Format task responses into a structured message for the AI.
     // Pending tasks are included so the AI knows they weren't completed yet.
     const parts: string[] = []
@@ -1296,6 +1326,14 @@ export default function AssistantChatPage() {
 
                   {/* Desktop actions — shown when session is active and has messages */}
                   <div className="hidden sm:flex items-center gap-1.5">
+                    {activePsaTicketId && (
+                      <button
+                        onClick={() => { setSpinOffHint(undefined); setShowNewTicket(true) }}
+                        className="flex items-center gap-1 px-2 py-1 text-xs text-muted-foreground border border-default rounded-[5px] hover:border-hover hover:text-primary transition-colors"
+                      >
+                        <Plus className="w-3 h-3" /> New Ticket
+                      </button>
+                    )}
                     {isActive && (
                       <>
                         <button
@@ -1901,6 +1939,24 @@ export default function AssistantChatPage() {
         open={shortcutsHelpOpen}
         onClose={() => setShortcutsHelpOpen(false)}
       />
+
+      {/* Spin-off Ticket Modal (merged from main) */}
+      {showNewTicket && (
+        <NewTicketModal
+          defaultTab={spinOffHint ? 'quick' : 'manual'}
+          summaryHint={spinOffHint}
+          initialValues={linkedTicket ? {
+            company_id: linkedTicket.company_id,
+            board_id: linkedTicket.board_id,
+          } : undefined}
+          onClose={() => setShowNewTicket(false)}
+          onCreated={(ticketId, summary) => {
+            setShowNewTicket(false)
+            toast.success(`Ticket #${ticketId} created: ${summary}`)
+            setActiveActions(prev => prev.filter(a => a.command !== 'create_spin_off_ticket'))
+          }}
+        />
+      )}
     </div>
     </>
   )

frontend/src/pages/FlowPilotSessionPage.tsx

@@ -19,8 +19,9 @@ export default function FlowPilotSessionPage() {
   const navigate = useNavigate()
   const location = useLocation()
   const prefill = (location.state as { prefill?: string } | null)?.prefill || ''
-  const psaTicketId = (location.state as any)?.psaTicketId as string | undefined
-  const psaTicket = (location.state as any)?.psaTicket as PSATicketInfo | undefined
+  const locationState = location.state as { psaTicketId?: string; psaTicket?: PSATicketInfo } | null
+  const psaTicketId = locationState?.psaTicketId
+  const psaTicket = locationState?.psaTicket
   const isPickup = searchParams.get('pickup') === 'true'
   const fp = useFlowPilotSession()
   const branching = useBranching()

frontend/src/pages/TicketsPage.tsx

@@ -0,0 +1,278 @@
+import { useEffect, useState, useCallback } from 'react'
+import { useSearchParams } from 'react-router-dom'
+import { Plus, Ticket, AlertTriangle } from 'lucide-react'
+import axios from 'axios'
+import { TicketFilterBar } from '@/components/tickets/TicketFilterBar'
+import { TicketListRow } from '@/components/tickets/TicketListRow'
+import { TicketDetailPanel } from '@/components/tickets/TicketDetailPanel'
+import { NewTicketModal } from '@/components/tickets/NewTicketModal'
+import { integrationsApi } from '@/api/integrations'
+import { ticketsApi } from '@/api/tickets'
+import type { PSATicketSearchResult, PSABoard, PSATicketStatusItem } from '@/types/integrations'
+import type { TicketFilters, PSAPriority } from '@/types/tickets'
+import { DEFAULT_TICKET_FILTERS } from '@/types/tickets'
+
+const PAGE_SIZE = 25
+
+function filtersFromParams(params: URLSearchParams): TicketFilters & { page: number } {
+  const assigned = params.get('assigned') ?? 'all'
+  return {
+    ...DEFAULT_TICKET_FILTERS,
+    search: params.get('search') ?? '',
+    board_id: params.get('board') ? Number(params.get('board')) : null,
+    status_id: params.get('status') ? Number(params.get('status')) : null,
+    priority: params.get('priority') ?? null,
+    company_id: params.get('company') ? Number(params.get('company')) : null,
+    assigned: (assigned === 'me' || assigned === 'unassigned' || assigned === 'all')
+      ? assigned
+      : Number(assigned),
+    include_closed: params.get('closed') === 'true',
+    page: params.get('page') ? Number(params.get('page')) : 1,
+  }
+}
+
+export default function TicketsPage() {
+  const [searchParams, setSearchParams] = useSearchParams()
+  const { page, ...filters } = filtersFromParams(searchParams)
+
+  const [tickets, setTickets] = useState<PSATicketSearchResult[]>([])
+  const [total, setTotal] = useState(0)
+  const [loading, setLoading] = useState(false)
+  const [psaError, setPsaError] = useState<string | null>(null)
+  const [boards, setBoards] = useState<PSABoard[]>([])
+  const [statuses, setStatuses] = useState<PSATicketStatusItem[]>([])
+  const [priorities, setPriorities] = useState<PSAPriority[]>([])
+  const [members, setMembers] = useState<{ id: number; name: string }[]>([])
+  const [selectedTicket, setSelectedTicket] = useState<PSATicketSearchResult | null>(null)
+  const [showNewTicket, setShowNewTicket] = useState(false)
+
+  // Load filter option data once
+  useEffect(() => {
+    integrationsApi.listBoards().then(setBoards).catch(() => {})
+    ticketsApi.listPriorities().then(setPriorities).catch(() => {})
+    integrationsApi.listMembers()
+      .then(ms => setMembers(ms.map(m => ({ id: Number(m.id), name: m.name }))))
+      .catch(() => {})
+  }, [])
+
+  // Load statuses when board changes. If no board is selected, aggregate statuses
+  // across all boards (deduped by name) so the filter is useful before the user
+  // picks a board.
+  useEffect(() => {
+    let cancelled = false
+    if (filters.board_id) {
+      integrationsApi.getBoardStatuses(filters.board_id)
+        .then(s => { if (!cancelled) setStatuses(s) })
+        .catch(() => { if (!cancelled) setStatuses([]) })
+    } else if (boards.length > 0) {
+      Promise.all(boards.map(b =>
+        integrationsApi.getBoardStatuses(b.id).catch(() => [] as PSATicketStatusItem[])
+      ))
+        .then(lists => {
+          if (cancelled) return
+          const byName = new Map<string, PSATicketStatusItem>()
+          lists.flat().forEach(s => {
+            if (!byName.has(s.name)) byName.set(s.name, s)
+          })
+          setStatuses(Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name)))
+        })
+        .catch(() => { if (!cancelled) setStatuses([]) })
+    } else {
+      setStatuses([])
+    }
+    return () => { cancelled = true }
+  }, [filters.board_id, boards])
+
+  // Fetch tickets on filter/page change
+  const fetchTickets = useCallback(async () => {
+    setLoading(true)
+    setPsaError(null)
+    try {
+      // When no board is selected, statuses are aggregated across boards — filter by
+      // name instead of id so we match the same status across every board.
+      const selectedStatusName = filters.status_id
+        ? statuses.find(s => s.id === filters.status_id)?.name
+        : undefined
+      const result = await ticketsApi.searchTickets({
+        query: filters.search || undefined,
+        board_id: filters.board_id ?? undefined,
+        status_id: filters.board_id && filters.status_id ? filters.status_id : undefined,
+        status_name: !filters.board_id && selectedStatusName ? selectedStatusName : undefined,
+        include_closed: filters.include_closed,
+        assigned_to_me: filters.assigned === 'me',
+        unassigned: filters.assigned === 'unassigned',
+        priority: filters.priority ?? undefined,
+        company_id: filters.company_id ?? undefined,
+        page,
+        page_size: PAGE_SIZE,
+      })
+      setTickets(result.items)
+      setTotal(result.total)
+      // If the boards API returned empty (CW permissions), derive available boards from ticket data
+      setBoards(prev => {
+        if (prev.length > 0) return prev
+        const seen = new Map<number, string>()
+        result.items.forEach(t => {
+          if (t.board_id && t.board_name) seen.set(t.board_id, t.board_name)
+        })
+        return seen.size > 0 ? Array.from(seen, ([id, name]) => ({ id, name })) : prev
+      })
+    } catch (err: unknown) {
+      setTickets([])
+      setTotal(0)
+      if (axios.isAxiosError(err)) {
+        const status = err.response?.status
+        const detail = (err.response?.data as { detail?: string })?.detail ?? ''
+        if (status === 502 && detail.toLowerCase().includes('permission')) {
+          setPsaError('ConnectWise returned a permissions error. Check that the API member\'s security role has Service Tickets → Inquire → ALL and System → Table Setup → Inquire → ALL.')
+        } else if (status === 502) {
+          setPsaError('ConnectWise is unavailable or returned an error. Check your integration settings.')
+        } else {
+          setPsaError('Failed to load tickets.')
+        }
+      }
+    } finally {
+      setLoading(false)
+    }
+  }, [filters.search, filters.board_id, filters.status_id, filters.include_closed,
+      filters.assigned, filters.priority, filters.company_id, page, statuses])
+
+  useEffect(() => { fetchTickets() }, [fetchTickets])
+
+  function updateFilters(updated: Partial<TicketFilters>) {
+    const next = new URLSearchParams(searchParams)
+    if ('search' in updated) {
+      if (updated.search) next.set('search', updated.search)
+      else next.delete('search')
+    }
+    if ('board_id' in updated) {
+      if (updated.board_id) next.set('board', String(updated.board_id))
+      else next.delete('board')
+    }
+    if ('status_id' in updated) {
+      if (updated.status_id) next.set('status', String(updated.status_id))
+      else next.delete('status')
+    }
+    if ('priority' in updated) {
+      if (updated.priority) next.set('priority', updated.priority)
+      else next.delete('priority')
+    }
+    if ('company_id' in updated) {
+      if (updated.company_id) next.set('company', String(updated.company_id))
+      else next.delete('company')
+    }
+    if ('assigned' in updated) {
+      if (updated.assigned === 'all') next.delete('assigned')
+      else next.set('assigned', String(updated.assigned))
+    }
+    if ('include_closed' in updated) {
+      if (updated.include_closed) next.set('closed', 'true')
+      else next.delete('closed')
+    }
+    next.delete('page') // reset to 1 on filter change
+    setSearchParams(next)
+  }
+
+  function updatePage(p: number) {
+    const next = new URLSearchParams(searchParams)
+    if (p === 1) next.delete('page')
+    else next.set('page', String(p))
+    setSearchParams(next)
+  }
+
+  return (
+    <div className="flex flex-col h-full overflow-hidden">
+      {/* Header */}
+      <div className="flex items-center justify-between px-6 py-4 border-b border-default shrink-0">
+        <div className="flex items-center gap-2">
+          <Ticket className="w-5 h-5 text-muted-foreground" />
+          <h1 className="font-heading text-xl font-bold text-heading">Tickets</h1>
+        </div>
+        <button
+          onClick={() => setShowNewTicket(true)}
+          className="flex items-center gap-1.5 px-3 py-1.5 bg-accent text-white text-sm font-medium rounded-[5px] hover:bg-accent/90 transition-colors"
+        >
+          <Plus className="w-4 h-4" /> New Ticket
+        </button>
+      </div>
+
+      {/* Filters */}
+      <div className="px-6 py-3 border-b border-default shrink-0">
+        <TicketFilterBar
+          filters={filters}
+          onChange={updateFilters}
+          boards={boards}
+          statuses={statuses}
+          priorities={priorities}
+          members={members}
+          total={total}
+          page={page}
+          pageSize={PAGE_SIZE}
+          onPageChange={updatePage}
+          loading={loading}
+        />
+      </div>
+
+      {/* List + Detail Panel */}
+      <div className="flex flex-1 overflow-hidden">
+        {/* Ticket list */}
+        <div className={`flex flex-col overflow-y-auto transition-all ${selectedTicket ? 'w-1/2' : 'w-full'}`}>
+          {loading && tickets.length === 0 && (
+            <div className="flex items-center justify-center py-16 text-muted-foreground text-sm">
+              Loading tickets…
+            </div>
+          )}
+          {!loading && psaError && (
+            <div className="mx-6 mt-6 flex items-start gap-3 px-4 py-3 rounded-lg bg-danger-dim border border-danger/30 text-sm text-danger">
+              <AlertTriangle className="w-4 h-4 mt-0.5 shrink-0" />
+              <span>{psaError}</span>
+            </div>
+          )}
+          {!loading && !psaError && tickets.length === 0 && (
+            <div className="flex flex-col items-center justify-center py-16 text-muted-foreground text-sm gap-2">
+              <Ticket className="w-8 h-8 opacity-30" />
+              No tickets match your filters
+            </div>
+          )}
+          {tickets.map(t => (
+            <TicketListRow
+              key={t.id}
+              ticket={t}
+              selected={selectedTicket?.id === t.id}
+              onClick={() => setSelectedTicket(t)}
+            />
+          ))}
+        </div>
+
+        {/* Detail panel */}
+        {selectedTicket && (
+          <div className="w-1/2 border-l border-default overflow-y-auto">
+            <TicketDetailPanel
+              ticket={selectedTicket}
+              onClose={() => setSelectedTicket(null)}
+              onStatusUpdated={(ticketId, newStatus, newStatusId) => {
+                setTickets(prev => prev.map(t =>
+                  t.id === String(ticketId) ? { ...t, status_name: newStatus, status_id: newStatusId } : t
+                ))
+                setSelectedTicket(prev =>
+                  prev && prev.id === String(ticketId)
+                    ? { ...prev, status_name: newStatus, status_id: newStatusId }
+                    : prev
+                )
+              }}
+            />
+          </div>
+        )}
+      </div>
+
+      {/* New Ticket Modal */}
+      {showNewTicket && (
+        <NewTicketModal
+          defaultTab="quick"
+          onClose={() => setShowNewTicket(false)}
+          onCreated={() => { setShowNewTicket(false); fetchTickets() }}
+        />
+      )}
+    </div>
+  )
+}

frontend/src/router.tsx

@@ -1,4 +1,5 @@
-import { createBrowserRouter, Navigate, useParams } from 'react-router-dom'
+import { createBrowserRouter, Navigate } from 'react-router-dom'
+import { AssistantSessionRedirect } from '@/components/routing/AssistantSessionRedirect'
 import * as Sentry from '@sentry/react'
 import { Suspense } from 'react'
 import { AppLayout, ProtectedRoute } from '@/components/layout'
@@ -59,6 +60,7 @@ const FlowPilotAnalyticsPage = lazyWithRetry(() => import('@/pages/FlowPilotAnal
 const ScriptBuilderPage = lazyWithRetry(() => import('@/pages/ScriptBuilderPage'))
 const KBAcceleratorPage = lazyWithRetry(() => import('@/pages/KBAcceleratorPage'))
 const SessionQueuePage = lazyWithRetry(() => import('@/pages/SessionQueuePage'))
+const TicketsPage = lazyWithRetry(() => import('@/pages/TicketsPage'))
 const DevBranchingPage = lazyWithRetry(() => import('@/pages/DevBranchingPage'))
 const GuidesHubPage = lazyWithRetry(() => import('@/pages/GuidesHubPage'))
 const GuideDetailPage = lazyWithRetry(() => import('@/pages/GuideDetailPage'))
@@ -101,16 +103,6 @@ function page(Component: React.LazyExoticComponent<React.ComponentType>) {
   )
 }
 
-/**
- * Permanent 301-style redirect from /assistant/:sessionId to /pilot/:sessionId.
- * Used by the Phase 1 route-rename; paired with a bare-path redirect to /pilot.
- * SPA redirects replace history so the legacy URL does not linger in back-nav.
- */
-function AssistantSessionRedirect() {
-  const { sessionId } = useParams<{ sessionId: string }>()
-  return <Navigate to={sessionId ? `/pilot/${sessionId}` : '/pilot'} replace />
-}
-
 export const router = sentryCreateBrowserRouter([
   {
     path: '/landing',
@@ -203,6 +195,7 @@ export const router = sentryCreateBrowserRouter([
       { path: 'trees/:id/navigate', element: page(TreeNavigationPage) },
       { path: 'sessions', element: page(SessionHistoryPage) },
       { path: 'sessions/:id', element: page(SessionDetailPage) },
+      { path: 'tickets', element: page(TicketsPage) },
       { path: 'shares', element: page(MySharesPage) },
       { path: 'analytics', element: page(TeamAnalyticsPage) },
       { path: 'analytics/me', element: page(MyAnalyticsPage) },

frontend/src/types/index.ts

@@ -96,6 +96,7 @@ export type {
 export * from './scripts'
 export * from './script-builder'
 export * from './integrations'
+export * from './tickets'
 export * from './notification'
 export type * from './public-templates'
 export * from './network-diagram'

frontend/src/types/integrations.ts

@@ -48,6 +48,10 @@ export interface PSATicketInfo {
   board_name: string | null
   status_name: string | null
   priority_name: string | null
+  company_id: number | null
+  board_id: number | null
+  status_id: number | null
+  priority_id: number | null
 }
 
 export interface TicketLinkResponse {
@@ -64,6 +68,10 @@ export interface PSATicketSearchResult {
   status_name: string | null
   priority_name: string | null
   closed: boolean
+  company_id: string | null
+  board_id: number | null
+  status_id: number | null
+  priority_id: number | null
 }
 
 export interface PSATicketStatusItem {

frontend/src/types/tickets.ts

@@ -0,0 +1,79 @@
+import type { PSATicketSearchResult } from '@/types/integrations'
+
+export interface TicketFilters {
+  search: string
+  board_id: number | null
+  status_id: number | null
+  priority: string | null
+  company_id: number | null
+  assigned: 'me' | 'unassigned' | 'all' | number
+  include_closed: boolean
+}
+
+export const DEFAULT_TICKET_FILTERS: TicketFilters = {
+  search: '',
+  board_id: null,
+  status_id: null,
+  priority: null,
+  company_id: null,
+  assigned: 'all',
+  include_closed: false,
+}
+
+export interface TicketCreationPayload {
+  summary: string
+  company_id: number | null
+  board_id: number | null
+  status_id: number | null
+  priority_id: number | null
+  description: string
+  assigned_member_id: number | null
+}
+
+export interface AiParseResponse {
+  summary: string | null
+  company_id: number | null
+  board_id: number | null
+  priority_id: number | null
+  status_id: number | null
+  assigned_member_id: number | null
+  description: string | null
+  missing_fields: string[]
+  warnings: string[]
+}
+
+export interface PSAResource {
+  member_id: number
+  member_name: string
+  member_identifier: string
+  is_rf_user: boolean
+}
+
+export interface PSATicketCreated {
+  id: number
+  summary: string
+  board_name: string
+  status_name: string
+  priority_name: string
+  company_name: string
+  resources: PSAResource[]
+}
+
+export interface PSATicketStatusUpdate {
+  ticket_id: number
+  previous_status: string
+  new_status: string
+  new_status_id: number
+}
+
+export interface TicketListResponse {
+  items: PSATicketSearchResult[]
+  total: number
+  page: number
+  page_size: number
+}
+
+export interface PSAPriority {
+  id: number
+  name: string
+}