Architecture

The inbox owns and writes the `conversation`, `message`, and `ticket` entities (plus a `cost_ledger` row per smart-reply), and reads shared-core `guest`, `booking`, and `property` for thread context. The data invariant holds: an owner's send / assign / status change is canonical and mirrors durably, while a viewer's smart-reply draft is ephemeral (a credential-tagged cost row that resets) and viewers cannot mutate thread state.

One metered stage — `smart-reply` — the shared C2 stage also invoked by #38, dual-mode by design (Cloud `claude-haiku-4-5`, cost-capped/fail-closed / OSS recorded $0 on local hardware). It runs OSS-only and is honestly labelled simulated (a canned-but-contextual draft chosen by conversation keywords); each run writes a cost row tagged with the invoking app. Out of scope and labelled: the channels themselves — outbound replies are in-app only, no real channel send. Cost, mode, and trace are inspector-only.