diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cfe3294..62201f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install quality tools
-        run: python -m pip install ruff mypy Pillow pillow-avif-plugin matplotlib aiohttp==3.9.5 pytest pytest-xdist
+        run: python -m pip install ruff mypy Pillow pillow-avif-plugin matplotlib aiohttp==3.9.5 PyJWT cryptography pytest pytest-xdist
       - name: Ruff
         run: ruff check .
       # Typing is a separate phase. mypy still reports errors across both cogs,
diff --git a/NHCogs/__init__.py b/NHCogs/__init__.py
index f17ebe7..ca4d14e 100644
--- a/NHCogs/__init__.py
+++ b/NHCogs/__init__.py
@@ -131,6 +131,10 @@ async def setup(bot: Red) -> None:
     try:
         if consoledump := await _load_subcog(bot, ".consoledump", "ConsoleDump"):
             loaded.append(consoledump)
+        if operational_errors := await _load_subcog(
+            bot, ".operationalerrors", "OperationalErrors"
+        ):
+            loaded.append(operational_errors)
         nhmisc = await _load_subcog(bot, ".nhmisc", "NHMisc")
         if nhmisc is not None:
             loaded.append(nhmisc)
diff --git a/NHCogs/consoledump/log_buffer.py b/NHCogs/consoledump/log_buffer.py
index bb73d25..35add8c 100644
--- a/NHCogs/consoledump/log_buffer.py
+++ b/NHCogs/consoledump/log_buffer.py
@@ -29,9 +29,15 @@
     r"[^&#\s]+"
 )
 _NAMED_SECRET_PATTERN = re.compile(
-    r"(?i)\b((?:access[_-]?token|api[_-]?key|password|secret|token)\s*[:=]\s*)"
+    r"(?i)\b((?:access[_-]?token|api[_-]?key|client[_-]?secret|"
+    r"webhook[_-]?secret|private[_-]?key|password|secret|token)\s*[:=]\s*)"
     r"(?:['\"])?[^\s,'\";]+(?:['\"])?"
 )
+_PRIVATE_KEY_BLOCK_PATTERN = re.compile(
+    r"-----BEGIN (?P<label>(?:RSA |EC |OPENSSH )?PRIVATE KEY)-----.*?"
+    r"-----END (?P=label)-----",
+    re.DOTALL,
+)
 _DISCORD_TOKEN_PATTERN = re.compile(
     r"(?<![A-Za-z0-9_-])(?:mfa\.[A-Za-z0-9_-]{20,}|"
     r"[A-Za-z0-9_-]{23,28}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,})"
@@ -66,9 +72,10 @@ class LogDump:
 
 
 def redact_log_text(text: str) -> str:
+    redacted = _PRIVATE_KEY_BLOCK_PATTERN.sub(_REDACTED, text)
     redacted = _AUTHORIZATION_PATTERN.sub(
         lambda match: match.group(1) + match.group(2) + _REDACTED,
-        text,
+        redacted,
     )
     redacted = _BEARER_PATTERN.sub("Bearer " + _REDACTED, redacted)
     redacted = _WEBHOOK_PATTERN.sub(lambda match: match.group(1) + _REDACTED, redacted)
diff --git a/NHCogs/custom_commands/README.md b/NHCogs/custom_commands/README.md
index 7a05426..673213b 100644
--- a/NHCogs/custom_commands/README.md
+++ b/NHCogs/custom_commands/README.md
@@ -61,8 +61,8 @@ Save validates and writes the complete draft in one transaction. Cancel and the
 30-minute timeout make no changes. Completed threads are locked and archived.
 
 Missing arguments, invalid values, cooldowns, and other expected command failures use
-Red's normal command feedback. Unexpected failures are also reported through NHMisc's
-configured error destination and maintainer ping.
+Red's normal command feedback. Unexpected failures use the shared OperationalErrors
+reporter configured through `[p]nhcogs errors`.
 
 ## Cooldowns and deletion
 
diff --git a/NHCogs/custom_commands/cog.py b/NHCogs/custom_commands/cog.py
index 7e9f47f..2fcc030 100644
--- a/NHCogs/custom_commands/cog.py
+++ b/NHCogs/custom_commands/cog.py
@@ -11,6 +11,7 @@
 from redbot.core.utils import menus
 from redbot.core.utils.chat_formatting import pagify
 
+from ..operational_errors import report_operational_error
 from .catalog import (
     CatalogError,
     CustomCommand,
@@ -126,7 +127,8 @@ async def on_error(
         _item: discord.ui.Item[CommandListView],
     ) -> None:
         if interaction.guild is not None:
-            await self._cog.nhmisc.report_operational_error(
+            await report_operational_error(
+                self._cog.bot,
                 guild_id=interaction.guild.id,
                 source="CustomCommands",
                 action="browse custom command list",
@@ -226,7 +228,8 @@ async def on_error(
         _item: discord.ui.Item[RawResponseView],
     ) -> None:
         if interaction.guild is not None:
-            await self._cog.nhmisc.report_operational_error(
+            await report_operational_error(
+                self._cog.bot,
                 guild_id=interaction.guild.id,
                 source="CustomCommands",
                 action="browse raw custom command responses",
@@ -329,7 +332,8 @@ async def on_error(
         _item: discord.ui.Item[DeleteConfirmationView],
     ) -> None:
         if interaction.guild is not None:
-            await self._cog.nhmisc.report_operational_error(
+            await report_operational_error(
+                self._cog.bot,
                 guild_id=interaction.guild.id,
                 source="CustomCommands",
                 action="delete custom command",
@@ -377,10 +381,9 @@ def __init__(
         self.runtime = CustomCommandRuntime(
             bot,
             self.catalog,
-            nhmisc.operational_errors,
             logger=log,
         )
-        self.workflows = WorkflowManager(self.catalog, nhmisc, logger=log)
+        self.workflows = WorkflowManager(bot, self.catalog, nhmisc, logger=log)
 
     async def cog_load(self) -> None:
         await self.catalog.initialize()
@@ -430,7 +433,8 @@ async def on_command_error(
             return
         command = getattr(ctx, "command", None)
         action = getattr(command, "qualified_name", None) or "unknown command"
-        await self.nhmisc.report_operational_error(
+        await report_operational_error(
+            self.bot,
             guild_id=guild.id,
             source="CustomCommands",
             action=action,
@@ -443,7 +447,8 @@ async def _log_moderation_action(self, guild, content: str) -> None:
         try:
             await self.nhmisc.send_moderation_log(guild, content)
         except Exception as error:
-            await self.nhmisc.report_operational_error(
+            await report_operational_error(
+                self.bot,
                 guild_id=guild.id,
                 source="CustomCommands",
                 action="publish custom command moderator log",
@@ -464,7 +469,8 @@ async def _report_view_timeout_error(
                 exc_info=(type(error), error, error.__traceback__),
             )
             return
-        await self.nhmisc.report_operational_error(
+        await report_operational_error(
+            self.bot,
             guild_id=guild.id,
             source="CustomCommands",
             action=action,
@@ -942,7 +948,8 @@ async def on_message_without_command(self, message: discord.Message) -> None:
             await self.runtime.handle_message(message)
         except Exception as error:
             channel = message.channel
-            await self.nhmisc.report_operational_error(
+            await report_operational_error(
+                self.bot,
                 guild_id=message.guild.id,
                 source="CustomCommands",
                 action="process custom command message",
diff --git a/NHCogs/custom_commands/migration_controller.py b/NHCogs/custom_commands/migration_controller.py
index ca3a272..c1c7f76 100644
--- a/NHCogs/custom_commands/migration_controller.py
+++ b/NHCogs/custom_commands/migration_controller.py
@@ -10,6 +10,7 @@
 from redbot.core import Config, commands
 from redbot.core.data_manager import cog_data_path
 
+from ..operational_errors import report_operational_error
 from .catalog import CustomCommand, CustomCommandCatalog
 from .lifecycle import CutoverController, ReplacementActivator
 from .migration import (
@@ -93,7 +94,8 @@ async def cog_command_error(
             return
         if ctx.guild is None:
             return
-        await self.nhmisc.report_operational_error(
+        await report_operational_error(
+            self.bot,
             guild_id=ctx.guild.id,
             source="CustomCommands",
             action="legacy migration command",
@@ -223,7 +225,8 @@ async def _apply_confirmed(self, ctx: commands.Context) -> None:
             latest = await self.state_store.get()
             if latest.phase is not MigrationPhase.COMPLETE:
                 await self.controller.restore_official()
-            await self.nhmisc.report_operational_error(
+            await report_operational_error(
+                self.bot,
                 guild_id=ctx.guild.id,
                 source="CustomCommands",
                 action="apply legacy migration",
@@ -238,7 +241,8 @@ async def _apply_confirmed(self, ctx: commands.Context) -> None:
         try:
             await self.bot.remove_cog(self.qualified_name)
         except Exception as error:
-            await self.nhmisc.report_operational_error(
+            await report_operational_error(
+                self.bot,
                 guild_id=ctx.guild.id,
                 source="CustomCommands",
                 action="remove completed migration command",
@@ -287,7 +291,6 @@ async def _require_private_migration_context(self, ctx: commands.Context) -> Non
             raise commands.UserFeedbackCheckFailure(
                 "Run migration in a channel hidden from @everyone"
             )
-        await self.nhmisc.require_private_error_channel(ctx.guild)
 
     @staticmethod
     def _write_artifacts(plan: MigrationPlan) -> Path:
@@ -366,7 +369,8 @@ async def build_custom_commands_component(bot: Any, nhmisc: Any):
         log.exception("Custom Commands replacement startup failed")
         guilds = tuple(bot.guilds)
         if guilds:
-            await nhmisc.report_operational_error(
+            await report_operational_error(
+                bot,
                 guild_id=guilds[0].id,
                 source="CustomCommands",
                 action="activate replacement startup",
diff --git a/NHCogs/custom_commands/runtime.py b/NHCogs/custom_commands/runtime.py
index 2220db4..702ecd4 100644
--- a/NHCogs/custom_commands/runtime.py
+++ b/NHCogs/custom_commands/runtime.py
@@ -12,6 +12,7 @@
 from redbot.core.commands import Parameter
 from redbot.core.utils.chat_formatting import humanize_list
 
+from ..operational_errors import report_operational_error
 from .arguments import (
     MAX_ARGUMENT_INDEX,
     PLACEHOLDER_PATTERN,
@@ -45,14 +46,12 @@ def __init__(
         self,
         bot: Any,
         catalog: CustomCommandCatalog,
-        operational_errors: Any,
         *,
         random_index: Callable[[int], int] = random.randrange,
         logger: Any,
     ):
         self._bot = bot
         self._catalog = catalog
-        self._operational_errors = operational_errors
         self._random_index = random_index
         self._logger = logger
         self._cooldown_deadlines: dict[tuple[str, int, str, int], float] = {}
@@ -330,18 +329,16 @@ async def _report(self, ctx: Any, action: str, error: BaseException) -> None:
             if getattr(channel, "parent", None) is not None
             else None
         )
-        try:
-            await self._operational_errors.report(
-                guild_id=guild.id,
-                source="CustomCommands",
-                action=action,
-                error=error,
-                channel_id=getattr(channel, "id", None),
-                thread_id=thread_id,
-                message_id=getattr(getattr(ctx, "message", None), "id", None),
-            )
-        except Exception:
-            self._logger.exception("Failed to report CustomCommands operational error")
+        await report_operational_error(
+            self._bot,
+            guild_id=guild.id,
+            source="CustomCommands",
+            action=action,
+            error=error,
+            channel_id=getattr(channel, "id", None),
+            thread_id=thread_id,
+            message_id=getattr(getattr(ctx, "message", None), "id", None),
+        )
 
     @staticmethod
     async def _callback(*_args: Any, **_kwargs: Any) -> None:
diff --git a/NHCogs/custom_commands/workflows.py b/NHCogs/custom_commands/workflows.py
index 08e26da..ae1c578 100644
--- a/NHCogs/custom_commands/workflows.py
+++ b/NHCogs/custom_commands/workflows.py
@@ -8,6 +8,7 @@
 
 import discord
 
+from ..operational_errors import report_operational_error
 from .arguments import ArgumentSignatureError, argument_signature
 from .catalog import (
     MAX_RESPONSE_LENGTH,
@@ -730,15 +731,16 @@ async def report_interaction_error(
 class WorkflowManager:
     def __init__(
         self,
+        bot: Any,
         catalog: CustomCommandCatalog,
         nhmisc: Any,
         *,
         logger: logging.Logger,
         session_timeout_seconds: float = SESSION_TIMEOUT_SECONDS,
     ):
+        self._bot = bot
         self.catalog = catalog
         self._nhmisc = nhmisc
-        self._operational_errors = nhmisc.operational_errors
         self.logger = logger
         self.session_timeout_seconds = session_timeout_seconds
         self._sessions: dict[int, WorkflowSession] = {}
@@ -865,14 +867,12 @@ async def _report_failure(
         thread_id: int | None = None,
         message_id: int | None = None,
     ) -> None:
-        try:
-            await self._operational_errors.report(
-                guild_id=guild_id,
-                source="CustomCommands",
-                action=action,
-                error=error,
-                thread_id=thread_id,
-                message_id=message_id,
-            )
-        except Exception:
-            self.logger.exception("Failed to report CustomCommands workflow error")
+        await report_operational_error(
+            self._bot,
+            guild_id=guild_id,
+            source="CustomCommands",
+            action=action,
+            error=error,
+            thread_id=thread_id,
+            message_id=message_id,
+        )
diff --git a/NHCogs/githubtickets/README.md b/NHCogs/githubtickets/README.md
index 71616a5..6256298 100644
--- a/NHCogs/githubtickets/README.md
+++ b/NHCogs/githubtickets/README.md
@@ -55,13 +55,15 @@ channel and categories are optional.
 
 `/newticket`
 
-Opens an ephemeral form for a pull request title, pull request link, optional categories,
-ping behavior, and an optional direct reviewer. The bot does not call GitHub or verify the
-link. Automatic routing requires at least one category. Direct routing requires a selected
-reviewer. When automatic routing uses multiple categories, a second ephemeral page shows
-how many eligible reviewers have every selected category. Categories can be removed there
-before creating the ticket. For Direct then automatic, the count excludes the direct
-reviewer because that person cannot be selected again during automatic fallback.
+Opens an ephemeral form for a canonical GitHub pull request link, optional categories, ping
+behavior, and an optional direct reviewer. The title is read from GitHub and cannot be entered
+separately. The integration validates the organization, repository access, open state, draft
+state, and active ticket binding before creating the ticket. The `discord-ticket` label is not
+required for manual creation. Automatic routing requires at least one category. Direct routing
+requires a selected reviewer. When automatic routing uses multiple categories, a second
+ephemeral page shows how many eligible reviewers have every selected category. Categories can
+be removed there before creating the ticket. For Direct then automatic, the count excludes the
+direct reviewer because that person cannot be selected again during automatic fallback.
 
 The available ping behaviors are:
 
@@ -76,10 +78,10 @@ The available ping behaviors are:
 
 `/developerprofile`
 
-Opens an ephemeral dashboard where a participant can edit their optional GitHub username,
+Opens an ephemeral dashboard where a participant can enter their optional GitHub profile link,
 select categories, allow or disable automatic pings, browse profiles by category, find
 Discord members by an exact GitHub username, or clear their profile after confirmation.
-Saving an empty profile removes its stored row.
+The link must use `https://github.com/<login>`. Saving an empty profile removes its stored row.
 
 ### View another developer profile
 
@@ -88,6 +90,79 @@ Saving an empty profile removes its stored row.
 The user context menu shows the selected member's optional GitHub username and
 categories in an ephemeral response. It does not show presence or automatic ping consent.
 
+## GitHub App integration
+
+The GitHub integration is configured by moderators through the `github` group. Every command
+in this group requires Manage Messages and is invoked from a guild. The integration settings,
+receiver, and selected guild are process-wide. Running `enable` in a guild selects that one
+guild for this bot process. A bare group shows a safe runtime overview. It never displays
+credentials, private key paths, installation IDs, client IDs, App IDs, webhook secrets, or raw
+network diagnostics.
+
+| Command | Description |
+|---|---|
+| `[p]githubtickets github` | Show the GitHub integration state and available commands |
+| `[p]githubtickets github enable` | Enable the integration when credentials and receiver settings are ready |
+| `[p]githubtickets github disable` | Disable the receiver and GitHub workers while preserving Discord ticket data |
+| `[p]githubtickets github receiver` | Show receiver state and commands |
+| `[p]githubtickets github receiver set <host> <port>` | Set the local receiver bind address and restart an enabled integration |
+| `[p]githubtickets github receiver clear` | Clear receiver settings and disable the integration |
+| `[p]githubtickets github recovery` | Show delivery recovery state and commands |
+| `[p]githubtickets github recovery interval <duration>` | Set the recovery interval using seconds, `s`, `m`, or `h` |
+| `[p]githubtickets github recovery run` | Queue one recovery pass when the integration is running |
+
+The receiver accepts signed `POST` requests at `/githubtickets/webhook`. Put it behind a
+public HTTPS reverse proxy and forward that path to the configured host and port. The receiver
+validates the raw body signature, installation, organization, and repository before durably
+accepting a delivery. It returns before Discord or GitHub processing, then workers process the
+delivery asynchronously. Recovery runs after startup and every 15 minutes by default. GitHub
+App delivery history is used to request redelivery for locally missing deliveries.
+
+Adding the `discord-ticket` label to a ready pull request creates one Discord ticket. A draft
+waits until it becomes ready for review. The ticket starts without categories or automatic
+routing. When the pull request author has one eligible Discord profile, the bot pings that
+author once in the ticket thread with an Add Categories control. Any participant or moderator
+can use the control. Confirming categories starts the normal all-category routing flow.
+
+Discord claims add the mapped GitHub login as a pull request assignee. Discord unassign removes
+that assignee. GitHub assignment and qualifying submitted reviews can claim the Discord ticket.
+Converting the pull request to a draft shows Keep Ticket and Remove Ticket controls. Closing or
+merging the pull request finishes the Discord ticket and writes the configured best-effort
+finish log. Removing the label does not remove an existing ticket.
+
+Create one private GitHub App for the organization and install it on the organization's
+repositories. The App needs these repository permissions:
+
+- Metadata: Read-only
+- Pull requests: Read & write
+
+Subscribe the App to these webhook events:
+
+- Pull request
+- Pull request review
+
+Supply `organization`, `client_id`, `app_id`, and `installation_id` through Red's shared API
+token service named `githubtickets`.
+
+Store the secret files under the Red-managed GitHubTickets cog data directory using these
+fixed relative paths:
+
+```text
+secrets/github-app.pem
+secrets/webhook-secret.txt
+```
+
+With the standard container layout, the files are visible inside the container as:
+
+```text
+/data/cogs/GitHubTickets/secrets/github-app.pem
+/data/cogs/GitHubTickets/secrets/webhook-secret.txt
+```
+
+The external host path depends on the volume mounted at `/data`. Both files must be readable
+by the account running Red. Their contents and paths are never shown in command output or
+public messages.
+
 ## Prefix command overviews
 
 `[p]githubtickets`
diff --git a/NHCogs/githubtickets/coordinator.py b/NHCogs/githubtickets/coordinator.py
index a8b863a..9deabba 100644
--- a/NHCogs/githubtickets/coordinator.py
+++ b/NHCogs/githubtickets/coordinator.py
@@ -4,17 +4,21 @@
 import logging
 from collections.abc import Awaitable, Callable, Sequence
 from contextlib import AsyncExitStack
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from datetime import datetime, timedelta, timezone
 
 from . import presentation
 from .models import (
+    ActivePullRequestTicketExists,
+    Category,
+    GitHubPullRequest,
     NewTicket,
     NextAction,
     PingReservation,
     PresenceTier,
     RoutingMode,
     Ticket,
+    TicketOrigin,
     TicketState,
 )
 from .projection import ProjectionNotFound, TicketProjection
@@ -106,15 +110,69 @@ async def create_ticket(
         async with self._lifecycle_lock:
             return await self._create_ticket_locked(request, actor)
 
+    async def create_ticket_for_pull_request(
+        self,
+        request: TicketRequest,
+        actor: TicketActor,
+        pull_request: GitHubPullRequest,
+    ) -> TicketResult:
+        async with self._lifecycle_lock:
+            return await self._create_ticket_locked(
+                request,
+                actor,
+                pull_request=pull_request,
+            )
+
+    async def create_ticket_from_github(
+        self,
+        guild_id: int,
+        pull_request: GitHubPullRequest,
+        *,
+        author_id: int | None,
+    ) -> TicketResult:
+        async with self._lifecycle_lock:
+            settings = await self._get_settings(guild_id)
+            if settings.ticket_channel_id is None:
+                return TicketResult(False, MISSING_TICKET_CHANNEL)
+            now = self._clock()
+            try:
+                ticket = await self._store.create_ticket_for_pull_request(
+                    NewTicket(
+                        guild_id=guild_id,
+                        channel_id=settings.ticket_channel_id,
+                        author_id=author_id,
+                        pr_title=pull_request.title,
+                        pr_url=pull_request.url,
+                        category_display="",
+                        routing_mode=RoutingMode.NONE,
+                        direct_target_id=None,
+                        category_ids=(),
+                        created_at=now,
+                        origin=TicketOrigin.GITHUB,
+                    ),
+                    pull_request,
+                )
+            except ActivePullRequestTicketExists:
+                return TicketResult(True)
+            except Exception:
+                return TicketResult(False, CREATE_FAILED)
+            return await self._project_created_ticket(
+                ticket,
+                routing_mode=RoutingMode.NONE,
+                settings=settings,
+                now=now,
+            )
+
     async def _create_ticket_locked(
         self,
         request: TicketRequest,
         actor: TicketActor,
+        *,
+        pull_request: GitHubPullRequest | None = None,
     ) -> TicketResult:
         direct_target_id = (
             request.direct_target_id
-            if request.routing_mode
-            in (RoutingMode.DIRECT_WAIT, RoutingMode.DIRECT_AUTOMATIC)
+            if request.routing_mode in (RoutingMode.DIRECT_WAIT, RoutingMode.DIRECT_AUTOMATIC)
             else None
         )
         actor_error = None
@@ -127,28 +185,60 @@ async def _create_ticket_locked(
         settings = await self._get_settings(request.guild_id)
         if settings.ticket_channel_id is None:
             return TicketResult(False, MISSING_TICKET_CHANNEL)
-        validation_error = self._validate_request(request)
+        effective_request = (
+            request
+            if pull_request is None
+            else replace(
+                request,
+                pr_title=pull_request.title,
+                pr_url=pull_request.url,
+            )
+        )
+        validation_error = self._validate_request(effective_request)
         if validation_error is not None:
             return TicketResult(False, validation_error)
 
         now = self._clock()
         try:
-            ticket = await self._store.create_ticket(
-                NewTicket(
-                    guild_id=request.guild_id,
-                    channel_id=settings.ticket_channel_id,
-                    author_id=actor.user_id,
-                    pr_title=request.pr_title,
-                    pr_url=request.pr_url,
-                    category_display=request.category_display,
-                    routing_mode=request.routing_mode,
-                    direct_target_id=direct_target_id,
-                    category_ids=request.category_ids,
-                    created_at=now,
+            new_ticket = NewTicket(
+                guild_id=request.guild_id,
+                channel_id=settings.ticket_channel_id,
+                author_id=actor.user_id,
+                pr_title=effective_request.pr_title,
+                pr_url=effective_request.pr_url,
+                category_display=request.category_display,
+                routing_mode=request.routing_mode,
+                direct_target_id=direct_target_id,
+                category_ids=request.category_ids,
+                created_at=now,
+            )
+            ticket = (
+                await self._store.create_ticket(new_ticket)
+                if pull_request is None
+                else await self._store.create_ticket_for_pull_request(
+                    new_ticket,
+                    pull_request,
                 )
             )
         except Exception:
             return TicketResult(False, CREATE_FAILED)
+        return await self._project_created_ticket(
+            ticket,
+            routing_mode=request.routing_mode,
+            settings=settings,
+            now=now,
+        )
+
+    async def _project_created_ticket(
+        self,
+        ticket: Ticket,
+        *,
+        routing_mode: RoutingMode,
+        settings: GuildSettings,
+        now: datetime,
+    ) -> TicketResult:
+        message_id: int | None = None
+        thread_id: int | None = None
         try:
             message_id = await self._projection.send_ticket(
                 ticket,
@@ -168,7 +258,7 @@ async def _create_ticket_locked(
             ):
                 raise RuntimeError("ticket thread reservation lost its creating state")
             protection_until, next_action, next_action_at = self._creation_schedule(
-                request.routing_mode,
+                routing_mode,
                 settings,
                 now,
             )
@@ -184,15 +274,37 @@ async def _create_ticket_locked(
             if not activated:
                 raise RuntimeError("ticket activation lost its creating state")
         except Exception:
-            await self._cleanup_failed_creation(ticket, locals().get("message_id"), locals().get("thread_id"))
+            await self._cleanup_failed_creation(ticket, message_id, thread_id)
             if await self._store.get_ticket(ticket.ticket_id) is not None:
                 await self._defer_cleanup_retry(ticket.ticket_id)
             return TicketResult(False, CREATE_FAILED)
 
+        activated_ticket = await self._store.get_ticket(ticket.ticket_id)
+        if activated_ticket is not None:
+            await self._send_pending_category_prompt(activated_ticket)
         if next_action_at is not None:
             self._wake_deadlines()
         return TicketResult(True)
 
+    async def _send_pending_category_prompt(self, ticket: Ticket) -> bool:
+        if ticket.category_prompt_retry_at is None:
+            return True
+        if ticket.thread_id is None:
+            return False
+        try:
+            await self._projection.prompt_categories(ticket, ticket.thread_id)
+        except Exception:
+            log.exception(
+                "GitHub Tickets category prompt failed for ticket %s",
+                ticket.ticket_id,
+            )
+            retry_at = self._clock() + timedelta(seconds=PROJECTION_RETRY_SECONDS)
+            if await self._store.defer_category_prompt(ticket.ticket_id, retry_at):
+                self._wake_deadlines()
+            return False
+        await self._store.acknowledge_category_prompt(ticket.ticket_id)
+        return True
+
     async def claim(self, ticket_id: int, actor: TicketActor) -> TicketResult:
         async with self._ticket_lock(ticket_id):
             ticket = await self._store.get_ticket(ticket_id)
@@ -200,23 +312,86 @@ async def claim(self, ticket_id: int, actor: TicketActor) -> TicketResult:
                 return TicketResult(False, INACTIVE_TICKET)
             if ticket.state is TicketState.CLAIMED:
                 return TicketResult(False, CLAIM_RACE_LOST)
-            if not (
-                actor.can_participate
-                or actor.user_id == ticket.direct_target_id
-            ):
+            if not (actor.can_participate or actor.user_id == ticket.direct_target_id):
                 return TicketResult(False, PERMISSION_DENIED)
             return await self._claim_open(ticket, actor)
 
+    async def claim_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        user_id: int,
+        github_login: str,
+        github_write_required: bool,
+    ) -> TicketResult:
+        ticket_id = await self._bound_ticket_id(repository_id, pr_number)
+        if ticket_id is None:
+            return TicketResult(False, INACTIVE_TICKET)
+        async with self._ticket_lock(ticket_id):
+            return await self._claim_ticket_from_github_locked(
+                ticket_id,
+                user_id=user_id,
+                github_login=github_login,
+                github_write_required=github_write_required,
+            )
+
+    async def _claim_ticket_from_github_locked(
+        self,
+        ticket_id: int,
+        *,
+        user_id: int,
+        github_login: str,
+        github_write_required: bool,
+    ) -> TicketResult:
+        ticket = await self._store.get_ticket(ticket_id)
+        if ticket is None or ticket.state is not TicketState.OPEN:
+            if ticket is not None and ticket.state is TicketState.CLAIMED:
+                return TicketResult(True)
+            return TicketResult(False, INACTIVE_TICKET)
+        if ticket.author_id == user_id:
+            return TicketResult(False, SELF_REVIEW_DENIED)
+        settings = await self._get_settings(ticket.guild_id)
+        now = self._clock()
+        protection_until = now + timedelta(seconds=settings.protection_seconds)
+        claimed = await self._store.claim_with_github_assignment(
+            ticket_id,
+            assignee_id=user_id,
+            github_login=github_login,
+            github_write_required=github_write_required,
+            protection_until=protection_until,
+            updated_at=now,
+        )
+        if not claimed:
+            return TicketResult(False, CLAIM_RACE_LOST)
+        current = await self._store.get_ticket(ticket_id)
+        if current is None:
+            return TicketResult(False, INACTIVE_TICKET)
+        return await self._edit_after_transition(current)
+
     async def _claim_open(self, ticket: Ticket, actor: TicketActor) -> TicketResult:
         settings = await self._get_settings(ticket.guild_id)
         now = self._clock()
         protection_until = now + timedelta(seconds=settings.protection_seconds)
-        if not await self._store.claim(
-            ticket.ticket_id,
-            actor.user_id,
-            protection_until,
-            now,
-        ):
+        github_login = await self._bound_unique_github_login(ticket, actor.user_id)
+        transitioned = (
+            await self._store.claim_with_github_assignment(
+                ticket.ticket_id,
+                assignee_id=actor.user_id,
+                github_login=github_login,
+                github_write_required=True,
+                protection_until=protection_until,
+                updated_at=now,
+            )
+            if github_login is not None
+            else await self._store.claim(
+                ticket.ticket_id,
+                actor.user_id,
+                protection_until,
+                now,
+            )
+        )
+        if not transitioned:
             current = await self._store.get_ticket(ticket.ticket_id)
             if current is not None and current.state is TicketState.CLAIMED:
                 return TicketResult(False, CLAIM_RACE_LOST)
@@ -232,10 +407,7 @@ async def decline(self, ticket_id: int, actor: TicketActor) -> TicketResult:
             ticket = await self._store.get_ticket(ticket_id)
             if ticket is None or ticket.state is not TicketState.OPEN:
                 return TicketResult(False, INACTIVE_TICKET)
-            if not (
-                actor.can_participate
-                or actor.user_id == ticket.direct_target_id
-            ):
+            if not (actor.can_participate or actor.user_id == ticket.direct_target_id):
                 return TicketResult(False, PERMISSION_DENIED)
             return await self._decline_open(ticket, actor)
 
@@ -290,10 +462,7 @@ async def unassign(self, ticket_id: int, actor: TicketActor) -> TicketResult:
             ticket = await self._store.get_ticket(ticket_id)
             if ticket is None or ticket.state is not TicketState.CLAIMED:
                 return TicketResult(False, INACTIVE_TICKET)
-            if not (
-                actor.can_manage_messages
-                or actor.user_id == ticket.assignee_id
-            ):
+            if not (actor.can_manage_messages or actor.user_id == ticket.assignee_id):
                 return TicketResult(False, PERMISSION_DENIED)
 
             settings = await self._get_settings(ticket.guild_id)
@@ -303,6 +472,69 @@ async def unassign(self, ticket_id: int, actor: TicketActor) -> TicketResult:
                 ticket.routing_mode,
                 protection_until,
             )
+            former_assignee = await self._store.unassign_with_github_outbox(
+                ticket_id,
+                protection_until=protection_until,
+                next_action=next_action,
+                next_action_at=next_action_at,
+                updated_at=now,
+            )
+            if former_assignee is None:
+                return TicketResult(False, INACTIVE_TICKET)
+            current = await self._store.get_ticket(ticket_id)
+            if current is None:
+                return TicketResult(False, INACTIVE_TICKET)
+            result = await self._edit_after_transition(current)
+            if result.success and next_action_at is not None:
+                self._wake_deadlines()
+            return result
+
+    async def _bound_unique_github_login(
+        self,
+        ticket: Ticket,
+        user_id: int | None,
+    ) -> str | None:
+        if user_id is None:
+            return None
+        pull_request = await self._store.get_pull_request_for_ticket(ticket.ticket_id)
+        if pull_request is None:
+            return None
+        profile = await self._store.get_profile(ticket.guild_id, user_id)
+        if profile is None or not profile.github_username:
+            return None
+        matching_profiles = await self._store.list_profiles_by_github_username(
+            ticket.guild_id,
+            profile.github_username,
+        )
+        if len(matching_profiles) != 1 or matching_profiles[0].user_id != user_id:
+            return None
+        return profile.github_username
+
+    async def unassign_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        user_id: int,
+    ) -> TicketResult:
+        ticket_id = await self._bound_ticket_id(repository_id, pr_number)
+        if ticket_id is None:
+            return TicketResult(True)
+        async with self._ticket_lock(ticket_id):
+            ticket = await self._store.get_ticket(ticket_id)
+            if (
+                ticket is None
+                or ticket.state is not TicketState.CLAIMED
+                or ticket.assignee_id != user_id
+            ):
+                return TicketResult(True)
+            settings = await self._get_settings(ticket.guild_id)
+            now = self._clock()
+            protection_until = now + timedelta(seconds=settings.protection_seconds)
+            next_action, next_action_at = self._release_schedule(
+                ticket.routing_mode,
+                protection_until,
+            )
             former_assignee = await self._store.unassign(
                 ticket_id,
                 protection_until=protection_until,
@@ -320,28 +552,231 @@ async def unassign(self, ticket_id: int, actor: TicketActor) -> TicketResult:
                 self._wake_deadlines()
             return result
 
+    async def _bound_ticket_id(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> int | None:
+        pull_request = await self._store.get_pull_request(repository_id, pr_number)
+        return pull_request.current_ticket_id if pull_request is not None else None
+
     async def mark_finished(self, ticket_id: int, actor: TicketActor) -> TicketResult:
         async with self._ticket_lock(ticket_id):
             ticket = await self._store.get_ticket(ticket_id)
             if ticket is None or ticket.state not in (TicketState.OPEN, TicketState.CLAIMED):
                 return TicketResult(False, INACTIVE_TICKET)
             if not (
-                actor.can_manage_messages
-                or actor.user_id in (ticket.author_id, ticket.assignee_id)
+                actor.can_manage_messages or actor.user_id in (ticket.author_id, ticket.assignee_id)
             ):
                 return TicketResult(False, PERMISSION_DENIED)
-            if not await self._store.begin_finishing(ticket_id, self._clock()):
-                return TicketResult(False, INACTIVE_TICKET)
-            finishing = await self._store.get_ticket(ticket_id)
-            if finishing is None:
-                return TicketResult(True, finished_ticket=ticket)
+            return await self._finish_ticket_locked(ticket)
+
+    async def finish_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> TicketResult:
+        ticket_id = await self._bound_ticket_id(repository_id, pr_number)
+        if ticket_id is None:
+            return TicketResult(True)
+        async with self._ticket_lock(ticket_id):
+            ticket = await self._store.get_ticket(ticket_id)
+            if ticket is None or ticket.state not in (
+                TicketState.OPEN,
+                TicketState.CLAIMED,
+            ):
+                return TicketResult(True)
+            return await self._finish_ticket_locked(ticket)
+
+    async def prompt_draft_decision_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> TicketResult:
+        ticket_id = await self._bound_ticket_id(repository_id, pr_number)
+        if ticket_id is None:
+            return TicketResult(True)
+        async with self._ticket_lock(ticket_id):
+            ticket = await self._store.get_ticket(ticket_id)
+            if ticket is None or ticket.state not in (
+                TicketState.OPEN,
+                TicketState.CLAIMED,
+            ):
+                return TicketResult(True)
+            pull_request = await self._store.get_pull_request_for_ticket(ticket_id)
+            if pull_request is None or not pull_request.draft:
+                return TicketResult(True)
             try:
-                await self._delete_remaining_projection(finishing)
+                await self._projection.prompt_draft_decision(ticket)
             except Exception:
-                await self._defer_cleanup_retry(ticket_id)
                 return TicketResult(False, ACTION_FAILED)
-            self._locks.pop(ticket_id, None)
+            return TicketResult(True)
+
+    async def add_ticket_categories(
+        self,
+        ticket_id: int,
+        category_ids: tuple[int, ...],
+        actor: TicketActor,
+    ) -> TicketResult:
+        selected_ids = tuple(dict.fromkeys(category_ids))
+        if not selected_ids:
+            return TicketResult(False, MISSING_AUTOMATIC_CATEGORIES)
+        async with self._ticket_lock(ticket_id):
+            ticket = await self._store.get_ticket(ticket_id)
+            if ticket is None or ticket.state not in (
+                TicketState.OPEN,
+                TicketState.CLAIMED,
+            ):
+                return TicketResult(False, INACTIVE_TICKET)
+            if not actor.can_participate:
+                return TicketResult(False, PERMISSION_DENIED)
+            categories = await self._store.list_categories(ticket.guild_id)
+            selected = set(selected_ids)
+            ordered_categories = tuple(
+                category for category in categories if category.category_id in selected
+            )
+            if len(ordered_categories) != len(selected_ids):
+                return TicketResult(False, presentation.CATEGORY_NO_LONGER_EXISTS)
+            ordered_ids = tuple(category.category_id for category in ordered_categories)
+            settled = self._settled_category_result(ticket, ordered_ids)
+            if settled is not None:
+                return settled
+            return await self._start_ticket_routing(ticket, ordered_categories)
+
+    @staticmethod
+    def _settled_category_result(
+        ticket: Ticket,
+        category_ids: tuple[int, ...],
+    ) -> TicketResult | None:
+        if ticket.routing_mode is RoutingMode.AUTOMATIC:
+            if ticket.category_ids == category_ids:
+                return TicketResult(True)
+            return TicketResult(False, INACTIVE_TICKET)
+        if (
+            ticket.origin is not TicketOrigin.GITHUB
+            or ticket.routing_mode is not RoutingMode.NONE
+        ):
+            return TicketResult(False, INACTIVE_TICKET)
+        return None
+
+    async def _start_ticket_routing(
+        self,
+        ticket: Ticket,
+        categories: tuple[Category, ...],
+    ) -> TicketResult:
+        settings = await self._get_settings(ticket.guild_id)
+        now = self._clock()
+        _, _, next_action_at = self._creation_schedule(
+            RoutingMode.AUTOMATIC,
+            settings,
+            now,
+        )
+        if next_action_at is None:
+            raise RuntimeError("automatic routing must have a deadline")
+        try:
+            current = await self._store.start_automatic_routing(
+                ticket.ticket_id,
+                category_ids=tuple(category.category_id for category in categories),
+                category_display=", ".join(category.name for category in categories),
+                next_action_at=next_action_at,
+                updated_at=now,
+            )
+        except ValueError:
+            return TicketResult(False, presentation.CATEGORY_NO_LONGER_EXISTS)
+        if current is None:
+            return TicketResult(False, INACTIVE_TICKET)
+        result = await self._edit_after_transition(current)
+        if result.success and current.next_action_at is not None:
+            self._wake_deadlines()
+        return result
+
+    async def keep_draft_ticket(
+        self,
+        ticket_id: int,
+        actor: TicketActor,
+    ) -> TicketResult:
+        async with self._ticket_lock(ticket_id):
+            ticket, error = await self._authorized_draft_ticket(ticket_id, actor)
+            if ticket is None:
+                return TicketResult(False, error)
+            return TicketResult(True)
+
+    async def remove_draft_ticket(
+        self,
+        ticket_id: int,
+        actor: TicketActor,
+    ) -> TicketResult:
+        async with self._ticket_lock(ticket_id):
+            ticket, error = await self._authorized_draft_ticket(ticket_id, actor)
+            if ticket is None:
+                return TicketResult(False, error)
+            return await self._finish_ticket_locked(ticket)
+
+    async def _authorized_draft_ticket(
+        self,
+        ticket_id: int,
+        actor: TicketActor,
+    ) -> tuple[Ticket | None, str]:
+        ticket = await self._store.get_ticket(ticket_id)
+        if ticket is None or ticket.state not in (TicketState.OPEN, TicketState.CLAIMED):
+            return None, INACTIVE_TICKET
+        pull_request = await self._store.get_pull_request_for_ticket(ticket_id)
+        if pull_request is None or not pull_request.draft:
+            return None, INACTIVE_TICKET
+        if actor.can_manage_messages or actor.user_id == ticket.author_id:
+            return ticket, ""
+        profiles = await self._store.list_profiles_by_github_username(
+            ticket.guild_id,
+            pull_request.github_author_login,
+        )
+        if len(profiles) == 1 and profiles[0].user_id == actor.user_id:
+            return ticket, ""
+        return None, PERMISSION_DENIED
+
+    async def update_title_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        title: str,
+    ) -> TicketResult:
+        ticket_id = await self._bound_ticket_id(repository_id, pr_number)
+        if ticket_id is None:
+            return TicketResult(True)
+        async with self._ticket_lock(ticket_id):
+            ticket = await self._store.get_ticket(ticket_id)
+            if ticket is None or ticket.state not in (
+                TicketState.OPEN,
+                TicketState.CLAIMED,
+            ):
+                return TicketResult(True)
+            normalized_title = title.strip()
+            if not normalized_title:
+                return TicketResult(True)
+            if ticket.pr_title == normalized_title:
+                return TicketResult(True)
+            updated = await self._store.update_ticket_title(
+                ticket_id,
+                normalized_title,
+                self._clock(),
+            )
+            if updated is None:
+                return TicketResult(False, INACTIVE_TICKET)
+            return await self._edit_after_transition(updated)
+
+    async def _finish_ticket_locked(self, ticket: Ticket) -> TicketResult:
+        if not await self._store.begin_finishing(ticket.ticket_id, self._clock()):
+            return TicketResult(False, INACTIVE_TICKET)
+        finishing = await self._store.get_ticket(ticket.ticket_id)
+        if finishing is None:
             return TicketResult(True, finished_ticket=ticket)
+        try:
+            await self._delete_remaining_projection(finishing)
+        except Exception:
+            await self._defer_cleanup_retry(ticket.ticket_id)
+            return TicketResult(False, ACTION_FAILED)
+        self._locks.pop(ticket.ticket_id, None)
+        return TicketResult(True, finished_ticket=ticket)
 
     async def handle_message_deleted(self, message_id: int) -> None:
         ticket = await self._store.get_ticket_by_message_id(message_id)
@@ -478,14 +913,12 @@ async def _redact_user_locked(
         updated_at: datetime,
     ) -> tuple[Ticket, ...]:
         authored = await self._store.list_authored_tickets(user_id)
-        active_ids = {
-            ticket.ticket_id for ticket in await self._store.list_active_tickets()
-        }
+        active_ids = {ticket.ticket_id for ticket in await self._store.list_active_tickets()}
         ticket_ids = tuple(
             sorted(
-                active_ids
-                .union(ticket.ticket_id for ticket in authored)
-                .union(await self._store.user_reference_ticket_ids(user_id))
+                active_ids.union(ticket.ticket_id for ticket in authored).union(
+                    await self._store.user_reference_ticket_ids(user_id)
+                )
             )
         )
         async with AsyncExitStack() as stack:
@@ -571,6 +1004,9 @@ async def _recover_creation(self, ticket: Ticket) -> TicketResult:
             return TicketResult(False, ACTION_FAILED)
         if not activated:
             return TicketResult(False, ACTION_FAILED)
+        activated_ticket = await self._store.get_ticket(ticket.ticket_id)
+        if activated_ticket is not None:
+            await self._send_pending_category_prompt(activated_ticket)
         if next_action_at is not None:
             self._wake_deadlines()
         return TicketResult(True)
@@ -600,6 +1036,15 @@ async def process_due(self, ticket_id: int) -> TicketResult:
                 TicketState.FINISHING,
             ):
                 return await self._recover_projection_cleanup_locked(ticket_id)
+            if (
+                ticket is not None
+                and ticket.category_prompt_retry_at is not None
+                and ticket.category_prompt_retry_at <= self._clock()
+            ):
+                await self._send_pending_category_prompt(ticket)
+                ticket = await self._store.get_ticket(ticket_id)
+                if ticket is None:
+                    return TicketResult(False, INACTIVE_TICKET)
             projection_sync = await self._store.get_projection_sync_ticket(ticket_id)
             if projection_sync is not None:
                 result = await self._edit_after_transition(projection_sync)
@@ -912,15 +1357,23 @@ async def _delete_remaining_projection(
 
     @staticmethod
     def _validate_request(request: TicketRequest) -> str | None:
-        if request.routing_mode in (
-            RoutingMode.AUTOMATIC,
-            RoutingMode.DIRECT_AUTOMATIC,
-        ) and not request.category_ids:
+        if (
+            request.routing_mode
+            in (
+                RoutingMode.AUTOMATIC,
+                RoutingMode.DIRECT_AUTOMATIC,
+            )
+            and not request.category_ids
+        ):
             return MISSING_AUTOMATIC_CATEGORIES
-        if request.routing_mode in (
-            RoutingMode.DIRECT_WAIT,
-            RoutingMode.DIRECT_AUTOMATIC,
-        ) and request.direct_target_id is None:
+        if (
+            request.routing_mode
+            in (
+                RoutingMode.DIRECT_WAIT,
+                RoutingMode.DIRECT_AUTOMATIC,
+            )
+            and request.direct_target_id is None
+        ):
             return MISSING_DIRECT_REVIEWER
         return None
 
diff --git a/NHCogs/githubtickets/credentials.py b/NHCogs/githubtickets/credentials.py
new file mode 100644
index 0000000..6a1ce9a
--- /dev/null
+++ b/NHCogs/githubtickets/credentials.py
@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any
+
+from .github_app import GitHubAppCredentials
+
+_TOKEN_SERVICE = "githubtickets"
+_MAX_SECRET_BYTES = 1024 * 1024
+_PRIVATE_KEY_PATH = Path("secrets/github-app.pem")
+_WEBHOOK_SECRET_PATH = Path("secrets/webhook-secret.txt")
+
+
+class InvalidGitHubAppCredentials(ValueError):
+    pass
+
+
+async def load_github_app_credentials(
+    bot: Any,
+    data_path: Path,
+) -> GitHubAppCredentials | None:
+    raw = await bot.get_shared_api_tokens(_TOKEN_SERVICE)
+    if not raw:
+        return None
+    if not isinstance(raw, Mapping):
+        raise InvalidGitHubAppCredentials("GitHub App credentials are invalid")
+    organization = _required_text(raw, "organization")
+    client_id = _required_text(raw, "client_id")
+    app_id = _positive_integer(raw, "app_id")
+    installation_id = _positive_integer(raw, "installation_id")
+    private_key = await _secret_file(data_path / _PRIVATE_KEY_PATH)
+    webhook_secret = await _secret_file(data_path / _WEBHOOK_SECRET_PATH)
+    return GitHubAppCredentials(
+        organization=organization,
+        client_id=client_id,
+        app_id=app_id,
+        installation_id=installation_id,
+        private_key=private_key,
+        webhook_secret=webhook_secret,
+    )
+
+
+def _required_text(values: Mapping[str, object], name: str) -> str:
+    value = values.get(name)
+    if not isinstance(value, str) or not value.strip():
+        raise InvalidGitHubAppCredentials("GitHub App credentials are incomplete")
+    return value.strip()
+
+
+def _positive_integer(values: Mapping[str, object], name: str) -> int:
+    value = values.get(name)
+    if isinstance(value, bool) or not isinstance(value, (int, str)):
+        raise InvalidGitHubAppCredentials("GitHub App credentials are incomplete")
+    try:
+        parsed = int(value)
+    except ValueError:
+        raise InvalidGitHubAppCredentials("GitHub App credentials are invalid") from None
+    if parsed <= 0:
+        raise InvalidGitHubAppCredentials("GitHub App credentials are invalid")
+    return parsed
+
+
+async def _secret_file(secret_path: Path) -> bytes:
+    try:
+        secret = await asyncio.to_thread(_read_secret_file, secret_path)
+    except (OSError, ValueError):
+        raise InvalidGitHubAppCredentials("GitHub App secret file is unavailable") from None
+    return secret
+
+
+def _read_secret_file(path: Path) -> bytes:
+    if path.stat().st_size > _MAX_SECRET_BYTES:
+        raise ValueError("secret file is too large")
+    value = path.read_bytes()
+    if len(value) > _MAX_SECRET_BYTES:
+        raise ValueError("secret file is too large")
+    value = value.strip()
+    if not value:
+        raise ValueError("secret file is empty")
+    return value
diff --git a/NHCogs/githubtickets/dashboard.py b/NHCogs/githubtickets/dashboard.py
index f529876..65b3456 100644
--- a/NHCogs/githubtickets/dashboard.py
+++ b/NHCogs/githubtickets/dashboard.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import logging
+import re
 from collections.abc import Awaitable, Callable, Sequence
 from dataclasses import replace
 from datetime import datetime, timezone
@@ -9,10 +10,15 @@
 
 from . import presentation
 from .coordinator import SELF_REVIEW_DENIED, TicketActor, TicketRequest, TicketResult
-from .models import Category, Profile, RoutingMode
+from .github_app import PullRequestSnapshot, pull_request_from_snapshot
+from .models import Category, GitHubPullRequest, Profile, RoutingMode
 from .store import GitHubTicketsStore
 
-CreateTicket = Callable[[TicketRequest, TicketActor], Awaitable[TicketResult]]
+CreateTicket = Callable[
+    [TicketRequest, TicketActor, GitHubPullRequest],
+    Awaitable[TicketResult],
+]
+FetchPullRequest = Callable[[str, str, int], Awaitable[PullRequestSnapshot]]
 CountAutomaticCandidates = Callable[
     [int, tuple[int, ...], frozenset[int]],
     Awaitable[int],
@@ -21,12 +27,62 @@
 MemberLookup = Callable[[int], discord.Member | None]
 MemberActorFactory = Callable[[discord.Member], TicketActor]
 log = logging.getLogger("red.NHCogs.GitHubTickets")
+GITHUB_INTEGRATION_UNAVAILABLE = "GitHub integration is unavailable"
+_PULL_REQUEST_LINK = re.compile(
+    r"https://github\.com/([A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)/"
+    r"([A-Za-z0-9_.-]+)/pull/([1-9][0-9]*)"
+)
+_GITHUB_PROFILE_LINK = re.compile(
+    r"https://github\.com/"
+    r"([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?)/?"
+)
 
 
 def _utc_now() -> datetime:
     return datetime.now(timezone.utc)
 
 
+def _parse_pull_request_link(value: str) -> tuple[str, str, int] | None:
+    match = _PULL_REQUEST_LINK.fullmatch(value)
+    if match is None:
+        return None
+    owner, repository, number = match.groups()
+    return owner, repository, int(number)
+
+
+def _parse_github_profile_link(value: str) -> str | None:
+    match = _GITHUB_PROFILE_LINK.fullmatch(value.strip())
+    return match.group(1) if match is not None else None
+
+
+def _github_profile_link(github_username: str) -> str:
+    return f"https://github.com/{github_username}"
+
+
+def _validated_pull_request(
+    snapshot: PullRequestSnapshot,
+    *,
+    owner: str,
+    repository: str,
+    number: int,
+    expected_organization: str,
+) -> GitHubPullRequest | None:
+    expected_full_name = f"{owner}/{repository}"
+    repository_full_name = snapshot.repository_full_name.strip()
+    repository_owner, separator, _ = repository_full_name.partition("/")
+    if (
+        not separator
+        or repository_full_name.casefold() != expected_full_name.casefold()
+        or repository_owner.casefold() != expected_organization.casefold()
+        or snapshot.number != number
+        or snapshot.state.casefold() != "open"
+        or snapshot.draft
+        or snapshot.merged
+    ):
+        return None
+    return pull_request_from_snapshot(snapshot)
+
+
 async def _check_participant(
     interaction: discord.Interaction,
     actor_factory: ActorFactory,
@@ -181,10 +237,14 @@ def __init__(
         self._clock = clock
         visible_categories = tuple(categories[:25])
 
-        self.github_username = discord.ui.TextInput(
-            default=profile.github_username if profile is not None else None,
+        self.github_profile_link = discord.ui.TextInput(
+            default=(
+                _github_profile_link(profile.github_username)
+                if profile is not None and profile.github_username
+                else None
+            ),
             required=False,
-            max_length=presentation.MAX_GITHUB_USERNAME_LENGTH,
+            max_length=presentation.MAX_GITHUB_PROFILE_LINK_LENGTH,
         )
         self.categories = discord.ui.Select(
             placeholder=presentation.SELECT_YOUR_CATEGORIES,
@@ -203,9 +263,9 @@ def __init__(
                 option.default = int(option.value) in selected_ids if option.value != "none" else False
         self.add_item(
             discord.ui.Label(
-                text=presentation.GITHUB_USERNAME,
-                description=presentation.GITHUB_USERNAME_DESCRIPTION,
-                component=self.github_username,
+                text=presentation.GITHUB_PROFILE_LINK,
+                description=presentation.GITHUB_PROFILE_LINK_DESCRIPTION,
+                component=self.github_profile_link,
             )
         )
         self.add_item(
@@ -224,6 +284,17 @@ def __init__(
     async def on_submit(self, interaction: discord.Interaction) -> None:
         if not await _check_participant(interaction, self._actor_factory):
             return
+        profile_link = str(self.github_profile_link.value).strip()
+        github_username = (
+            _parse_github_profile_link(profile_link) if profile_link else None
+        )
+        if profile_link and github_username is None:
+            await interaction.response.send_message(
+                presentation.INVALID_GITHUB_PROFILE_LINK,
+                ephemeral=True,
+                allowed_mentions=discord.AllowedMentions.none(),
+            )
+            return
         category_ids = tuple(int(value) for value in self.categories.values)
         if self.automatic_pings.value and not category_ids:
             await interaction.response.send_message(
@@ -248,7 +319,7 @@ async def on_submit(self, interaction: discord.Interaction) -> None:
         await self._store.save_profile(
             guild_id=self._guild_id,
             user_id=actor.user_id,
-            github_username=str(self.github_username.value),
+            github_username=github_username,
             category_ids=category_ids,
             automatic_pings=self.automatic_pings.value,
             updated_at=self._clock(),
@@ -264,6 +335,8 @@ def __init__(
         guild_id: int,
         categories: Sequence[Category],
         create_ticket: CreateTicket,
+        fetch_pull_request: FetchPullRequest,
+        expected_organization: str,
         actor_factory: ActorFactory,
         count_automatic_candidates: CountAutomaticCandidates,
         draft: TicketRequest | None = None,
@@ -272,16 +345,12 @@ def __init__(
         self._store = store
         self._guild_id = guild_id
         self._create_ticket = create_ticket
+        self._fetch_pull_request = fetch_pull_request
+        self._expected_organization = expected_organization
         self._actor_factory = actor_factory
         self._count_automatic_candidates = count_automatic_candidates
         visible_categories = tuple(categories[:25])
 
-        self.pr_title = discord.ui.TextInput(
-            placeholder=presentation.ENTER_PR_TITLE,
-            default=draft.pr_title if draft is not None else None,
-            required=True,
-            max_length=presentation.MAX_PR_TITLE_LENGTH,
-        )
         self.pr_link = discord.ui.TextInput(
             placeholder=presentation.ENTER_PR_LINK,
             default=draft.pr_url if draft is not None else None,
@@ -345,7 +414,6 @@ def __init__(
                     int(option.value) in selected_ids if option.value != "none" else False
                 )
         for label, component, description in (
-            (presentation.PR_TITLE, self.pr_title, None),
             (presentation.PR_LINK, self.pr_link, None),
             (presentation.CATEGORIES, self.categories, None),
             (
@@ -367,6 +435,36 @@ def __init__(
                 )
             )
 
+    async def _linked_pull_request(
+        self,
+        interaction: discord.Interaction,
+    ) -> GitHubPullRequest | None:
+        identity = _parse_pull_request_link(str(self.pr_link.value).strip())
+        if identity is None:
+            await self._send_error(interaction, presentation.COULD_NOT_CREATE_TICKET)
+            return None
+        owner, repository, number = identity
+        if owner.casefold() != self._expected_organization.casefold():
+            await self._send_error(interaction, presentation.COULD_NOT_CREATE_TICKET)
+            return None
+        await interaction.response.defer(ephemeral=True)
+        try:
+            snapshot = await self._fetch_pull_request(owner, repository, number)
+        except Exception:
+            log.exception("GitHub Tickets pull request lookup failed")
+            await self._send_error(interaction, presentation.COULD_NOT_CREATE_TICKET)
+            return None
+        pull_request = _validated_pull_request(
+            snapshot,
+            owner=owner,
+            repository=repository,
+            number=number,
+            expected_organization=self._expected_organization,
+        )
+        if pull_request is None:
+            await self._send_error(interaction, presentation.COULD_NOT_CREATE_TICKET)
+        return pull_request
+
     async def on_submit(self, interaction: discord.Interaction) -> None:
         if not await _check_participant(interaction, self._actor_factory):
             return
@@ -398,10 +496,13 @@ async def on_submit(self, interaction: discord.Interaction) -> None:
         if any(category_id not in current_categories for category_id in category_ids):
             await self._send_error(interaction, presentation.CATEGORY_NO_LONGER_EXISTS)
             return
+        pull_request = await self._linked_pull_request(interaction)
+        if pull_request is None:
+            return
         request = TicketRequest(
             guild_id=self._guild_id,
-            pr_title=str(self.pr_title.value).strip(),
-            pr_url=str(self.pr_link.value).strip(),
+            pr_title=pull_request.title,
+            pr_url=pull_request.url,
             category_display=", ".join(
                 current_categories[category_id].name for category_id in category_ids
             ),
@@ -421,7 +522,7 @@ async def on_submit(self, interaction: discord.Interaction) -> None:
                 category_ids,
                 frozenset(excluded_user_ids),
             )
-            await interaction.response.send_message(
+            await interaction.followup.send(
                 presentation.confirm_categories(candidate_count),
                 view=ConfirmCategoriesView(
                     self._store,
@@ -430,7 +531,10 @@ async def on_submit(self, interaction: discord.Interaction) -> None:
                         current_categories[category_id] for category_id in category_ids
                     ),
                     request=request,
+                    pull_request=pull_request,
                     create_ticket=self._create_ticket,
+                    fetch_pull_request=self._fetch_pull_request,
+                    expected_organization=self._expected_organization,
                     actor_factory=self._actor_factory,
                     count_automatic_candidates=self._count_automatic_candidates,
                     automatic_candidate_exclusions=frozenset(excluded_user_ids),
@@ -438,35 +542,45 @@ async def on_submit(self, interaction: discord.Interaction) -> None:
                 ephemeral=True,
                 allowed_mentions=discord.AllowedMentions.none(),
             )
-            return
-        await _create_ticket_request(
-            interaction,
-            request=request,
-            create_ticket=self._create_ticket,
-            actor_factory=self._actor_factory,
-        )
+        else:
+            await _create_ticket_request(
+                interaction,
+                request=request,
+                pull_request=pull_request,
+                create_ticket=self._create_ticket,
+                actor_factory=self._actor_factory,
+            )
 
     @staticmethod
     async def _send_error(
         interaction: discord.Interaction,
         message: str | None,
     ) -> None:
-        await interaction.response.send_message(
-            message,
-            ephemeral=True,
-            allowed_mentions=discord.AllowedMentions.none(),
-        )
+        kwargs = {
+            "ephemeral": True,
+            "allowed_mentions": discord.AllowedMentions.none(),
+        }
+        if interaction.response.is_done():
+            await interaction.followup.send(message, **kwargs)
+        else:
+            await interaction.response.send_message(message, **kwargs)
 
 
 async def _create_ticket_request(
     interaction: discord.Interaction,
     *,
     request: TicketRequest,
+    pull_request: GitHubPullRequest,
     create_ticket: CreateTicket,
     actor_factory: ActorFactory,
 ) -> bool:
-    await interaction.response.defer()
-    result = await create_ticket(request, actor_factory(interaction))
+    if not interaction.response.is_done():
+        await interaction.response.defer(ephemeral=True)
+    result = await create_ticket(
+        request,
+        actor_factory(interaction),
+        pull_request,
+    )
     if result.success:
         return True
     await interaction.followup.send(result.response, ephemeral=True)
@@ -481,7 +595,10 @@ def __init__(
         guild_id: int,
         categories: Sequence[Category],
         request: TicketRequest,
+        pull_request: GitHubPullRequest,
         create_ticket: CreateTicket,
+        fetch_pull_request: FetchPullRequest,
+        expected_organization: str,
         actor_factory: ActorFactory,
         count_automatic_candidates: CountAutomaticCandidates,
         automatic_candidate_exclusions: frozenset[int],
@@ -491,7 +608,10 @@ def __init__(
         self._guild_id = guild_id
         self._categories = tuple(categories)
         self._request = request
+        self._pull_request = pull_request
         self._create_ticket = create_ticket
+        self._fetch_pull_request = fetch_pull_request
+        self._expected_organization = expected_organization
         self._actor_factory = actor_factory
         self._count_automatic_candidates = count_automatic_candidates
         self._automatic_candidate_exclusions = automatic_candidate_exclusions
@@ -597,6 +717,8 @@ async def _back(self, interaction: discord.Interaction) -> None:
                 guild_id=self._guild_id,
                 categories=categories,
                 create_ticket=self._create_ticket,
+                fetch_pull_request=self._fetch_pull_request,
+                expected_organization=self._expected_organization,
                 actor_factory=self._actor_factory,
                 count_automatic_candidates=self._count_automatic_candidates,
                 draft=self._selected_request(),
@@ -624,6 +746,7 @@ async def _create(self, interaction: discord.Interaction) -> None:
         if await _create_ticket_request(
             interaction,
             request=request,
+            pull_request=self._pull_request,
             create_ticket=self._create_ticket,
             actor_factory=self._actor_factory,
         ):
@@ -636,11 +759,20 @@ async def send_new_ticket_modal(
     *,
     guild_id: int,
     create_ticket: CreateTicket,
+    fetch_pull_request: FetchPullRequest | None,
+    expected_organization: str | None,
     actor_factory: ActorFactory,
     count_automatic_candidates: CountAutomaticCandidates,
 ) -> None:
     if not await _check_participant(interaction, actor_factory):
         return
+    if fetch_pull_request is None or not expected_organization:
+        await interaction.response.send_message(
+            GITHUB_INTEGRATION_UNAVAILABLE,
+            ephemeral=True,
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
+        return
     categories = await store.list_categories(guild_id)
     await interaction.response.send_modal(
         NewTicketModal(
@@ -648,6 +780,8 @@ async def send_new_ticket_modal(
             guild_id=guild_id,
             categories=categories,
             create_ticket=create_ticket,
+            fetch_pull_request=fetch_pull_request,
+            expected_organization=expected_organization,
             actor_factory=actor_factory,
             count_automatic_candidates=count_automatic_candidates,
         )
diff --git a/NHCogs/githubtickets/discord_projection.py b/NHCogs/githubtickets/discord_projection.py
index 1176839..427d07f 100644
--- a/NHCogs/githubtickets/discord_projection.py
+++ b/NHCogs/githubtickets/discord_projection.py
@@ -8,8 +8,10 @@
 
 from .models import Ticket
 from .presentation import (
+    add_categories_notification,
     automatic_review_notification,
     direct_review_notification,
+    draft_ticket_notification,
     thread_name,
     ticket_message,
 )
@@ -23,9 +25,14 @@ def __init__(
         self,
         bot,
         view_factory: Callable[[Ticket], discord.ui.View],
+        *,
+        category_prompt_view_factory: Callable[[Ticket], discord.ui.View],
+        draft_prompt_view_factory: Callable[[Ticket], discord.ui.View],
     ) -> None:
         self._bot = bot
         self._view_factory = view_factory
+        self._category_prompt_view_factory = category_prompt_view_factory
+        self._draft_prompt_view_factory = draft_prompt_view_factory
         self._sent_messages: dict[int, Any] = {}
 
     async def send_ticket(
@@ -95,6 +102,35 @@ async def create_thread(self, ticket: Ticket, message_id: int) -> int:
         self._sent_messages.pop(message_id, None)
         return thread.id
 
+    async def prompt_categories(self, ticket: Ticket, thread_id: int) -> None:
+        author_mention = (
+            f"<@{ticket.author_id}>" if ticket.author_id is not None else None
+        )
+        content = (
+            add_categories_notification(author_mention)
+            if author_mention is not None
+            else "Add categories to start automatic routing"
+        )
+        await self._send_thread_prompt(
+            thread_id,
+            content,
+            view=self._category_prompt_view_factory(ticket),
+            user_id=ticket.author_id,
+        )
+
+    async def prompt_draft_decision(self, ticket: Ticket) -> None:
+        if ticket.thread_id is None:
+            raise ProjectionNotFound
+        author_mention = (
+            f"<@{ticket.author_id}>" if ticket.author_id is not None else None
+        )
+        await self._send_thread_prompt(
+            ticket.thread_id,
+            draft_ticket_notification(author_mention),
+            view=self._draft_prompt_view_factory(ticket),
+            user_id=ticket.author_id,
+        )
+
     async def edit_ticket(
         self,
         ticket: Ticket,
@@ -143,6 +179,34 @@ async def ping_reviewer(
         except discord.NotFound as error:
             raise ProjectionNotFound from error
 
+    async def _send_thread_prompt(
+        self,
+        thread_id: int,
+        content: str,
+        *,
+        view: discord.ui.View,
+        user_id: int | None,
+    ) -> None:
+        thread = self._cached_channel(thread_id)
+        allowed_mentions = (
+            discord.AllowedMentions.none()
+            if user_id is None
+            else discord.AllowedMentions(
+                everyone=False,
+                users=[discord.Object(id=user_id)],
+                roles=False,
+                replied_user=False,
+            )
+        )
+        try:
+            await thread.send(
+                content,
+                view=view,
+                allowed_mentions=allowed_mentions,
+            )
+        except discord.NotFound as error:
+            raise ProjectionNotFound from error
+
     async def find_ping(
         self,
         thread_id: int,
diff --git a/NHCogs/githubtickets/event_handler.py b/NHCogs/githubtickets/event_handler.py
new file mode 100644
index 0000000..7f99852
--- /dev/null
+++ b/NHCogs/githubtickets/event_handler.py
@@ -0,0 +1,313 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+from collections.abc import Awaitable, Callable
+from dataclasses import replace
+from typing import Any
+
+from NHCogs.operational_errors import report_operational_error
+
+from . import events
+from .coordinator import TicketCoordinator
+from .models import GitHubDelivery, GitHubPullRequest, PullRequestObservationState, Ticket
+from .runtime import DeliveryDisposition
+from .store import GitHubTicketsStore
+
+_TICKET_LABEL = "discord-ticket"
+RefreshPullRequest = Callable[[GitHubPullRequest], Awaitable[GitHubPullRequest]]
+TicketFinished = Callable[[Ticket], Awaitable[None]]
+log = logging.getLogger(__name__)
+
+
+class _AmbiguousGitHubMapping(RuntimeError):
+    def __init__(self, login: str, count: int) -> None:
+        super().__init__(f"GitHub login {login} maps to {count} cached members")
+
+
+class GitHubEventTransitionDeferred(RuntimeError):
+    pass
+
+
+class GitHubEventHandler:
+    def __init__(
+        self,
+        store: GitHubTicketsStore,
+        coordinator: TicketCoordinator,
+        *,
+        bot: Any,
+        guild_id: int,
+        member_is_eligible: Callable[[Any], bool],
+        refresh_pull_request: RefreshPullRequest | None = None,
+        ticket_finished: TicketFinished | None = None,
+    ) -> None:
+        self._store = store
+        self._coordinator = coordinator
+        self._bot = bot
+        self._guild_id = guild_id
+        self._member_is_eligible = member_is_eligible
+        self._refresh_pull_request = refresh_pull_request
+        self._ticket_finished = ticket_finished
+
+    async def __call__(self, delivery: GitHubDelivery) -> DeliveryDisposition:
+        parsed = events.parse_delivery(delivery)
+        if parsed is None:
+            return DeliveryDisposition.IGNORED
+        if isinstance(parsed, events.GitHubAppLifecycleEvent):
+            return DeliveryDisposition.STOPPED
+        observation = await self._store.observe_pull_request(parsed.pull_request)
+        if observation.state is PullRequestObservationState.CONFLICT:
+            if self._refresh_pull_request is None:
+                raise GitHubEventTransitionDeferred(
+                    "GitHub pull request conflict could not be refreshed"
+                )
+            authoritative = await self._refresh_pull_request(parsed.pull_request)
+            observation = await self._store.observe_pull_request(
+                authoritative,
+                authoritative=True,
+            )
+            if observation.state is not PullRequestObservationState.APPLIED:
+                raise GitHubEventTransitionDeferred(
+                    "GitHub pull request conflict did not settle"
+                )
+        if isinstance(parsed, events.PullRequestEvent):
+            parsed = replace(
+                parsed,
+                action=self._reconciled_action(parsed, observation.pull_request),
+                pull_request=observation.pull_request,
+                assignee_logins=observation.pull_request.assignees,
+            )
+            await self._handle_pull_request(parsed)
+        else:
+            parsed = replace(
+                parsed,
+                pull_request=observation.pull_request,
+                assignee_logins=observation.pull_request.assignees,
+            )
+            await self._handle_review(parsed)
+        return DeliveryDisposition.PROCESSED
+
+    @staticmethod
+    def _reconciled_action(
+        event: events.PullRequestEvent,
+        pull_request: GitHubPullRequest,
+    ) -> events.PullRequestAction:
+        if event.action in {"assigned", "unassigned"} and event.assignee_login is not None:
+            assigned = any(
+                login.casefold() == event.assignee_login.casefold()
+                for login in pull_request.assignees
+            )
+            return "assigned" if assigned else "unassigned"
+        if event.action in {"labeled", "unlabeled"} and event.label is not None:
+            labeled = any(
+                label.casefold() == event.label.casefold() for label in pull_request.labels
+            )
+            return "labeled" if labeled else "unlabeled"
+        if event.action in {"closed", "reopened"}:
+            return "reopened" if pull_request.open else "closed"
+        if event.action in {"converted_to_draft", "ready_for_review"}:
+            return "converted_to_draft" if pull_request.draft else "ready_for_review"
+        return event.action
+
+    async def _handle_pull_request(self, event: events.PullRequestEvent) -> None:
+        pull_request = event.pull_request
+        labeled_for_ticket = (
+            event.action == "labeled"
+            and event.label is not None
+            and event.label.casefold() == _TICKET_LABEL
+        )
+        became_ready_with_label = event.action == "ready_for_review" and any(
+            label.casefold() == _TICKET_LABEL for label in pull_request.labels
+        )
+        if (
+            (labeled_for_ticket or became_ready_with_label)
+            and pull_request.open
+            and not pull_request.draft
+        ):
+            if not pull_request.title.strip():
+                return
+            author, ambiguous = await self._resolve_member(
+                pull_request.github_author_login,
+                require_eligible=True,
+            )
+            if ambiguous:
+                return
+            result = await self._coordinator.create_ticket_from_github(
+                self._guild_id,
+                pull_request,
+                author_id=int(author.id) if author is not None else None,
+            )
+            self._require_settled(result)
+        elif event.action == "closed":
+            result = await self._coordinator.finish_ticket_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+            )
+            self._require_settled(result)
+            if result.finished_ticket is not None and self._ticket_finished is not None:
+                try:
+                    await self._ticket_finished(result.finished_ticket)
+                except asyncio.CancelledError:
+                    raise
+                except Exception:
+                    log.exception("GitHub Tickets finished ticket log failed")
+        elif event.action == "converted_to_draft":
+            result = await self._coordinator.prompt_draft_decision_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+            )
+            self._require_settled(result)
+        elif event.action == "edited" and event.title_changed:
+            result = await self._coordinator.update_title_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+                title=pull_request.title,
+            )
+            self._require_settled(result)
+        elif event.action == "assigned":
+            candidate, candidate_login, ambiguous = await self._first_eligible_assignee(
+                self._assignee_logins(event),
+                author_login=pull_request.github_author_login,
+            )
+            if ambiguous or candidate is None or candidate_login is None:
+                return
+            result = await self._coordinator.claim_ticket_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+                user_id=int(candidate.id),
+                github_login=candidate_login,
+                github_write_required=False,
+            )
+            self._require_settled(result)
+        elif event.action == "unassigned":
+            await self._handle_unassigned(event)
+
+    async def _handle_review(self, event: events.PullRequestReviewEvent) -> None:
+        reviewer_login = event.reviewer_login
+        if (
+            event.state not in {"approved", "changes_requested"}
+            or reviewer_login is None
+            or reviewer_login.casefold() == event.pull_request.github_author_login.casefold()
+        ):
+            return
+        reviewer, ambiguous = await self._resolve_member(
+            reviewer_login,
+            require_eligible=True,
+        )
+        if ambiguous or reviewer is None:
+            return
+        already_assigned = any(
+            login.casefold() == reviewer_login.casefold() for login in event.assignee_logins
+        )
+        result = await self._coordinator.claim_ticket_from_github(
+            event.pull_request.repository_id,
+            event.pull_request.pr_number,
+            user_id=int(reviewer.id),
+            github_login=reviewer_login,
+            github_write_required=not already_assigned,
+        )
+        self._require_settled(result)
+
+    async def _handle_unassigned(self, event: events.PullRequestEvent) -> None:
+        pull_request = event.pull_request
+        removed = None
+        if event.assignee_login is not None:
+            removed, ambiguous = await self._resolve_member(
+                event.assignee_login,
+                require_eligible=False,
+            )
+            if ambiguous:
+                return
+        remaining_logins = tuple(
+            login
+            for login in event.assignee_logins
+            if event.assignee_login is None or login.casefold() != event.assignee_login.casefold()
+        )
+        candidate, candidate_login, ambiguous = await self._first_eligible_assignee(
+            remaining_logins,
+            author_login=pull_request.github_author_login,
+        )
+        if ambiguous:
+            return
+        if removed is not None:
+            result = await self._coordinator.unassign_ticket_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+                user_id=int(removed.id),
+            )
+            self._require_settled(result)
+        if candidate is not None and candidate_login is not None:
+            result = await self._coordinator.claim_ticket_from_github(
+                pull_request.repository_id,
+                pull_request.pr_number,
+                user_id=int(candidate.id),
+                github_login=candidate_login,
+                github_write_required=False,
+            )
+            self._require_settled(result)
+
+    async def _resolve_member(
+        self,
+        login: str,
+        *,
+        require_eligible: bool,
+    ) -> tuple[Any | None, bool]:
+        profiles = await self._store.list_profiles_by_github_username(
+            self._guild_id,
+            login,
+        )
+        guild = self._bot.get_guild(self._guild_id)
+        if guild is None:
+            return None, False
+        members: dict[int, Any] = {}
+        for profile in profiles:
+            member = guild.get_member(int(profile.user_id))
+            if member is not None:
+                members[int(member.id)] = member
+        if len(members) > 1:
+            await report_operational_error(
+                self._bot,
+                guild_id=self._guild_id,
+                source="GitHubTickets",
+                action="resolve GitHub identity",
+                error=_AmbiguousGitHubMapping(login, len(members)),
+            )
+            return None, True
+        member = next(iter(members.values()), None)
+        if require_eligible and member is not None and not self._eligible(member):
+            return None, False
+        return member, False
+
+    async def _first_eligible_assignee(
+        self,
+        logins: tuple[str, ...],
+        *,
+        author_login: str,
+    ) -> tuple[Any | None, str | None, bool]:
+        first = None
+        first_login = None
+        for login in logins:
+            if login.casefold() == author_login.casefold():
+                continue
+            member, ambiguous = await self._resolve_member(
+                login,
+                require_eligible=True,
+            )
+            if ambiguous:
+                return None, None, True
+            if first is None and member is not None:
+                first = member
+                first_login = login
+        return first, first_login, False
+
+    @staticmethod
+    def _assignee_logins(event: events.PullRequestEvent) -> tuple[str, ...]:
+        return tuple(dict.fromkeys(login.casefold() for login in event.assignee_logins))
+
+    def _eligible(self, member: Any) -> bool:
+        return self._member_is_eligible(member)
+
+    @staticmethod
+    def _require_settled(result: Any) -> None:
+        if not result.success:
+            raise GitHubEventTransitionDeferred("GitHub event transition did not settle")
diff --git a/NHCogs/githubtickets/events.py b/NHCogs/githubtickets/events.py
new file mode 100644
index 0000000..c18ba92
--- /dev/null
+++ b/NHCogs/githubtickets/events.py
@@ -0,0 +1,317 @@
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Literal, TypeAlias, cast
+
+from .models import GitHubDelivery, GitHubPullRequest
+
+PullRequestAction: TypeAlias = Literal[
+    "labeled",
+    "ready_for_review",
+    "opened",
+    "reopened",
+    "unlabeled",
+    "edited",
+    "synchronize",
+    "converted_to_draft",
+    "closed",
+    "assigned",
+    "unassigned",
+]
+GitHubAppLifecycleReason: TypeAlias = Literal[
+    "installation_suspended",
+    "installation_deleted",
+    "permissions_changed",
+    "repositories_removed",
+]
+
+
+class InvalidGitHubDelivery(ValueError):
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class PullRequestEvent:
+    action: PullRequestAction
+    pull_request: GitHubPullRequest
+    label: str | None = None
+    assignee_login: str | None = None
+    assignee_logins: tuple[str, ...] = ()
+    title_changed: bool = False
+
+
+@dataclass(frozen=True, slots=True)
+class PullRequestReviewEvent:
+    pull_request: GitHubPullRequest
+    state: str
+    reviewer_login: str | None
+    assignee_logins: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubAppLifecycleEvent:
+    reason: GitHubAppLifecycleReason
+    repository_ids: tuple[int, ...] = ()
+
+
+ParsedGitHubEvent: TypeAlias = (
+    PullRequestEvent | PullRequestReviewEvent | GitHubAppLifecycleEvent
+)
+
+_PULL_REQUEST_ACTIONS = frozenset(
+    {
+        "labeled",
+        "ready_for_review",
+        "opened",
+        "reopened",
+        "unlabeled",
+        "edited",
+        "synchronize",
+        "converted_to_draft",
+        "closed",
+        "assigned",
+        "unassigned",
+    }
+)
+_INVALID_MESSAGE = "GitHub delivery payload is invalid"
+
+
+def parse_delivery(delivery: GitHubDelivery) -> ParsedGitHubEvent | None:
+    lifecycle_reason = _LIFECYCLE_ACTIONS.get((delivery.event, delivery.action))
+    if lifecycle_reason is not None:
+        try:
+            payload = _payload(delivery)
+            _delivery_action(payload, delivery)
+            repository_ids = (
+                _removed_repository_ids(payload)
+                if lifecycle_reason == "repositories_removed"
+                else ()
+            )
+            return GitHubAppLifecycleEvent(lifecycle_reason, repository_ids)
+        except (json.JSONDecodeError, KeyError, TypeError, UnicodeDecodeError, ValueError):
+            raise InvalidGitHubDelivery(_INVALID_MESSAGE) from None
+    if delivery.event == "pull_request":
+        if delivery.action not in _PULL_REQUEST_ACTIONS:
+            return None
+        try:
+            return _parse_pull_request_event(delivery)
+        except (json.JSONDecodeError, KeyError, TypeError, UnicodeDecodeError, ValueError):
+            raise InvalidGitHubDelivery(_INVALID_MESSAGE) from None
+    if delivery.event == "pull_request_review":
+        if delivery.action != "submitted":
+            return None
+        try:
+            return _parse_review_event(delivery)
+        except (json.JSONDecodeError, KeyError, TypeError, UnicodeDecodeError, ValueError):
+            raise InvalidGitHubDelivery(_INVALID_MESSAGE) from None
+    return None
+
+
+_LIFECYCLE_ACTIONS: dict[
+    tuple[str, str | None],
+    GitHubAppLifecycleReason,
+] = {
+    ("installation", "suspend"): "installation_suspended",
+    ("installation", "deleted"): "installation_deleted",
+    ("installation", "new_permissions_accepted"): "permissions_changed",
+    ("installation_repositories", "removed"): "repositories_removed",
+}
+
+
+def _parse_pull_request_event(delivery: GitHubDelivery) -> PullRequestEvent:
+    payload = _payload(delivery)
+    action = _delivery_action(payload, delivery)
+    pull_request = _pull_request(payload, action)
+    label = None
+    if action in {"labeled", "unlabeled"}:
+        label_payload = _optional_mapping(payload, "label")
+        if label_payload is not None:
+            label = _string(label_payload, "name")
+    assignee_login = None
+    if action in {"assigned", "unassigned"}:
+        assignee = _optional_mapping(payload, "assignee")
+        if assignee is not None:
+            assignee_login = _string(assignee, "login")
+    changes = _optional_mapping(payload, "changes")
+    return PullRequestEvent(
+        action=cast(PullRequestAction, action),
+        pull_request=pull_request,
+        label=label,
+        assignee_login=assignee_login,
+        assignee_logins=_assignee_logins(payload),
+        title_changed=action == "edited" and changes is not None and "title" in changes,
+    )
+
+
+def _parse_review_event(delivery: GitHubDelivery) -> PullRequestReviewEvent:
+    payload = _payload(delivery)
+    action = _delivery_action(payload, delivery)
+    review = _mapping(payload, "review")
+    reviewer = _optional_mapping(review, "user")
+    state = _string(review, "state").strip().casefold()
+    if not state:
+        raise ValueError
+    return PullRequestReviewEvent(
+        pull_request=_pull_request(payload, action),
+        state=state,
+        reviewer_login=_string(reviewer, "login") if reviewer is not None else None,
+        assignee_logins=_assignee_logins(payload),
+    )
+
+
+def _delivery_action(
+    payload: Mapping[str, object],
+    delivery: GitHubDelivery,
+) -> str:
+    action = _string(payload, "action")
+    if action != delivery.action:
+        raise ValueError
+    return action
+
+
+def _payload(delivery: GitHubDelivery) -> Mapping[str, object]:
+    raw_body = delivery.raw_body
+    if raw_body is None:
+        raise ValueError
+    payload = json.loads(raw_body)
+    if not isinstance(payload, Mapping):
+        raise TypeError
+    return payload
+
+
+def _pull_request(
+    payload: Mapping[str, object],
+    action: str,
+) -> GitHubPullRequest:
+    repository = _mapping(payload, "repository")
+    pull_request = _mapping(payload, "pull_request")
+    author = _mapping(pull_request, "user")
+    state = _string(pull_request, "state").casefold()
+    if state not in {"open", "closed"}:
+        raise ValueError
+    repository_full_name = _string(repository, "full_name").strip()
+    owner, separator, repository_name = repository_full_name.partition("/")
+    if not separator or not owner or not repository_name or "/" in repository_name:
+        raise ValueError
+    draft = _optional_bool(pull_request, "draft", default=False)
+    _ = _optional_bool(pull_request, "merged", default=False)
+    labels = tuple(
+        _string(_mapping_value(label), "name") for label in _sequence(pull_request, "labels")
+    )
+    return GitHubPullRequest(
+        repository_id=_positive_integer(repository, "id"),
+        pr_number=_positive_integer(pull_request, "number"),
+        github_pr_id=_positive_integer(pull_request, "id"),
+        github_author_id=_positive_integer(author, "id"),
+        repository_full_name=repository_full_name,
+        url=_string(pull_request, "html_url"),
+        title=_string(pull_request, "title", allow_empty=True),
+        github_author_login=_string(author, "login"),
+        draft=draft,
+        open=state == "open",
+        labels=labels,
+        github_updated_at=_datetime(pull_request, "updated_at"),
+        assignees=_assignee_logins(payload),
+        last_processed_action=action,
+    )
+
+
+def _assignee_logins(payload: Mapping[str, object]) -> tuple[str, ...]:
+    pull_request = _mapping(payload, "pull_request")
+    assignees = pull_request.get("assignees")
+    if assignees is None:
+        return ()
+    if not isinstance(assignees, Sequence) or isinstance(
+        assignees,
+        (str, bytes, bytearray),
+    ):
+        return ()
+    logins: list[str] = []
+    for assignee in assignees:
+        if not isinstance(assignee, Mapping):
+            continue
+        login = assignee.get("login")
+        if isinstance(login, str) and login:
+            logins.append(login)
+    return tuple(logins)
+
+
+def _removed_repository_ids(payload: Mapping[str, object]) -> tuple[int, ...]:
+    repository_ids = tuple(
+        _positive_integer(_mapping_value(repository), "id")
+        for repository in _sequence(payload, "repositories_removed")
+    )
+    if not repository_ids:
+        raise ValueError
+    return repository_ids
+
+
+def _mapping(parent: Mapping[str, object], key: str) -> Mapping[str, object]:
+    return _mapping_value(parent[key])
+
+
+def _mapping_value(value: object) -> Mapping[str, object]:
+    if not isinstance(value, Mapping):
+        raise TypeError
+    return value
+
+
+def _optional_mapping(
+    parent: Mapping[str, object],
+    key: str,
+) -> Mapping[str, object] | None:
+    value = parent.get(key)
+    if value is None:
+        return None
+    return _mapping_value(value)
+
+
+def _sequence(parent: Mapping[str, object], key: str) -> Sequence[object]:
+    value = parent[key]
+    if not isinstance(value, Sequence) or isinstance(value, (str, bytes, bytearray)):
+        raise TypeError
+    return value
+
+
+def _string(
+    parent: Mapping[str, object],
+    key: str,
+    *,
+    allow_empty: bool = False,
+) -> str:
+    value = parent[key]
+    if not isinstance(value, str) or (not allow_empty and not value):
+        raise ValueError
+    return value
+
+
+def _positive_integer(parent: Mapping[str, object], key: str) -> int:
+    value = parent[key]
+    if not isinstance(value, int) or isinstance(value, bool) or value <= 0:
+        raise ValueError
+    return value
+
+
+def _optional_bool(
+    parent: Mapping[str, object],
+    key: str,
+    *,
+    default: bool,
+) -> bool:
+    value = parent.get(key)
+    if value is None:
+        return default
+    if not isinstance(value, bool):
+        raise TypeError
+    return value
+
+
+def _datetime(parent: Mapping[str, object], key: str) -> datetime:
+    value = _string(parent, key)
+    parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    if parsed.tzinfo is None:
+        raise ValueError
+    return parsed
diff --git a/NHCogs/githubtickets/github_app.py b/NHCogs/githubtickets/github_app.py
new file mode 100644
index 0000000..1dfcc83
--- /dev/null
+++ b/NHCogs/githubtickets/github_app.py
@@ -0,0 +1,424 @@
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import aiohttp
+import jwt
+
+from .models import GitHubPullRequest
+
+_API_ROOT = "https://api.github.com"
+_API_VERSION = "2022-11-28"
+_ACCEPT = "application/vnd.github+json"
+_USER_AGENT = "NHCogs-GitHubTickets"
+_JWT_BACKDATE = timedelta(seconds=60)
+_JWT_LIFETIME = timedelta(minutes=9)
+_TOKEN_REFRESH_MARGIN = timedelta(minutes=1)
+_HTTP_SUCCESS_MIN = 200
+_HTTP_REDIRECT_MIN = 300
+_HTTP_UNAUTHORIZED = 401
+_HTTP_FORBIDDEN = 403
+_HTTP_TOO_MANY_REQUESTS = 429
+_TRANSIENT_STATUSES = frozenset({500, 502, 503, 504})
+_REQUEST_TIMEOUT = aiohttp.ClientTimeout(total=30, connect=10)
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubAppCredentials:
+    organization: str
+    client_id: str
+    app_id: int
+    installation_id: int
+    private_key: bytes = field(repr=False)
+    webhook_secret: bytes = field(repr=False)
+
+
+@dataclass(frozen=True, slots=True)
+class PullRequestSnapshot:
+    pull_request_id: int
+    number: int
+    repository_id: int
+    repository_full_name: str
+    title: str
+    url: str
+    state: str
+    draft: bool
+    merged: bool
+    author_id: int
+    author_login: str
+    updated_at: datetime
+    labels: tuple[str, ...]
+    assignees: tuple[str, ...]
+
+
+def pull_request_from_snapshot(snapshot: PullRequestSnapshot) -> GitHubPullRequest:
+    state = snapshot.state.casefold()
+    if state not in {"open", "closed"}:
+        raise ValueError("pull request state is invalid")
+    return GitHubPullRequest(
+        repository_id=snapshot.repository_id,
+        pr_number=snapshot.number,
+        github_pr_id=snapshot.pull_request_id,
+        github_author_id=snapshot.author_id,
+        repository_full_name=snapshot.repository_full_name.strip(),
+        url=snapshot.url,
+        title=snapshot.title,
+        github_author_login=snapshot.author_login,
+        draft=snapshot.draft,
+        open=state == "open",
+        labels=snapshot.labels,
+        github_updated_at=snapshot.updated_at,
+        assignees=snapshot.assignees,
+    )
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubDeliverySummary:
+    delivery_id: int
+    guid: str
+    delivered_at: datetime
+    redelivery: bool
+    status_code: int
+    event: str
+    action: str | None
+
+
+class GitHubRequestError(RuntimeError):
+    def __init__(
+        self,
+        operation: str,
+        status: int | None = None,
+        *,
+        retryable: bool = False,
+        rate_limited: bool = False,
+        retry_at: datetime | None = None,
+    ) -> None:
+        self.operation = operation
+        self.status = status
+        self.retryable = retryable
+        self.rate_limited = rate_limited
+        self.retry_at = retry_at
+        suffix = "" if status is None else f" with status {status}"
+        super().__init__(f"GitHub {operation} failed{suffix}")
+
+
+class GitHubAssigneeUnavailable(RuntimeError):
+    def __init__(self, login: str) -> None:
+        self.login = login
+        super().__init__(f"GitHub did not assign {login}")
+
+
+class GitHubAppClient:
+    def __init__(
+        self,
+        credentials: GitHubAppCredentials,
+        session: Any,
+        *,
+        clock: Callable[[], datetime] | None = None,
+    ) -> None:
+        self._credentials = credentials
+        self._session = session
+        self._clock = clock or (lambda: datetime.now(tz=timezone.utc))
+        self._token: str | None = None
+        self._token_expires_at: datetime | None = None
+        self._token_lock = asyncio.Lock()
+
+    async def get_pull_request(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+    ) -> PullRequestSnapshot:
+        payload = await self._request_json(
+            "GET",
+            f"/repos/{owner}/{repository}/pulls/{number}",
+            operation="read pull request",
+        )
+        user = _mapping(payload["user"])
+        repository_payload = _mapping(_mapping(payload["base"])["repo"])
+        return PullRequestSnapshot(
+            pull_request_id=_integer(payload["id"]),
+            number=_integer(payload["number"]),
+            repository_id=_integer(repository_payload["id"]),
+            repository_full_name=str(repository_payload["full_name"]),
+            title=str(payload["title"]),
+            url=str(payload["html_url"]),
+            state=str(payload["state"]),
+            draft=bool(payload["draft"]),
+            merged=bool(payload["merged"]),
+            author_id=_integer(user["id"]),
+            author_login=str(user["login"]),
+            updated_at=_parse_datetime(payload["updated_at"]),
+            labels=tuple(str(_mapping(label)["name"]) for label in _sequence(payload["labels"])),
+            assignees=tuple(
+                str(_mapping(assignee)["login"]) for assignee in _sequence(payload["assignees"])
+            ),
+        )
+
+    async def add_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        payload = await self._request_json(
+            "POST",
+            f"/repos/{owner}/{repository}/issues/{number}/assignees",
+            operation="add assignee",
+            json={"assignees": [login]},
+        )
+        if login.casefold() not in {candidate.casefold() for candidate in _assignee_logins(payload)}:
+            raise GitHubAssigneeUnavailable(login)
+
+    async def remove_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        payload = await self._request_json(
+            "DELETE",
+            f"/repos/{owner}/{repository}/issues/{number}/assignees",
+            operation="remove assignee",
+            json={"assignees": [login]},
+        )
+        if login.casefold() in {candidate.casefold() for candidate in _assignee_logins(payload)}:
+            raise GitHubRequestError("remove assignee")
+
+    async def list_deliveries(self, *, page: int = 1) -> tuple[GitHubDeliverySummary, ...]:
+        payload = await self._app_request(
+            "GET",
+            f"/app/hook/deliveries?per_page=100&page={page}",
+            operation="list deliveries",
+            read_json=True,
+        )
+        deliveries = []
+        for raw_delivery in _sequence(payload):
+            delivery = _mapping(raw_delivery)
+            action = delivery.get("action")
+            deliveries.append(
+                GitHubDeliverySummary(
+                    delivery_id=_integer(delivery["id"]),
+                    guid=str(delivery["guid"]),
+                    delivered_at=_parse_datetime(delivery["delivered_at"]),
+                    redelivery=bool(delivery["redelivery"]),
+                    status_code=_integer(delivery["status_code"]),
+                    event=str(delivery["event"]),
+                    action=action if isinstance(action, str) else None,
+                )
+            )
+        return tuple(deliveries)
+
+    async def redeliver(self, delivery_id: int) -> None:
+        await self._app_request(
+            "POST",
+            f"/app/hook/deliveries/{delivery_id}/attempts",
+            operation="redeliver delivery",
+            read_json=False,
+        )
+
+    def invalidate_installation_token(self) -> None:
+        self._token = None
+        self._token_expires_at = None
+
+    async def _app_request(
+        self,
+        method: str,
+        path: str,
+        *,
+        operation: str,
+        read_json: bool,
+    ) -> object:
+        status, headers, payload = await self._send(
+            method,
+            path,
+            headers=_headers(self._app_jwt()),
+            operation=operation,
+            read_json=read_json,
+        )
+        if not _HTTP_SUCCESS_MIN <= status < _HTTP_REDIRECT_MIN:
+            raise _response_error(operation, status, headers, self._clock())
+        return payload
+
+    async def _request_json(
+        self,
+        method: str,
+        path: str,
+        *,
+        operation: str,
+        json: Mapping[str, object] | None = None,
+    ) -> Mapping[str, object]:
+        for attempt in range(2):
+            token = await self._installation_token()
+            status, headers, payload = await self._send(
+                method,
+                path,
+                headers=_headers(token),
+                operation=operation,
+                json=json,
+                read_json=True,
+            )
+            if status == _HTTP_UNAUTHORIZED and attempt == 0:
+                self._invalidate_token(token)
+                continue
+            if not _HTTP_SUCCESS_MIN <= status < _HTTP_REDIRECT_MIN:
+                raise _response_error(operation, status, headers, self._clock())
+            return _mapping(payload)
+        raise GitHubRequestError(operation)
+
+    async def _installation_token(self) -> str:
+        now = self._clock()
+        if self._token_valid(now):
+            return self._token or ""
+        async with self._token_lock:
+            now = self._clock()
+            if self._token_valid(now):
+                return self._token or ""
+            path = f"/app/installations/{self._credentials.installation_id}/access_tokens"
+            status, headers, raw_payload = await self._send(
+                "POST",
+                path,
+                headers=_headers(self._app_jwt()),
+                operation="installation token",
+                read_json=True,
+            )
+            if not _HTTP_SUCCESS_MIN <= status < _HTTP_REDIRECT_MIN:
+                raise _response_error("installation token", status, headers, self._clock())
+            payload = _mapping(raw_payload)
+            self._token = str(payload["token"])
+            self._token_expires_at = datetime.fromisoformat(
+                str(payload["expires_at"]).replace("Z", "+00:00")
+            )
+            return self._token
+
+    async def _send(
+        self,
+        method: str,
+        path: str,
+        *,
+        headers: Mapping[str, str],
+        operation: str,
+        read_json: bool,
+        json: Mapping[str, object] | None = None,
+    ) -> tuple[int, Mapping[str, str], object]:
+        try:
+            async with self._session.request(
+                method,
+                f"{_API_ROOT}{path}",
+                headers=headers,
+                json=json,
+                timeout=_REQUEST_TIMEOUT,
+            ) as response:
+                response_headers = {
+                    str(name).casefold(): str(value) for name, value in response.headers.items()
+                }
+                payload = (
+                    await response.json(content_type=None)
+                    if read_json and _HTTP_SUCCESS_MIN <= response.status < _HTTP_REDIRECT_MIN
+                    else None
+                )
+                return int(response.status), response_headers, payload
+        except (aiohttp.ClientError, asyncio.TimeoutError, OSError):
+            raise GitHubRequestError(operation, retryable=True) from None
+
+    def _app_jwt(self) -> str:
+        now = self._clock()
+        return jwt.encode(
+            {
+                "iat": int((now - _JWT_BACKDATE).timestamp()),
+                "exp": int((now + _JWT_LIFETIME).timestamp()),
+                "iss": self._credentials.client_id,
+            },
+            self._credentials.private_key,
+            algorithm="RS256",
+        )
+
+    def _token_valid(self, now: datetime) -> bool:
+        return (
+            self._token is not None
+            and self._token_expires_at is not None
+            and now < self._token_expires_at - _TOKEN_REFRESH_MARGIN
+        )
+
+    def _invalidate_token(self, rejected_token: str) -> None:
+        if self._token == rejected_token:
+            self._token = None
+            self._token_expires_at = None
+
+
+def _headers(token: str) -> dict[str, str]:
+    return {
+        "Accept": _ACCEPT,
+        "Authorization": f"Bearer {token}",
+        "X-GitHub-Api-Version": _API_VERSION,
+        "User-Agent": _USER_AGENT,
+    }
+
+
+def _mapping(value: object) -> Mapping[str, object]:
+    if not isinstance(value, Mapping):
+        raise GitHubRequestError("decode response")
+    return value
+
+
+def _sequence(value: object) -> tuple[object, ...]:
+    if not isinstance(value, list):
+        raise GitHubRequestError("decode response")
+    return tuple(value)
+
+
+def _integer(value: object) -> int:
+    if not isinstance(value, int) or isinstance(value, bool):
+        raise GitHubRequestError("decode response")
+    return value
+
+
+def _assignee_logins(payload: Mapping[str, object]) -> tuple[str, ...]:
+    return tuple(
+        str(_mapping(assignee)["login"]) for assignee in _sequence(payload["assignees"])
+    )
+
+
+def _parse_datetime(value: object) -> datetime:
+    return datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+
+
+def _response_error(
+    operation: str,
+    status: int,
+    headers: Mapping[str, str],
+    now: datetime,
+) -> GitHubRequestError:
+    retry_after = headers.get("retry-after")
+    rate_limit_reset = headers.get("x-ratelimit-reset")
+    rate_limited = status == _HTTP_TOO_MANY_REQUESTS or (
+        status == _HTTP_FORBIDDEN and (retry_after is not None or rate_limit_reset is not None)
+    )
+    retry_at = _retry_at(retry_after, rate_limit_reset, now) if rate_limited else None
+    return GitHubRequestError(
+        operation,
+        status,
+        retryable=rate_limited or status in _TRANSIENT_STATUSES,
+        rate_limited=rate_limited,
+        retry_at=retry_at,
+    )
+
+
+def _retry_at(retry_after: object, rate_limit_reset: object, now: datetime) -> datetime | None:
+    if retry_after is not None:
+        try:
+            return now + timedelta(seconds=max(0.0, float(str(retry_after))))
+        except ValueError:
+            pass
+    if rate_limit_reset is not None:
+        try:
+            return datetime.fromtimestamp(float(str(rate_limit_reset)), tz=timezone.utc)
+        except ValueError:
+            pass
+    return None
diff --git a/NHCogs/githubtickets/githubtickets.py b/NHCogs/githubtickets/githubtickets.py
index 0a30b3d..42aa3f4 100644
--- a/NHCogs/githubtickets/githubtickets.py
+++ b/NHCogs/githubtickets/githubtickets.py
@@ -2,23 +2,29 @@
 
 import asyncio
 import logging
-from datetime import datetime, timezone
+from collections.abc import Mapping
+from datetime import datetime, timedelta, timezone
 from typing import Literal
 
+import aiohttp
 import discord
 from redbot.core import Config, commands
 from redbot.core.bot import Red
 from redbot.core.data_manager import cog_data_path
 
 from .. import command_overview
+from ..operational_errors import report_operational_error
 from . import presentation, settings
 from .coordinator import TicketActor, TicketCoordinator, TicketResult
+from .credentials import InvalidGitHubAppCredentials, load_github_app_credentials
 from .dashboard import (
     GitHubTicketsDashboard,
     send_developer_profile,
     send_new_ticket_modal,
 )
 from .discord_projection import DiscordTicketProjection
+from .event_handler import GitHubEventHandler
+from .github_app import GitHubAppClient, pull_request_from_snapshot
 from .models import (
     CategoryAlreadyExists,
     CategoryLimitReached,
@@ -28,11 +34,14 @@
     TicketState,
 )
 from .routing import CandidateFacts
+from .runtime import GitHubIntegrationRuntime
 from .scheduler import DeadlineScheduler
 from .store import MAX_CATEGORY_NAME_LENGTH, GitHubTicketsStore
-from .ticket_views import TicketControls
+from .ticket_views import DraftTicketControls, GitHubCategoryPrompt, TicketControls
+from .webhook import GitHubWebhookReceiver
 
 log = logging.getLogger(__name__)
+_MAX_NETWORK_PORT = 65535
 
 
 class GitHubTickets(commands.Cog):
@@ -48,9 +57,16 @@ def __init__(self, bot: Red) -> None:
             force_registration=True,
         )
         self.config.register_guild(**settings.DEFAULTS)
-        self.store = GitHubTicketsStore(cog_data_path(self) / "githubtickets.sqlite")
+        self.config.register_global(**settings.GITHUB_INTEGRATION_DEFAULTS)
+        self._data_path = cog_data_path(self)
+        self.store = GitHubTicketsStore(self._data_path / "githubtickets.sqlite")
         self._participant_roles: dict[int, frozenset[int]] = {}
-        self.projection = DiscordTicketProjection(bot, self._ticket_view)
+        self.projection = DiscordTicketProjection(
+            bot,
+            self._ticket_view,
+            category_prompt_view_factory=self._github_category_prompt_view,
+            draft_prompt_view_factory=self._draft_ticket_view,
+        )
         self.coordinator = TicketCoordinator(
             self.store,
             self.projection,
@@ -59,6 +75,10 @@ def __init__(self, bot: Red) -> None:
             wake_deadlines=self._wake_deadlines,
         )
         self.scheduler = DeadlineScheduler(self.store, self._process_due_deadline)
+        self._github_session: aiohttp.ClientSession | None = None
+        self._github_client: GitHubAppClient | None = None
+        self._github_organization: str | None = None
+        self._github_runtime: GitHubIntegrationRuntime | None = None
         self._startup_task: asyncio.Task[None] | None = None
         self._new_ticket_command = discord.app_commands.Command(
             name=presentation.NEW_TICKET_COMMAND,
@@ -115,8 +135,33 @@ async def cog_unload(self) -> None:
                 pass
             except Exception:
                 pass
+        try:
+            await self._stop_github_integration()
+        except Exception:
+            log.exception("GitHub Tickets integration shutdown failed")
         await self.scheduler.close()
 
+    @commands.Cog.listener()
+    async def on_red_api_tokens_update(
+        self,
+        service_name: str,
+        _api_tokens: Mapping[str, str],
+    ) -> None:
+        if service_name != "githubtickets":
+            return
+        try:
+            await self._restart_github_integration()
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await report_operational_error(
+                self.bot,
+                guild_id=0,
+                source="GitHubTickets",
+                action="restart GitHub integration after API token update",
+                error=error,
+            )
+
     async def _restore_runtime(self) -> None:
         await self.bot.wait_until_red_ready()
         while True:
@@ -139,10 +184,130 @@ async def _restore_runtime_once(self) -> None:
             if ticket.message_id is None or ticket.message_id in self._restored_view_message_ids:
                 continue
             self.bot.add_view(self._ticket_view(ticket), message_id=ticket.message_id)
+            self.bot.add_view(self._github_category_prompt_view(ticket))
+            self.bot.add_view(self._draft_ticket_view(ticket))
             self._restored_view_message_ids.add(ticket.message_id)
         now = datetime.now(timezone.utc)
         for ticket_id in await self.store.due_ticket_ids(now):
             await self.coordinator.process_due(ticket_id)
+        await self._restart_github_integration()
+
+    async def _restart_github_integration(self) -> bool:
+        report_guild_id = 0
+        try:
+            await self._stop_github_integration()
+            integration_settings = settings.GitHubIntegrationSettings.from_mapping(
+                await self.config.all()
+            )
+            if integration_settings.guild_id is not None:
+                report_guild_id = integration_settings.guild_id
+            if not integration_settings.enabled:
+                return False
+            credentials = await load_github_app_credentials(self.bot, self._data_path)
+            if credentials is None:
+                raise RuntimeError("GitHub App credentials are not configured")
+            if (
+                integration_settings.guild_id is None
+                or not integration_settings.receiver_configured
+            ):
+                raise RuntimeError("GitHub integration receiver is not configured")
+            guild_id = integration_settings.guild_id
+            bind_host = integration_settings.bind_host
+            bind_port = integration_settings.bind_port
+            if bind_host is None or bind_port is None:
+                raise RuntimeError("GitHub integration receiver is not configured")
+            session = aiohttp.ClientSession()
+            client = GitHubAppClient(credentials, session)
+            receiver = GitHubWebhookReceiver(self.store, credentials)
+
+            async def refresh_pull_request(pull_request):
+                owner, separator, repository = pull_request.repository_full_name.partition("/")
+                if not separator or not owner or not repository or "/" in repository:
+                    raise ValueError("stored pull request repository is invalid")
+                snapshot = await client.get_pull_request(
+                    owner,
+                    repository,
+                    pull_request.pr_number,
+                )
+                return pull_request_from_snapshot(snapshot)
+
+            handler = GitHubEventHandler(
+                self.store,
+                self.coordinator,
+                bot=self.bot,
+                guild_id=guild_id,
+                member_is_eligible=lambda member: self._actor_for_member(
+                    guild_id,
+                    member,
+                ).can_participate,
+                refresh_pull_request=refresh_pull_request,
+                ticket_finished=self._log_github_finished_ticket,
+            )
+            runtime = GitHubIntegrationRuntime(
+                self.store,
+                client=client,
+                receiver=receiver,
+                delivery_handler=handler,
+                lifecycle_stopped=self._github_lifecycle_stopped,
+                bot=self.bot,
+                guild_id=guild_id,
+                clock=lambda: datetime.now(timezone.utc),
+                recovery_interval=timedelta(
+                    seconds=integration_settings.recovery_seconds
+                ),
+            )
+            try:
+                await runtime.start(bind_host, bind_port)
+            except BaseException:
+                await session.close()
+                raise
+            self._github_session = session
+            self._github_client = client
+            self._github_organization = credentials.organization
+            self._github_runtime = runtime
+            return True
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await report_operational_error(
+                self.bot,
+                guild_id=report_guild_id,
+                source="GitHubTickets",
+                action="start GitHub integration",
+                error=error,
+            )
+            return False
+
+    async def _stop_github_integration(self) -> None:
+        runtime = self._github_runtime
+        session = self._github_session
+        self._github_runtime = None
+        self._github_session = None
+        self._github_client = None
+        self._github_organization = None
+        try:
+            if runtime is not None:
+                await runtime.close()
+        finally:
+            if session is not None:
+                await session.close()
+
+    async def _github_lifecycle_stopped(
+        self,
+        runtime: GitHubIntegrationRuntime,
+    ) -> None:
+        if runtime is not self._github_runtime:
+            return
+        session = self._github_session
+        self._github_runtime = None
+        self._github_session = None
+        self._github_client = None
+        self._github_organization = None
+        try:
+            await self.config.set_raw("enabled", value=False)
+        finally:
+            if session is not None:
+                await session.close()
 
     @staticmethod
     def _observe_startup_task(task: asyncio.Task[None]) -> None:
@@ -235,7 +400,13 @@ async def _open_new_ticket(self, interaction: discord.Interaction) -> None:
             interaction,
             self.store,
             guild_id=guild_id,
-            create_ticket=self.coordinator.create_ticket,
+            create_ticket=self.coordinator.create_ticket_for_pull_request,
+            fetch_pull_request=(
+                self._github_client.get_pull_request
+                if self._github_client is not None
+                else None
+            ),
+            expected_organization=self._github_organization,
             actor_factory=self._actor_from_interaction,
             count_automatic_candidates=self._count_automatic_candidates,
         )
@@ -380,6 +551,23 @@ def _ticket_view(self, ticket: Ticket) -> TicketControls:
             mark_finished=self._finish_ticket,
         )
 
+    def _github_category_prompt_view(self, ticket: Ticket) -> GitHubCategoryPrompt:
+        return GitHubCategoryPrompt(
+            ticket.guild_id,
+            ticket.public_token,
+            actor_factory=self._actor_from_interaction,
+            get_categories=self.store.list_categories,
+            add_categories=self._add_ticket_categories,
+        )
+
+    def _draft_ticket_view(self, ticket: Ticket) -> DraftTicketControls:
+        return DraftTicketControls(
+            ticket.public_token,
+            actor_factory=self._actor_from_interaction,
+            keep_ticket=self._keep_draft_ticket,
+            remove_ticket=self._remove_draft_ticket,
+        )
+
     async def _ticket_action(self, action, public_token: str, actor: TicketActor):
         ticket = await self.store.get_ticket_by_public_token(public_token)
         if ticket is None:
@@ -395,6 +583,35 @@ async def _decline_ticket(self, public_token: str, actor: TicketActor):
     async def _unassign_ticket(self, public_token: str, actor: TicketActor):
         return await self._ticket_action(self.coordinator.unassign, public_token, actor)
 
+    async def _add_ticket_categories(
+        self,
+        public_token: str,
+        category_ids: tuple[int, ...],
+        actor: TicketActor,
+    ):
+        ticket = await self.store.get_ticket_by_public_token(public_token)
+        if ticket is None:
+            return TicketResult(False, presentation.TICKET_NOT_ACTIVE)
+        return await self.coordinator.add_ticket_categories(
+            ticket.ticket_id,
+            category_ids,
+            actor,
+        )
+
+    async def _keep_draft_ticket(self, public_token: str, actor: TicketActor):
+        return await self._ticket_action(
+            self.coordinator.keep_draft_ticket,
+            public_token,
+            actor,
+        )
+
+    async def _remove_draft_ticket(self, public_token: str, actor: TicketActor):
+        return await self._ticket_action(
+            self.coordinator.remove_draft_ticket,
+            public_token,
+            actor,
+        )
+
     async def _finish_ticket(self, public_token: str, actor: TicketActor):
         ticket = await self.store.get_ticket_by_public_token(public_token)
         if ticket is None:
@@ -404,7 +621,10 @@ async def _finish_ticket(self, public_token: str, actor: TicketActor):
             await self._log_finished_ticket(result.finished_ticket, actor.user_id)
         return result
 
-    async def _log_finished_ticket(self, ticket: Ticket, actor_id: int) -> None:
+    async def _log_github_finished_ticket(self, ticket: Ticket) -> None:
+        await self._log_finished_ticket(ticket, None)
+
+    async def _log_finished_ticket(self, ticket: Ticket, actor_id: int | None) -> None:
         try:
             guild_settings = await self._get_guild_settings(ticket.guild_id)
             if guild_settings.log_channel_id is None:
@@ -487,7 +707,11 @@ async def _get_candidates(self, ticket: Ticket) -> tuple[CandidateFacts, ...]:
         matching_profile_ids = await self._automatic_candidate_ids(
             ticket.guild_id,
             ticket.category_ids,
-            frozenset({ticket.author_id}),
+            (
+                frozenset()
+                if ticket.author_id is None
+                else frozenset({ticket.author_id})
+            ),
         )
         histories = await self.store.candidate_history(
             ticket.ticket_id,
@@ -682,10 +906,18 @@ async def _send_group_overview(
         titles = {
             "githubtickets": "GitHub Tickets",
             "logchannel": "Log channel",
+            "github": "GitHub integration",
+            "receiver": "GitHub receiver",
+            "recovery": "GitHub recovery",
         }
+        configuration_sender = (
+            self._send_github_configuration_overview
+            if ctx.command.name in {"github", "receiver", "recovery"}
+            else self._send_configuration_overview
+        )
         await command_overview.send_group_overview(
             ctx,
-            lambda: self._send_configuration_overview(ctx),
+            lambda: configuration_sender(ctx),
             include_descendants=include_descendants,
             title=titles.get(ctx.command.name),
         )
@@ -725,6 +957,167 @@ async def _send_configuration_overview(self, ctx: commands.Context) -> None:
                 allowed_mentions=discord.AllowedMentions.none(),
             )
 
+    async def _send_github_configuration_overview(self, ctx: commands.Context) -> None:
+        integration_settings = settings.GitHubIntegrationSettings.from_mapping(
+            await self.config.all()
+        )
+        credentials_valid: bool | None
+        try:
+            credentials = await load_github_app_credentials(self.bot, self._data_path)
+        except Exception:
+            credentials = None
+            credentials_valid = False
+        else:
+            credentials_valid = True if credentials is not None else None
+        receiver = None
+        if integration_settings.receiver_configured:
+            receiver = f"{integration_settings.bind_host}:{integration_settings.bind_port}"
+        content = presentation.github_integration_overview(
+            enabled=integration_settings.enabled,
+            organization=(credentials.organization if credentials is not None else None),
+            receiver=receiver,
+            credentials_valid=credentials_valid,
+            running=self._github_runtime is not None,
+            recovery_seconds=integration_settings.recovery_seconds,
+        )
+        await ctx.send(
+            content,
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
+
+    @githubtickets.group(name="github", invoke_without_command=True)
+    async def githubtickets_github(self, ctx: commands.Context) -> None:
+        """Configure the GitHub integration"""
+        await self._send_group_overview(ctx)
+
+    @githubtickets_github.command(name="enable")
+    async def githubtickets_github_enable(self, ctx: commands.Context) -> None:
+        """Enable the GitHub integration"""
+        integration_settings = settings.GitHubIntegrationSettings.from_mapping(
+            await self.config.all()
+        )
+        if not integration_settings.receiver_configured:
+            await ctx.send("GitHub receiver is not configured")
+            return
+        try:
+            credentials = await load_github_app_credentials(self.bot, self._data_path)
+        except InvalidGitHubAppCredentials as error:
+            await report_operational_error(
+                self.bot,
+                guild_id=ctx.guild.id,
+                source="GitHubTickets",
+                action="load GitHub credentials",
+                error=error,
+            )
+            await ctx.send("GitHub credentials are invalid")
+            return
+        except Exception as error:
+            await report_operational_error(
+                self.bot,
+                guild_id=ctx.guild.id,
+                source="GitHubTickets",
+                action="load GitHub credentials",
+                error=error,
+            )
+            await ctx.send("Could not read GitHub credentials")
+            return
+        if credentials is None:
+            await ctx.send("GitHub credentials are not configured")
+            return
+        await self.config.set_raw("guild_id", value=ctx.guild.id)
+        await self.config.set_raw("enabled", value=True)
+        if await self._restart_github_integration():
+            await ctx.send("GitHub integration enabled")
+        else:
+            await ctx.send("Could not start GitHub integration")
+
+    @githubtickets_github.command(name="disable")
+    async def githubtickets_github_disable(self, ctx: commands.Context) -> None:
+        """Disable the GitHub integration"""
+        await self.config.set_raw("enabled", value=False)
+        await self._restart_github_integration()
+        await ctx.send("GitHub integration disabled")
+
+    @githubtickets_github.group(name="receiver", invoke_without_command=True)
+    async def githubtickets_github_receiver(self, ctx: commands.Context) -> None:
+        """Configure the GitHub webhook receiver"""
+        await self._send_group_overview(ctx)
+
+    @githubtickets_github_receiver.command(name="set")
+    async def githubtickets_github_receiver_set(
+        self,
+        ctx: commands.Context,
+        host: str,
+        port: int,
+    ) -> None:
+        """Set the GitHub webhook receiver"""
+        normalized_host = host.strip()
+        if not normalized_host:
+            await ctx.send("Invalid host")
+            return
+        if not 1 <= port <= _MAX_NETWORK_PORT:
+            await ctx.send("Invalid port")
+            return
+        await self.config.set_raw("bind_host", value=normalized_host)
+        await self.config.set_raw("bind_port", value=port)
+        integration_settings = settings.GitHubIntegrationSettings.from_mapping(
+            await self.config.all()
+        )
+        if integration_settings.enabled and not await self._restart_github_integration():
+            await ctx.send("GitHub receiver saved but integration could not start")
+            return
+        await ctx.send(f"GitHub receiver set to {normalized_host}:{port}")
+
+    @githubtickets_github_receiver.command(name="clear")
+    async def githubtickets_github_receiver_clear(self, ctx: commands.Context) -> None:
+        """Clear the GitHub webhook receiver"""
+        await self.config.set_raw("bind_host", value=None)
+        await self.config.set_raw("bind_port", value=None)
+        await self.config.set_raw("enabled", value=False)
+        await self._restart_github_integration()
+        await ctx.send("GitHub receiver cleared and integration disabled")
+
+    @githubtickets_github.group(name="recovery", invoke_without_command=True)
+    async def githubtickets_github_recovery(self, ctx: commands.Context) -> None:
+        """Configure GitHub delivery recovery"""
+        await self._send_group_overview(ctx)
+
+    @githubtickets_github_recovery.command(name="interval")
+    async def githubtickets_github_recovery_interval(
+        self,
+        ctx: commands.Context,
+        duration: str,
+    ) -> None:
+        """Set the GitHub recovery interval"""
+        try:
+            seconds = settings.parse_duration(duration)
+        except (settings.InvalidDuration, settings.NegativeDuration):
+            await ctx.send(presentation.INVALID_DURATION)
+            return
+        if seconds <= 0:
+            await ctx.send(presentation.INVALID_DURATION)
+            return
+        await self.config.set_raw("recovery_seconds", value=seconds)
+        integration_settings = settings.GitHubIntegrationSettings.from_mapping(
+            await self.config.all()
+        )
+        if integration_settings.enabled and not await self._restart_github_integration():
+            await ctx.send("Recovery interval saved but integration could not start")
+            return
+        await ctx.send(
+            f"GitHub recovery interval set to {presentation.duration_text(seconds)}"
+        )
+
+    @githubtickets_github_recovery.command(name="run")
+    async def githubtickets_github_recovery_run(self, ctx: commands.Context) -> None:
+        """Queue GitHub delivery recovery"""
+        runtime = self._github_runtime
+        if runtime is None:
+            await ctx.send("GitHub integration is not running")
+            return
+        runtime.request_recovery()
+        await ctx.send("GitHub recovery queued")
+
     @githubtickets.group(name="channel", invoke_without_command=True)
     async def githubtickets_channel(self, ctx: commands.Context) -> None:
         """Configure the ticket channel"""
diff --git a/NHCogs/githubtickets/info.json b/NHCogs/githubtickets/info.json
index f482ce3..9b9a42f 100644
--- a/NHCogs/githubtickets/info.json
+++ b/NHCogs/githubtickets/info.json
@@ -13,12 +13,15 @@
     "utility",
     "redbot"
   ],
-  "requirements": [],
+  "requirements": [
+    "PyJWT>=2.8.0",
+    "cryptography>=41.0.0"
+  ],
   "min_bot_version": "3.5.23",
   "min_python_version": [
     3,
     10,
     0
   ],
-  "end_user_data_statement": "GitHubTickets stores guild and user IDs, optional GitHub usernames, expertise categories, pull request titles and links, Discord ticket locations, reviewer routing state, exclusions, ping history, and deadlines in SQLite. Finished tickets, deleted ticket messages or threads, guild removal, and Red user-data deletion remove the corresponding data. Discord message content is not read back into the database."
+  "end_user_data_statement": "GitHubTickets stores Discord guild and user IDs, optional GitHub user IDs and logins, categories, pull request repository IDs, pull request IDs and numbers, URLs, titles, authors, labels, draft and open state, update timestamps, Discord ticket locations, reviewer routing state, exclusions, ping history, and deadlines in SQLite. It stores GitHub delivery GUIDs and related event metadata for deduplication and recovery. Raw webhook request bodies are cleared after successful processing. Pending and failed deliveries, including terminal failures, may retain raw request bodies until the three-day delivery-body pruning window expires. Delivery identity and minimal result metadata are retained for at least seven days. GitHub add-assignee and remove-assignee outbox intents store ticket and transition IDs, repository and pull request identity, normalized GitHub login, state, retry counters, error summaries, and timestamps until their work is completed or cleaned up. Finished tickets and deleted ticket messages or threads remove corresponding ticket data. Guild removal clears the guild's GitHubTickets data. Red user-data deletion removes or redacts matching Discord-user profile and ticket data, but does not delete GitHub delivery identities or pull request rows that remain unbound. Discord message content is not read back into the database."
 }
diff --git a/NHCogs/githubtickets/models.py b/NHCogs/githubtickets/models.py
index 6d552fe..344cc53 100644
--- a/NHCogs/githubtickets/models.py
+++ b/NHCogs/githubtickets/models.py
@@ -19,6 +19,11 @@ class TicketState(str, Enum):
     FINISHING = "finishing"
 
 
+class TicketOrigin(str, Enum):
+    DISCORD = "discord"
+    GITHUB = "github"
+
+
 class NextAction(str, Enum):
     DIRECT_PING = "direct_ping"
     AUTOMATIC_PING = "automatic_ping"
@@ -38,6 +43,35 @@ class ExclusionReason(str, Enum):
     TIMED_OUT = "timed_out"
 
 
+class GitHubDeliveryState(str, Enum):
+    PENDING = "pending"
+    PROCESSING = "processing"
+    RETRY = "retry"
+    AWAITING_REDELIVERY = "awaiting_redelivery"
+    PROCESSED = "processed"
+    IGNORED = "ignored"
+    FAILED = "failed"
+
+
+class GitHubOutboxOperation(str, Enum):
+    ADD_ASSIGNEE = "add_assignee"
+    REMOVE_ASSIGNEE = "remove_assignee"
+
+
+class GitHubOutboxState(str, Enum):
+    PENDING = "pending"
+    PROCESSING = "processing"
+    RETRY = "retry"
+    SUCCEEDED = "succeeded"
+    FAILED = "failed"
+
+
+class PullRequestObservationState(str, Enum):
+    APPLIED = "applied"
+    STALE = "stale"
+    CONFLICT = "conflict"
+
+
 class InvalidCategoryName(ValueError):
     pass
 
@@ -50,6 +84,10 @@ class CategoryLimitReached(ValueError):
     pass
 
 
+class ActivePullRequestTicketExists(ValueError):
+    pass
+
+
 @dataclass(frozen=True, slots=True)
 class Category:
     category_id: int
@@ -83,7 +121,7 @@ class CandidateHistory:
 class NewTicket:
     guild_id: int
     channel_id: int
-    author_id: int
+    author_id: int | None
     pr_title: str
     pr_url: str
     category_display: str
@@ -91,6 +129,7 @@ class NewTicket:
     direct_target_id: int | None
     category_ids: tuple[int, ...]
     created_at: datetime
+    origin: TicketOrigin = TicketOrigin.DISCORD
 
 
 @dataclass(frozen=True, slots=True)
@@ -100,7 +139,7 @@ class Ticket:
     channel_id: int
     message_id: int | None
     thread_id: int | None
-    author_id: int
+    author_id: int | None
     pr_title: str
     pr_url: str
     category_display: str
@@ -123,6 +162,72 @@ class Ticket:
     category_ids: tuple[int, ...]
     public_token: str = ""
     pending_ping_reserved_at: datetime | None = None
+    origin: TicketOrigin = TicketOrigin.DISCORD
+    category_prompt_retry_at: datetime | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubPullRequest:
+    repository_id: int
+    pr_number: int
+    github_pr_id: int
+    github_author_id: int
+    repository_full_name: str
+    url: str
+    title: str
+    github_author_login: str
+    draft: bool
+    open: bool
+    labels: tuple[str, ...]
+    github_updated_at: datetime
+    assignees: tuple[str, ...] = ()
+    current_ticket_id: int | None = None
+    last_processed_action: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class PullRequestObservation:
+    state: PullRequestObservationState
+    pull_request: GitHubPullRequest
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubDelivery:
+    delivery_guid: str
+    github_delivery_id: int | None
+    event: str
+    action: str | None
+    installation_id: int
+    repository_id: int | None
+    pr_number: int | None
+    received_at: datetime
+    state: GitHubDeliveryState
+    attempts: int
+    next_attempt_at: datetime | None
+    processing_started_at: datetime | None
+    completed_at: datetime | None
+    error_summary: str | None
+    raw_body: bytes | None
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubOutboxItem:
+    outbox_id: int
+    operation: GitHubOutboxOperation
+    ticket_id: int
+    transition_version: int
+    repository_id: int
+    repository_full_name: str
+    pr_number: int
+    github_login: str
+    actor_user_id: int | None
+    state: GitHubOutboxState
+    attempts: int
+    next_attempt_at: datetime | None
+    processing_started_at: datetime | None
+    error_summary: str | None
+    created_at: datetime
+    updated_at: datetime
 
 
 @dataclass(frozen=True, slots=True)
diff --git a/NHCogs/githubtickets/presentation.py b/NHCogs/githubtickets/presentation.py
index 12c33cd..aa1ada8 100644
--- a/NHCogs/githubtickets/presentation.py
+++ b/NHCogs/githubtickets/presentation.py
@@ -7,6 +7,7 @@
 MAX_PR_TITLE_LENGTH = 256
 MAX_PR_URL_LENGTH = 1_024
 MAX_GITHUB_USERNAME_LENGTH = 100
+MAX_GITHUB_PROFILE_LINK_LENGTH = 100
 _MAX_USER_MENTION = "<@18446744073709551615>"
 
 NEW_TICKET_COMMAND = "newticket"
@@ -21,7 +22,8 @@
 FIND_BY_GITHUB_USERNAME = "Find by GitHub username"
 CLEAR_PROFILE = "Clear Profile"
 GITHUB_USERNAME = "GitHub username"
-GITHUB_USERNAME_DESCRIPTION = "Leave empty if it matches your Discord name"
+GITHUB_PROFILE_LINK = "GitHub profile link"
+GITHUB_PROFILE_LINK_DESCRIPTION = "Used to assign you to pull requests"
 ENTER_GITHUB_USERNAME = "Enter a GitHub username"
 CATEGORIES = "Categories"
 SELECT_YOUR_CATEGORIES = "Select your categories"
@@ -54,6 +56,10 @@
 CLAIM = "Claim"
 DECLINE = "Decline"
 UNASSIGN = "Unassign"
+ADD_CATEGORIES = "Add Categories"
+KEEP_TICKET = "Keep Ticket"
+REMOVE_TICKET = "Remove Ticket"
+CATEGORIES_ADDED = "Categories added"
 TICKET_CHANNEL_NOT_CONFIGURED = "Ticket channel is not configured"
 CANNOT_USE_ACTION = "You cannot use this action"
 TICKET_NOT_ACTIVE = "This ticket is no longer active"
@@ -77,6 +83,7 @@
 INVALID_DURATION = "Invalid duration"
 DURATION_NEGATIVE = "Duration cannot be negative"
 INVALID_USER_ID = "Invalid user ID"
+INVALID_GITHUB_PROFILE_LINK = "Enter a valid GitHub profile link"
 
 HELP_COPY = (
     "Configure GitHub Tickets",
@@ -116,7 +123,8 @@
     BROWSE_CATEGORIES,
     CLEAR_PROFILE,
     GITHUB_USERNAME,
-    GITHUB_USERNAME_DESCRIPTION,
+    GITHUB_PROFILE_LINK,
+    GITHUB_PROFILE_LINK_DESCRIPTION,
     CATEGORIES,
     SELECT_YOUR_CATEGORIES,
     ALLOW_AUTOMATIC_PINGS,
@@ -146,6 +154,10 @@
     CLAIM,
     DECLINE,
     UNASSIGN,
+    ADD_CATEGORIES,
+    KEEP_TICKET,
+    REMOVE_TICKET,
+    CATEGORIES_ADDED,
     TICKET_CHANNEL_NOT_CONFIGURED,
     CANNOT_USE_ACTION,
     TICKET_NOT_ACTIVE,
@@ -168,6 +180,7 @@
     INVALID_DURATION,
     DURATION_NEGATIVE,
     INVALID_USER_ID,
+    INVALID_GITHUB_PROFILE_LINK,
     *HELP_COPY,
 )
 
@@ -184,6 +197,15 @@ def confirm_categories(candidate_count: int) -> str:
     return f"{CONFIRM_CATEGORIES}\n{detail}"
 
 
+def add_categories_notification(author_mention: str) -> str:
+    return f"{author_mention} add categories to start automatic routing"
+
+
+def draft_ticket_notification(author_mention: str | None) -> str:
+    prompt = "This pull request was converted to a draft. Keep or remove its ticket?"
+    return prompt if author_mention is None else f"{author_mention} {prompt}"
+
+
 def _linked_title(title: str, url: str) -> str:
     return f"[{title}](<{url}>)"
 
@@ -212,11 +234,15 @@ def finished_ticket_log(
     *,
     title: str,
     url: str,
-    actor_id: int,
-    author_id: int,
+    actor_id: int | None,
+    author_id: int | None,
     reviewer_id: int | None,
 ) -> str:
-    metadata = [f"Finished by <@{actor_id}>", f"Author <@{author_id}>"]
+    metadata = [
+        f"Finished by <@{actor_id}>" if actor_id is not None else "Finished from GitHub"
+    ]
+    if author_id is not None:
+        metadata.append(f"Author <@{author_id}>")
     if reviewer_id is not None:
         metadata.append(f"Reviewer <@{reviewer_id}>")
     return f"{_linked_title(title, url)}\n{' | '.join(metadata)}"
@@ -363,6 +389,34 @@ def configuration_overview(
     return "\n".join(lines)
 
 
+def github_integration_overview(
+    *,
+    enabled: bool,
+    organization: str | None,
+    receiver: str | None,
+    credentials_valid: bool | None,
+    running: bool,
+    recovery_seconds: int,
+) -> str:
+    credentials = (
+        "Available"
+        if credentials_valid is True
+        else "Invalid"
+        if credentials_valid is False
+        else "Not configured"
+    )
+    return "\n".join(
+        (
+            f"Enabled: {'Yes' if enabled else 'No'}",
+            f"Organization: {organization or 'Not configured'}",
+            f"Receiver: {receiver or 'Not configured'}",
+            f"Credentials: {credentials}",
+            f"Runtime: {'Running' if running else 'Stopped'}",
+            f"Recovery interval: {duration_text(recovery_seconds)}",
+        )
+    )
+
+
 def ticket_channel_set(channel_mention: str) -> str:
     return f"Ticket channel set to {channel_mention}"
 
diff --git a/NHCogs/githubtickets/projection.py b/NHCogs/githubtickets/projection.py
index 41b2d4a..658a430 100644
--- a/NHCogs/githubtickets/projection.py
+++ b/NHCogs/githubtickets/projection.py
@@ -28,6 +28,10 @@ async def find_ticket_thread(self, ticket: Ticket) -> int | None: ...
 
     async def create_thread(self, ticket: Ticket, message_id: int) -> int: ...
 
+    async def prompt_categories(self, ticket: Ticket, thread_id: int) -> None: ...
+
+    async def prompt_draft_decision(self, ticket: Ticket) -> None: ...
+
     async def edit_ticket(
         self,
         ticket: Ticket,
diff --git a/NHCogs/githubtickets/runtime.py b/NHCogs/githubtickets/runtime.py
new file mode 100644
index 0000000..03b54f2
--- /dev/null
+++ b/NHCogs/githubtickets/runtime.py
@@ -0,0 +1,671 @@
+from __future__ import annotations
+
+import asyncio
+import random
+from collections.abc import Awaitable, Callable
+from datetime import datetime, timedelta
+from enum import Enum
+from typing import Any, TypeVar
+
+from NHCogs.operational_errors import report_operational_error
+
+from .github_app import (
+    GitHubAppClient,
+    GitHubAssigneeUnavailable,
+    GitHubDeliverySummary,
+    GitHubRequestError,
+)
+from .models import (
+    GitHubDelivery,
+    GitHubDeliveryState,
+    GitHubOutboxItem,
+    GitHubOutboxOperation,
+)
+from .store import DELIVERY_IDENTITY_RETENTION, GitHubTicketsStore
+from .webhook import GitHubWebhookReceiver
+
+_DELIVERIES_PER_PAGE = 100
+_HTTP_SUCCESS_MIN = 200
+_HTTP_REDIRECT_MIN = 300
+_ResultT = TypeVar("_ResultT")
+
+
+class DeliveryDisposition(str, Enum):
+    PROCESSED = "processed"
+    IGNORED = "ignored"
+    STOPPED = "stopped"
+
+
+class GitHubIntegrationRuntime:
+    def __init__(
+        self,
+        store: GitHubTicketsStore,
+        *,
+        client: GitHubAppClient | None,
+        receiver: GitHubWebhookReceiver | None,
+        delivery_handler: Callable[[GitHubDelivery], Awaitable[DeliveryDisposition]],
+        lifecycle_stopped: (
+            Callable[[GitHubIntegrationRuntime], Awaitable[None]] | None
+        ) = None,
+        bot: Any,
+        guild_id: int,
+        clock: Callable[[], datetime],
+        poll_interval: float = 1.0,
+        recovery_interval: timedelta = timedelta(minutes=15),
+        stale_after: timedelta = timedelta(minutes=5),
+        retry_base: timedelta = timedelta(seconds=30),
+        retry_cap: timedelta = timedelta(minutes=15),
+        max_delivery_attempts: int = 5,
+        max_outbox_attempts: int = 5,
+        max_recovery_pages: int = 10,
+        max_redeliveries_per_recovery: int = 100,
+        random_source: random.Random | None = None,
+    ) -> None:
+        if (client is None) != (receiver is None):
+            raise ValueError("GitHub client and webhook receiver must be configured together")
+        if poll_interval < 0:
+            raise ValueError("poll interval cannot be negative")
+        if recovery_interval <= timedelta(0) or stale_after <= timedelta(0):
+            raise ValueError("recovery and stale intervals must be positive")
+        if retry_base <= timedelta(0) or retry_cap < retry_base:
+            raise ValueError("retry delays must be positive and ordered")
+        if max_delivery_attempts < 1:
+            raise ValueError("delivery attempt limit must be positive")
+        if max_outbox_attempts < 1:
+            raise ValueError("outbox attempt limit must be positive")
+        if max_recovery_pages < 1 or max_redeliveries_per_recovery < 1:
+            raise ValueError("recovery limits must be positive")
+        self._store = store
+        self._client = client
+        self._receiver = receiver
+        self._delivery_handler = delivery_handler
+        self._lifecycle_stopped = lifecycle_stopped
+        self._bot = bot
+        self._guild_id = guild_id
+        self._clock = clock
+        self._poll_interval = poll_interval
+        self._recovery_interval = recovery_interval
+        self._stale_after = stale_after
+        self._retry_base = retry_base
+        self._retry_cap = retry_cap
+        self._max_delivery_attempts = max_delivery_attempts
+        self._max_outbox_attempts = max_outbox_attempts
+        self._max_recovery_pages = max_recovery_pages
+        self._max_redeliveries_per_recovery = max_redeliveries_per_recovery
+        self._random = random_source or random.Random()
+        self._github_mutation_lock = asyncio.Lock()
+        self._recovery_lock = asyncio.Lock()
+        self._recovery_requested = asyncio.Event()
+        self._recovery_not_before: datetime | None = None
+        self._recovery_failure_attempts = 0
+        self._stop_requested = asyncio.Event()
+        self._token_invalidated = False
+        self._tasks: list[asyncio.Task[None]] = []
+        self._started = False
+
+    async def start(self, host: str, port: int) -> int | None:
+        if self._started:
+            raise RuntimeError("GitHub integration runtime is already running")
+        self._stop_requested.clear()
+        self._token_invalidated = False
+        self._started = True
+        if self._receiver is None:
+            return None
+        try:
+            bound_port = await self._receiver.start(host, port)
+        except BaseException:
+            self._started = False
+            raise
+        self._tasks = [
+            asyncio.create_task(
+                self._guard_background("process webhook deliveries", self._delivery_loop),
+                name="githubtickets-deliveries",
+            ),
+            asyncio.create_task(
+                self._guard_background("process GitHub outbox", self._outbox_loop),
+                name="githubtickets-outbox",
+            ),
+            asyncio.create_task(
+                self._guard_background("recover GitHub deliveries", self._recovery_loop),
+                name="githubtickets-recovery",
+            ),
+        ]
+        return bound_port
+
+    async def close(self) -> None:
+        if not self._started and not self._tasks:
+            return
+        self._stop_requested.set()
+        try:
+            if self._receiver is not None:
+                await self._receiver.close()
+        finally:
+            current = asyncio.current_task()
+            tasks = [task for task in self._tasks if task is not current]
+            for task in tasks:
+                task.cancel()
+            await asyncio.gather(*tasks, return_exceptions=True)
+            self._invalidate_client_token()
+            self._tasks = [
+                task for task in self._tasks if task is current and not task.done()
+            ]
+            self._started = False
+
+    async def run_recovery(self) -> None:
+        if self._client is None:
+            return
+        self._recovery_requested.set()
+        if self._recovery_lock.locked():
+            return
+        while self._recovery_requested.is_set():
+            async with self._recovery_lock:
+                if not self._recovery_requested.is_set():
+                    return
+                self._recovery_requested.clear()
+                await self._run_recovery_once()
+
+    async def _run_recovery_once(self) -> None:
+        if (
+            self._recovery_not_before is not None
+            and self._clock() < self._recovery_not_before
+        ):
+            return
+        self._recovery_not_before = None
+        try:
+            await self._recover_deliveries()
+        finally:
+            try:
+                await self._await_store(self._store.prune_deliveries(self._clock()))
+            except asyncio.CancelledError:
+                raise
+            except Exception as error:
+                await self._report("prune GitHub webhook deliveries", error)
+
+    def request_recovery(self) -> None:
+        self._recovery_requested.set()
+
+    async def _recover_deliveries(self) -> None:
+        client = self._client
+        if client is None:
+            raise RuntimeError("GitHub integration is not configured")
+        redeliveries = 0
+        identity_cutoff = self._clock() - DELIVERY_IDENTITY_RETENTION
+        start_page, resume_after_delivery_id = await self._await_store(
+            self._store.get_delivery_recovery_checkpoint()
+        )
+        for page in range(start_page, start_page + self._max_recovery_pages):
+            try:
+                deliveries = await client.list_deliveries(page=page)
+            except asyncio.CancelledError:
+                raise
+            except Exception as error:
+                await self._report("list GitHub webhook deliveries", error)
+                self._apply_recovery_failure(error)
+                return
+            listed_count = len(deliveries)
+            if resume_after_delivery_id is not None:
+                resume_index = next(
+                    (
+                        index
+                        for index, delivery in enumerate(deliveries)
+                        if delivery.delivery_id == resume_after_delivery_id
+                    ),
+                    None,
+                )
+                if resume_index is not None:
+                    deliveries = deliveries[resume_index + 1 :]
+                resume_after_delivery_id = None
+            attempted, last_checked_delivery_id, stopped = (
+                await self._recover_delivery_page(
+                    deliveries,
+                    identity_cutoff=identity_cutoff,
+                    remaining_redeliveries=(
+                        self._max_redeliveries_per_recovery - redeliveries
+                    ),
+                )
+            )
+            redeliveries += attempted
+            if stopped:
+                await self._save_recovery_checkpoint(
+                    next_page=page,
+                    last_delivery_id=last_checked_delivery_id,
+                )
+                return
+            if listed_count < _DELIVERIES_PER_PAGE:
+                await self._save_recovery_checkpoint(
+                    next_page=1,
+                    last_delivery_id=None,
+                )
+                return
+            await self._save_recovery_checkpoint(
+                next_page=page + 1,
+                last_delivery_id=last_checked_delivery_id,
+            )
+
+    async def _recover_delivery_page(
+        self,
+        deliveries: tuple[GitHubDeliverySummary, ...],
+        *,
+        identity_cutoff: datetime,
+        remaining_redeliveries: int,
+    ) -> tuple[int, int | None, bool]:
+        client = self._client
+        if client is None:
+            raise RuntimeError("GitHub integration is not configured")
+        attempted = 0
+        last_checked_delivery_id: int | None = None
+        for delivery in deliveries:
+            failed_summary = not (
+                _HTTP_SUCCESS_MIN <= delivery.status_code < _HTTP_REDIRECT_MIN
+            )
+            if delivery.delivered_at < identity_cutoff or (
+                delivery.redelivery and not failed_summary
+            ):
+                last_checked_delivery_id = delivery.delivery_id
+                continue
+            should_redeliver, prepared_body = (
+                await self._prepare_recovery_redelivery(
+                    delivery,
+                    redelivery_available=attempted < remaining_redeliveries,
+                )
+            )
+            if not should_redeliver:
+                last_checked_delivery_id = delivery.delivery_id
+                continue
+            if attempted >= remaining_redeliveries:
+                return attempted, last_checked_delivery_id, True
+            attempted += 1
+            checked, stopped = await self._redeliver_recovery_delivery(
+                delivery,
+                prepared_body,
+            )
+            if checked:
+                last_checked_delivery_id = delivery.delivery_id
+            if stopped:
+                return attempted, last_checked_delivery_id, True
+        return attempted, last_checked_delivery_id, False
+
+    async def _prepare_recovery_redelivery(
+        self,
+        delivery: GitHubDeliverySummary,
+        *,
+        redelivery_available: bool,
+    ) -> tuple[bool, bytes | None]:
+        try:
+            local_delivery = await self._await_store(
+                self._store.get_delivery(delivery.guid)
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report(
+                f"inspect GitHub webhook delivery {delivery.delivery_id}",
+                error,
+            )
+            return False, None
+        should_redeliver = local_delivery is None or (
+            local_delivery.state
+            in {
+                GitHubDeliveryState.FAILED,
+                GitHubDeliveryState.AWAITING_REDELIVERY,
+            }
+            and (
+                local_delivery.next_attempt_at is None
+                or local_delivery.next_attempt_at <= self._clock()
+            )
+        )
+        if not should_redeliver or not redelivery_available:
+            return should_redeliver, None
+        if local_delivery is None:
+            return True, None
+        prepared_body = local_delivery.raw_body
+        now = self._clock()
+        try:
+            prepared = await self._await_store(
+                self._store.prepare_delivery_redelivery(
+                    delivery.guid,
+                    github_delivery_id=delivery.delivery_id,
+                    now=now,
+                    next_attempt_at=now + self._retry_base,
+                )
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report(
+                f"prepare GitHub webhook redelivery {delivery.delivery_id}",
+                error,
+            )
+            return False, None
+        if not prepared:
+            return False, None
+        return True, prepared_body
+
+    async def _redeliver_recovery_delivery(
+        self,
+        delivery: GitHubDeliverySummary,
+        prepared_body: bytes | None,
+    ) -> tuple[bool, bool]:
+        client = self._client
+        if client is None:
+            raise RuntimeError("GitHub integration is not configured")
+        try:
+            async with self._github_mutation_lock:
+                await client.redeliver(delivery.delivery_id)
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report(
+                f"redeliver GitHub webhook delivery {delivery.delivery_id}",
+                error,
+            )
+            next_attempt_at = self._apply_recovery_failure(error)
+            retryable, _rate_limited, _retry_at = _classify_github_request(error)
+            try:
+                await self._await_store(
+                    self._store.restore_delivery_redelivery(
+                        delivery.guid,
+                        raw_body=prepared_body,
+                        next_attempt_at=next_attempt_at,
+                        error_summary=_error_summary(error),
+                    )
+                )
+            except asyncio.CancelledError:
+                raise
+            except Exception as restore_error:
+                await self._report(
+                    f"restore GitHub webhook delivery {delivery.delivery_id}",
+                    restore_error,
+                )
+            return not retryable, True
+        self._recovery_failure_attempts = 0
+        return True, False
+
+    async def _guard_background(
+        self,
+        action: str,
+        operation: Callable[[], Awaitable[None]],
+    ) -> None:
+        while not self._stop_requested.is_set():
+            try:
+                await operation()
+            except asyncio.CancelledError:
+                raise
+            except Exception as error:
+                await self._report(action, error)
+                await asyncio.sleep(self._poll_interval)
+
+    async def _delivery_loop(self) -> None:
+        while not self._stop_requested.is_set():
+            now = self._clock()
+            delivery = await self._await_store(
+                self._store.claim_next_delivery(
+                    now=now,
+                    stale_before=now - self._stale_after,
+                )
+            )
+            if delivery is None:
+                await asyncio.sleep(self._poll_interval)
+                continue
+            await self._process_delivery(delivery)
+
+    async def _process_delivery(self, delivery: GitHubDelivery) -> None:
+        try:
+            disposition = await self._delivery_handler(delivery)
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report(
+                f"process GitHub delivery {delivery.delivery_guid}",
+                error,
+            )
+            summary = _error_summary(error)
+            retryable, _rate_limited, retry_at = _classify_github_request(error)
+            terminal = isinstance(error, GitHubRequestError) and not retryable
+            if terminal or delivery.attempts >= self._max_delivery_attempts:
+                await self._await_store(
+                    self._store.fail_delivery(
+                        delivery.delivery_guid,
+                        completed_at=self._clock(),
+                        error_summary=summary,
+                    )
+                )
+            else:
+                await self._await_store(
+                    self._store.defer_delivery(
+                        delivery.delivery_guid,
+                        next_attempt_at=self._next_retry_at(
+                            delivery.attempts,
+                            retry_at,
+                        ),
+                        error_summary=summary,
+                    )
+                )
+            return
+        await self._await_store(
+            self._store.complete_delivery(
+                delivery.delivery_guid,
+                completed_at=self._clock(),
+                ignored=disposition is DeliveryDisposition.IGNORED,
+            )
+        )
+        if disposition is DeliveryDisposition.STOPPED:
+            await self._stop_after_lifecycle_delivery(delivery)
+
+    async def _stop_after_lifecycle_delivery(self, delivery: GitHubDelivery) -> None:
+        self._stop_requested.set()
+        if self._receiver is not None:
+            try:
+                await self._receiver.close()
+            except asyncio.CancelledError:
+                raise
+            except Exception as error:
+                await self._report(
+                    "close GitHub webhook receiver after lifecycle event",
+                    error,
+                )
+        current = asyncio.current_task()
+        tasks = [task for task in self._tasks if task is not current]
+        for task in tasks:
+            task.cancel()
+        await asyncio.gather(*tasks, return_exceptions=True)
+        self._tasks = [task for task in self._tasks if task is current and not task.done()]
+        self._invalidate_client_token()
+        self._started = False
+        if self._lifecycle_stopped is not None:
+            try:
+                await self._lifecycle_stopped(self)
+            except asyncio.CancelledError:
+                raise
+            except Exception as error:
+                await self._report("finalize GitHub integration lifecycle stop", error)
+        await self._report(
+            f"stop GitHub integration after {delivery.event} {delivery.action or 'event'}",
+            RuntimeError("GitHub App lifecycle changed"),
+        )
+
+    def _invalidate_client_token(self) -> None:
+        if self._client is None or self._token_invalidated:
+            return
+        self._client.invalidate_installation_token()
+        self._token_invalidated = True
+
+    def _next_retry_at(
+        self,
+        attempts: int,
+        retry_at: datetime | None = None,
+    ) -> datetime:
+        base_seconds = self._retry_base.total_seconds()
+        cap_seconds = self._retry_cap.total_seconds()
+        exponential = base_seconds * (2 ** min(max(attempts - 1, 0), 30))
+        bounded = min(exponential, cap_seconds)
+        jittered = bounded * (0.5 + self._random.random())
+        calculated = self._clock() + timedelta(seconds=min(jittered, cap_seconds))
+        if retry_at is not None and retry_at > calculated:
+            return retry_at
+        return calculated
+
+    async def _outbox_loop(self) -> None:
+        while not self._stop_requested.is_set():
+            now = self._clock()
+            item = await self._await_store(
+                self._store.claim_next_outbox(
+                    now=now,
+                    stale_before=now - self._stale_after,
+                )
+            )
+            if item is None:
+                await asyncio.sleep(self._poll_interval)
+                continue
+            await self._process_outbox(item)
+
+    async def _process_outbox(self, item: GitHubOutboxItem) -> None:
+        client = self._client
+        if client is None:
+            raise RuntimeError("GitHub integration is not configured")
+        try:
+            owner, repository = _split_repository_name(item.repository_full_name)
+            async with self._github_mutation_lock:
+                if item.operation is GitHubOutboxOperation.ADD_ASSIGNEE:
+                    await client.add_assignee(
+                        owner,
+                        repository,
+                        item.pr_number,
+                        item.github_login,
+                    )
+                elif item.operation is GitHubOutboxOperation.REMOVE_ASSIGNEE:
+                    await client.remove_assignee(
+                        owner,
+                        repository,
+                        item.pr_number,
+                        item.github_login,
+                    )
+                else:
+                    raise ValueError(f"unsupported GitHub outbox operation {item.operation}")
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report(f"apply GitHub outbox item {item.outbox_id}", error)
+            summary = _error_summary(error)
+            terminal = isinstance(error, (GitHubAssigneeUnavailable, ValueError))
+            retry_at = None
+            if isinstance(error, GitHubRequestError):
+                retryable, _rate_limited, retry_at = _classify_github_request(error)
+                terminal = not retryable
+            if terminal or item.attempts >= self._max_outbox_attempts:
+                await self._await_store(
+                    self._store.fail_outbox(
+                        item.outbox_id,
+                        failed_at=self._clock(),
+                        error_summary=summary,
+                    )
+                )
+            else:
+                await self._await_store(
+                    self._store.defer_outbox(
+                        item.outbox_id,
+                        next_attempt_at=self._next_retry_at(item.attempts, retry_at),
+                        error_summary=summary,
+                    )
+                )
+            return
+        await self._await_store(
+            self._store.complete_outbox(
+                item.outbox_id,
+                completed_at=self._clock(),
+            )
+        )
+
+    async def _recovery_loop(self) -> None:
+        while not self._stop_requested.is_set():
+            self._recovery_requested.clear()
+            await self.run_recovery()
+            try:
+                timeout = self._recovery_interval.total_seconds()
+                if self._recovery_not_before is not None:
+                    timeout = max(
+                        timeout,
+                        (self._recovery_not_before - self._clock()).total_seconds(),
+                    )
+                await asyncio.wait_for(
+                    self._recovery_requested.wait(),
+                    timeout=max(0.0, timeout),
+                )
+            except asyncio.TimeoutError:
+                pass
+
+    def _apply_recovery_failure(self, error: BaseException) -> datetime | None:
+        retryable, _rate_limited, retry_at = _classify_github_request(error)
+        if not retryable:
+            return None
+        self._recovery_failure_attempts += 1
+        next_attempt_at = self._next_retry_at(
+            self._recovery_failure_attempts,
+            retry_at,
+        )
+        self._recovery_not_before = next_attempt_at
+        return next_attempt_at
+
+    async def _save_recovery_checkpoint(
+        self,
+        *,
+        next_page: int,
+        last_delivery_id: int | None,
+    ) -> None:
+        try:
+            await self._await_store(
+                self._store.save_delivery_recovery_checkpoint(
+                    next_page=next_page,
+                    last_delivery_id=last_delivery_id,
+                    checked_at=self._clock(),
+                )
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception as error:
+            await self._report("save GitHub delivery recovery checkpoint", error)
+
+    async def _await_store(self, operation: Awaitable[_ResultT]) -> _ResultT:
+        task = asyncio.ensure_future(operation)
+        try:
+            return await asyncio.shield(task)
+        except asyncio.CancelledError:
+            await asyncio.gather(task, return_exceptions=True)
+            raise
+
+    async def _report(self, action: str, error: BaseException) -> None:
+        await report_operational_error(
+            self._bot,
+            guild_id=self._guild_id,
+            source="GitHubTickets",
+            action=action,
+            error=error,
+        )
+
+
+def _error_summary(error: BaseException) -> str:
+    if isinstance(error, (GitHubAssigneeUnavailable, GitHubRequestError)):
+        detail = " ".join(str(error).split())
+        return f"{type(error).__name__}: {detail}"[:500]
+    return type(error).__name__[:500]
+
+
+def _classify_github_request(
+    error: BaseException,
+) -> tuple[bool, bool, datetime | None]:
+    if not isinstance(error, GitHubRequestError):
+        return True, False, None
+    return (
+        error.retryable or error.rate_limited,
+        error.rate_limited,
+        error.retry_at,
+    )
+
+
+def _split_repository_name(full_name: str) -> tuple[str, str]:
+    if full_name.count("/") != 1:
+        raise ValueError("GitHub repository full name must contain one slash")
+    owner, repository = full_name.split("/", 1)
+    if not owner or not repository:
+        raise ValueError("GitHub repository full name must include owner and repository")
+    return owner, repository
diff --git a/NHCogs/githubtickets/settings.py b/NHCogs/githubtickets/settings.py
index aa7b345..ee29f03 100644
--- a/NHCogs/githubtickets/settings.py
+++ b/NHCogs/githubtickets/settings.py
@@ -13,6 +13,7 @@
 DEFAULT_OFFLINE_RESPONSE_SECONDS = 24 * 60 * 60
 DEFAULT_DIRECT_RESPONSE_SECONDS = 24 * 60 * 60
 DEFAULT_MAX_PINGS = 3
+DEFAULT_GITHUB_RECOVERY_SECONDS = 15 * 60
 
 
 class InvalidDuration(ValueError):
@@ -22,6 +23,7 @@ class InvalidDuration(ValueError):
 class NegativeDuration(ValueError):
     pass
 
+
 DEFAULTS: dict[str, object] = {
     "ticket_channel_id": None,
     "log_channel_id": None,
@@ -36,8 +38,17 @@ class NegativeDuration(ValueError):
     "max_pings": DEFAULT_MAX_PINGS,
 }
 
+GITHUB_INTEGRATION_DEFAULTS: dict[str, object] = {
+    "guild_id": None,
+    "enabled": False,
+    "bind_host": None,
+    "bind_port": None,
+    "recovery_seconds": DEFAULT_GITHUB_RECOVERY_SECONDS,
+}
+
 _DURATION_PATTERN = re.compile(r"^(?P<sign>-?)(?P<value>\d+)(?P<unit>[smh]?)$")
 _DURATION_MULTIPLIERS = {"": 1, "s": 1, "m": 60, "h": 60 * 60}
+_MAX_PORT = 65535
 
 
 def parse_duration(raw: str) -> int:
@@ -87,6 +98,25 @@ def _nonnegative_int(raw: object, default: int) -> int:
     return raw
 
 
+def _positive_int(raw: object, default: int) -> int:
+    if isinstance(raw, bool) or not isinstance(raw, int) or raw <= 0:
+        return default
+    return raw
+
+
+def _bind_host(raw: object) -> str | None:
+    if not isinstance(raw, str):
+        return None
+    value = raw.strip()
+    return value or None
+
+
+def _bind_port(raw: object) -> int | None:
+    if isinstance(raw, bool) or not isinstance(raw, int):
+        return None
+    return raw if 1 <= raw <= _MAX_PORT else None
+
+
 @dataclass(frozen=True, slots=True)
 class GuildSettings:
     ticket_channel_id: int | None
@@ -133,3 +163,34 @@ def from_mapping(cls, raw: Mapping[str, object] | object) -> GuildSettings:
             ),
             max_pings=_nonnegative_int(values.get("max_pings"), DEFAULT_MAX_PINGS),
         )
+
+
+@dataclass(frozen=True, slots=True)
+class GitHubIntegrationSettings:
+    guild_id: int | None
+    enabled: bool
+    bind_host: str | None
+    bind_port: int | None
+    recovery_seconds: int
+
+    @property
+    def receiver_configured(self) -> bool:
+        return self.bind_host is not None and self.bind_port is not None
+
+    @classmethod
+    def from_mapping(
+        cls,
+        raw: Mapping[str, object] | object,
+    ) -> GitHubIntegrationSettings:
+        values = raw if isinstance(raw, Mapping) else {}
+        enabled = values.get("enabled")
+        return cls(
+            guild_id=_positive_id(values.get("guild_id")),
+            enabled=enabled if isinstance(enabled, bool) else False,
+            bind_host=_bind_host(values.get("bind_host")),
+            bind_port=_bind_port(values.get("bind_port")),
+            recovery_seconds=_positive_int(
+                values.get("recovery_seconds"),
+                DEFAULT_GITHUB_RECOVERY_SECONDS,
+            ),
+        )
diff --git a/NHCogs/githubtickets/store.py b/NHCogs/githubtickets/store.py
index d794a5e..9ced44a 100644
--- a/NHCogs/githubtickets/store.py
+++ b/NHCogs/githubtickets/store.py
@@ -1,30 +1,41 @@
 from __future__ import annotations
 
 import asyncio
+import json
 import secrets
 import sqlite3
 from contextlib import closing
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import TYPE_CHECKING
 
 from NHCogs.storage import ConnectionFactory, apply_migrations, connect
 
 from .models import (
+    ActivePullRequestTicketExists,
     CandidateHistory,
     Category,
     CategoryAlreadyExists,
     CategoryLimitReached,
     ExclusionReason,
+    GitHubDelivery,
+    GitHubDeliveryState,
+    GitHubOutboxItem,
+    GitHubOutboxOperation,
+    GitHubOutboxState,
+    GitHubPullRequest,
     InvalidCategoryName,
     NewTicket,
     NextAction,
     PingReservation,
     PresenceTier,
     Profile,
+    PullRequestObservation,
+    PullRequestObservationState,
     RoutingMode,
     Ticket,
     TicketExclusion,
+    TicketOrigin,
     TicketPing,
     TicketState,
 )
@@ -33,9 +44,13 @@
     from collections.abc import Iterable, Mapping
 
 
-SCHEMA_VERSION = 1
+SCHEMA_VERSION = 3
 MAX_CATEGORIES = 25
 MAX_CATEGORY_NAME_LENGTH = 100
+MAX_DELIVERY_BODY_BYTES = 1_048_576
+MAX_ERROR_SUMMARY_LENGTH = 500
+DELIVERY_RAW_BODY_RETENTION = timedelta(days=3)
+DELIVERY_IDENTITY_RETENTION = timedelta(days=7)
 
 
 def _serialize_datetime(value: datetime) -> str:
@@ -90,9 +105,7 @@ def _decode_profile(connection: sqlite3.Connection, row: sqlite3.Row) -> Profile
         guild_id=int(row["guild_id"]),
         user_id=int(row["user_id"]),
         github_username=(
-            str(row["github_username"])
-            if row["github_username"] is not None
-            else None
+            str(row["github_username"]) if row["github_username"] is not None else None
         ),
         automatic_pings=bool(row["automatic_pings"]),
         category_ids=category_ids,
@@ -120,7 +133,7 @@ def _decode_ticket(connection: sqlite3.Connection, row: sqlite3.Row) -> Ticket:
         channel_id=int(row["channel_id"]),
         message_id=int(row["message_id"]) if row["message_id"] is not None else None,
         thread_id=int(row["thread_id"]) if row["thread_id"] is not None else None,
-        author_id=int(row["author_id"]),
+        author_id=int(row["author_id"]) if row["author_id"] is not None else None,
         pr_title=str(row["pr_title"]),
         pr_url=str(row["pr_url"]),
         category_display=str(row["category_display"]),
@@ -130,9 +143,7 @@ def _decode_ticket(connection: sqlite3.Connection, row: sqlite3.Row) -> Ticket:
             int(row["direct_target_id"]) if row["direct_target_id"] is not None else None
         ),
         current_target_id=(
-            int(row["current_target_id"])
-            if row["current_target_id"] is not None
-            else None
+            int(row["current_target_id"]) if row["current_target_id"] is not None else None
         ),
         assignee_id=int(row["assignee_id"]) if row["assignee_id"] is not None else None,
         ping_count=int(row["ping_count"]),
@@ -142,9 +153,7 @@ def _decode_ticket(connection: sqlite3.Connection, row: sqlite3.Row) -> Ticket:
         ),
         next_action_at=_deserialize_optional_datetime(row["next_action_at"]),
         pending_target_id=(
-            int(row["pending_target_id"])
-            if row["pending_target_id"] is not None
-            else None
+            int(row["pending_target_id"]) if row["pending_target_id"] is not None else None
         ),
         pending_presence_tier=(
             PresenceTier(str(row["pending_presence_tier"]))
@@ -156,18 +165,105 @@ def _decode_ticket(connection: sqlite3.Connection, row: sqlite3.Row) -> Ticket:
             if row["pending_ping_automatic"] is not None
             else None
         ),
-        pending_ping_reserved_at=_deserialize_optional_datetime(
-            row["pending_ping_reserved_at"]
-        ),
-        pending_response_deadline=_deserialize_optional_datetime(
-            row["pending_response_deadline"]
-        ),
+        pending_ping_reserved_at=_deserialize_optional_datetime(row["pending_ping_reserved_at"]),
+        pending_response_deadline=_deserialize_optional_datetime(row["pending_response_deadline"]),
         created_at=_deserialize_datetime(str(row["created_at"])),
         updated_at=_deserialize_datetime(str(row["updated_at"])),
         transition_version=int(row["transition_version"]),
         category_ids=category_ids,
         public_token=str(row["public_token"]),
+        origin=TicketOrigin(str(row["origin"])),
+        category_prompt_retry_at=_deserialize_optional_datetime(
+            row["category_prompt_retry_at"]
+        ),
+    )
+
+
+def _decode_pull_request(row: sqlite3.Row) -> GitHubPullRequest:
+    return GitHubPullRequest(
+        repository_id=int(row["repository_id"]),
+        pr_number=int(row["pr_number"]),
+        github_pr_id=int(row["github_pr_id"]),
+        github_author_id=int(row["github_author_id"]),
+        repository_full_name=str(row["repository_full_name"]),
+        url=str(row["pr_url"]),
+        title=str(row["pr_title"]),
+        github_author_login=str(row["github_author_login"]),
+        draft=bool(row["draft"]),
+        open=bool(row["open"]),
+        labels=tuple(json.loads(str(row["observed_labels"]))),
+        github_updated_at=_deserialize_datetime(str(row["github_updated_at"])),
+        assignees=tuple(json.loads(str(row["observed_assignees"]))),
+        current_ticket_id=(
+            int(row["current_ticket_id"]) if row["current_ticket_id"] is not None else None
+        ),
+        last_processed_action=(
+            str(row["last_processed_action"]) if row["last_processed_action"] is not None else None
+        ),
+    )
+
+
+def _pull_request_state(pull_request: GitHubPullRequest) -> tuple[object, ...]:
+    return (
+        pull_request.repository_full_name.strip().casefold(),
+        pull_request.url.strip().casefold(),
+        pull_request.title.strip(),
+        pull_request.github_author_login.strip().casefold(),
+        pull_request.draft,
+        pull_request.open,
+        frozenset(label.strip().casefold() for label in pull_request.labels if label.strip()),
+        tuple(
+            assignee.strip().casefold()
+            for assignee in pull_request.assignees
+            if assignee.strip()
+        ),
+    )
+
+
+def _decode_delivery(row: sqlite3.Row) -> GitHubDelivery:
+    raw_body = row["raw_body"]
+    return GitHubDelivery(
+        delivery_guid=str(row["delivery_guid"]),
+        github_delivery_id=(
+            int(row["github_delivery_id"]) if row["github_delivery_id"] is not None else None
+        ),
+        event=str(row["event"]),
+        action=str(row["action"]) if row["action"] is not None else None,
+        installation_id=int(row["installation_id"]),
+        repository_id=(int(row["repository_id"]) if row["repository_id"] is not None else None),
+        pr_number=int(row["pr_number"]) if row["pr_number"] is not None else None,
+        received_at=_deserialize_datetime(str(row["received_at"])),
+        state=GitHubDeliveryState(str(row["state"])),
+        attempts=int(row["attempts"]),
+        next_attempt_at=_deserialize_optional_datetime(row["next_attempt_at"]),
+        processing_started_at=_deserialize_optional_datetime(row["processing_started_at"]),
+        completed_at=_deserialize_optional_datetime(row["completed_at"]),
+        error_summary=(str(row["error_summary"]) if row["error_summary"] is not None else None),
+        raw_body=bytes(raw_body) if raw_body is not None else None,
+    )
+
+
+def _decode_outbox(row: sqlite3.Row) -> GitHubOutboxItem:
+    return GitHubOutboxItem(
+        outbox_id=int(row["outbox_id"]),
+        operation=GitHubOutboxOperation(str(row["operation"])),
+        ticket_id=int(row["ticket_id"]),
+        transition_version=int(row["transition_version"]),
+        repository_id=int(row["repository_id"]),
+        repository_full_name=str(row["repository_full_name"]),
+        pr_number=int(row["pr_number"]),
+        github_login=str(row["github_login"]),
+        actor_user_id=(int(row["actor_user_id"]) if row["actor_user_id"] is not None else None),
+        state=GitHubOutboxState(str(row["state"])),
+        attempts=int(row["attempts"]),
+        next_attempt_at=_deserialize_optional_datetime(row["next_attempt_at"]),
+        processing_started_at=_deserialize_optional_datetime(row["processing_started_at"]),
+        error_summary=(str(row["error_summary"]) if row["error_summary"] is not None else None),
+        created_at=_deserialize_datetime(str(row["created_at"])),
+        updated_at=_deserialize_datetime(str(row["updated_at"])),
     )
+
+
 def _create_schema(connection: sqlite3.Connection) -> None:
     schema = """
         CREATE TABLE categories (
@@ -317,7 +413,287 @@ def _create_schema(connection: sqlite3.Connection) -> None:
             connection.execute(statement)
 
 
-MIGRATIONS = (_create_schema,)
+def _migrate_to_github_durable_work(connection: sqlite3.Connection) -> None:
+    schema = """
+        CREATE TEMP TABLE migration_tickets AS SELECT * FROM tickets;
+        CREATE TEMP TABLE migration_ticket_categories
+            AS SELECT * FROM ticket_categories;
+        CREATE TEMP TABLE migration_ticket_exclusions
+            AS SELECT * FROM ticket_exclusions;
+        CREATE TEMP TABLE migration_ticket_pings AS SELECT * FROM ticket_pings;
+
+        DROP TABLE ticket_categories;
+        DROP TABLE ticket_exclusions;
+        DROP TABLE ticket_pings;
+        DROP TABLE tickets;
+
+        CREATE TABLE tickets (
+            ticket_id INTEGER PRIMARY KEY AUTOINCREMENT,
+            public_token TEXT NOT NULL UNIQUE,
+            guild_id INTEGER NOT NULL,
+            channel_id INTEGER NOT NULL,
+            message_id INTEGER UNIQUE,
+            thread_id INTEGER UNIQUE,
+            author_id INTEGER,
+            origin TEXT NOT NULL CHECK (origin IN ('discord', 'github')),
+            pr_title TEXT NOT NULL,
+            pr_url TEXT NOT NULL,
+            category_display TEXT NOT NULL,
+            routing_mode TEXT NOT NULL CHECK (
+                routing_mode IN (
+                    'none', 'automatic', 'direct_wait', 'direct_automatic'
+                )
+            ),
+            state TEXT NOT NULL CHECK (
+                state IN ('creating', 'open', 'claimed', 'finishing')
+            ),
+            direct_target_id INTEGER,
+            current_target_id INTEGER,
+            assignee_id INTEGER,
+            ping_count INTEGER NOT NULL DEFAULT 0 CHECK (ping_count >= 0),
+            protection_until TEXT,
+            next_action TEXT CHECK (
+                next_action IS NULL OR next_action IN (
+                    'direct_ping', 'automatic_ping', 'target_timeout'
+                )
+            ),
+            next_action_at TEXT,
+            pending_target_id INTEGER,
+            pending_presence_tier TEXT CHECK (
+                pending_presence_tier IS NULL OR pending_presence_tier IN (
+                    'online', 'idle', 'do_not_disturb', 'offline'
+                )
+            ),
+            pending_ping_automatic INTEGER CHECK (
+                pending_ping_automatic IS NULL OR pending_ping_automatic IN (0, 1)
+            ),
+            pending_ping_reserved_at TEXT,
+            pending_response_deadline TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            projection_sync_at TEXT,
+            transition_version INTEGER NOT NULL DEFAULT 0
+                CHECK (transition_version >= 0),
+            CHECK (
+                (next_action IS NULL AND next_action_at IS NULL)
+                OR (next_action IS NOT NULL AND next_action_at IS NOT NULL)
+            ),
+            CHECK (
+                (pending_target_id IS NULL
+                    AND pending_ping_automatic IS NULL
+                    AND pending_ping_reserved_at IS NULL
+                    AND pending_response_deadline IS NULL)
+                OR (pending_target_id IS NOT NULL
+                    AND pending_ping_automatic IS NOT NULL
+                    AND pending_ping_reserved_at IS NOT NULL
+                    AND pending_response_deadline IS NOT NULL)
+            )
+        );
+
+        INSERT INTO tickets (
+            ticket_id, public_token, guild_id, channel_id, message_id, thread_id,
+            author_id, origin, pr_title, pr_url, category_display, routing_mode,
+            state, direct_target_id, current_target_id, assignee_id, ping_count,
+            protection_until, next_action, next_action_at, pending_target_id,
+            pending_presence_tier, pending_ping_automatic,
+            pending_ping_reserved_at, pending_response_deadline, created_at,
+            updated_at, projection_sync_at, transition_version
+        )
+        SELECT ticket_id, public_token, guild_id, channel_id, message_id, thread_id,
+            author_id, 'discord', pr_title, pr_url, category_display, routing_mode,
+            state, direct_target_id, current_target_id, assignee_id, ping_count,
+            protection_until, next_action, next_action_at, pending_target_id,
+            pending_presence_tier, pending_ping_automatic,
+            pending_ping_reserved_at, pending_response_deadline, created_at,
+            updated_at, projection_sync_at, transition_version
+        FROM migration_tickets;
+
+        CREATE TABLE ticket_categories (
+            ticket_id INTEGER NOT NULL,
+            category_id INTEGER NOT NULL,
+            PRIMARY KEY (ticket_id, category_id),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE,
+            FOREIGN KEY (category_id)
+                REFERENCES categories (category_id) ON DELETE CASCADE
+        );
+        INSERT INTO ticket_categories SELECT * FROM migration_ticket_categories;
+
+        CREATE TABLE ticket_exclusions (
+            ticket_id INTEGER NOT NULL,
+            user_id INTEGER NOT NULL,
+            reason TEXT NOT NULL CHECK (
+                reason IN ('declined', 'unassigned', 'timed_out')
+            ),
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (ticket_id, user_id),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE
+        );
+        INSERT INTO ticket_exclusions SELECT * FROM migration_ticket_exclusions;
+
+        CREATE TABLE ticket_pings (
+            ticket_id INTEGER NOT NULL,
+            sequence_number INTEGER NOT NULL CHECK (sequence_number > 0),
+            target_user_id INTEGER NOT NULL,
+            presence_tier TEXT CHECK (
+                presence_tier IS NULL OR presence_tier IN (
+                    'online', 'idle', 'do_not_disturb', 'offline'
+                )
+            ),
+            automatic INTEGER NOT NULL CHECK (automatic IN (0, 1)),
+            sent_at TEXT NOT NULL,
+            response_deadline TEXT NOT NULL,
+            PRIMARY KEY (ticket_id, sequence_number),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE
+        );
+        INSERT INTO ticket_pings SELECT * FROM migration_ticket_pings;
+
+        DROP TABLE migration_ticket_pings;
+        DROP TABLE migration_ticket_exclusions;
+        DROP TABLE migration_ticket_categories;
+        DROP TABLE migration_tickets;
+
+        CREATE INDEX idx_ticket_deadlines ON tickets (next_action_at, ticket_id)
+            WHERE next_action_at IS NOT NULL;
+        CREATE INDEX idx_ticket_message ON tickets (message_id)
+            WHERE message_id IS NOT NULL;
+        CREATE INDEX idx_ticket_thread ON tickets (thread_id)
+            WHERE thread_id IS NOT NULL;
+        CREATE INDEX idx_ticket_assignee ON tickets (guild_id, assignee_id)
+            WHERE assignee_id IS NOT NULL;
+        CREATE INDEX idx_ticket_pings_target
+            ON ticket_pings (target_user_id, sent_at);
+
+        CREATE TABLE github_pull_requests (
+            repository_id INTEGER NOT NULL,
+            pr_number INTEGER NOT NULL CHECK (pr_number > 0),
+            github_pr_id INTEGER NOT NULL UNIQUE,
+            github_author_id INTEGER NOT NULL,
+            repository_full_name TEXT NOT NULL,
+            pr_url TEXT NOT NULL,
+            pr_title TEXT NOT NULL,
+            github_author_login TEXT NOT NULL,
+            draft INTEGER NOT NULL CHECK (draft IN (0, 1)),
+            open INTEGER NOT NULL CHECK (open IN (0, 1)),
+            observed_labels TEXT NOT NULL,
+            observed_assignees TEXT NOT NULL,
+            github_updated_at TEXT NOT NULL,
+            current_ticket_id INTEGER,
+            last_processed_action TEXT,
+            PRIMARY KEY (repository_id, pr_number),
+            FOREIGN KEY (current_ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE SET NULL
+        );
+        CREATE UNIQUE INDEX idx_github_pull_requests_active_ticket
+            ON github_pull_requests (current_ticket_id)
+            WHERE current_ticket_id IS NOT NULL;
+        CREATE INDEX idx_github_pull_requests_author
+            ON github_pull_requests (github_author_id);
+
+        CREATE TABLE github_deliveries (
+            delivery_guid TEXT PRIMARY KEY,
+            github_delivery_id INTEGER UNIQUE,
+            event TEXT NOT NULL,
+            action TEXT,
+            installation_id INTEGER NOT NULL,
+            repository_id INTEGER,
+            pr_number INTEGER,
+            received_at TEXT NOT NULL,
+            state TEXT NOT NULL CHECK (
+                state IN (
+                    'pending', 'processing', 'retry', 'awaiting_redelivery',
+                    'processed', 'ignored', 'failed'
+                )
+            ),
+            attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+            next_attempt_at TEXT,
+            processing_started_at TEXT,
+            completed_at TEXT,
+            error_summary TEXT CHECK (
+                error_summary IS NULL OR length(error_summary) <= 500
+            ),
+            raw_body BLOB CHECK (
+                raw_body IS NULL OR length(raw_body) <= 1048576
+            )
+        );
+        CREATE INDEX idx_github_deliveries_pending
+            ON github_deliveries (next_attempt_at, received_at, delivery_guid)
+            WHERE state IN ('pending', 'retry');
+        CREATE INDEX idx_github_deliveries_processing
+            ON github_deliveries (processing_started_at, delivery_guid)
+            WHERE state = 'processing';
+
+        CREATE TABLE github_delivery_recovery (
+            singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+            next_page INTEGER NOT NULL CHECK (next_page > 0),
+            last_delivery_id INTEGER CHECK (
+                last_delivery_id IS NULL OR last_delivery_id > 0
+            ),
+            checked_at TEXT NOT NULL
+        );
+
+        CREATE TABLE github_outbox (
+            outbox_id INTEGER PRIMARY KEY AUTOINCREMENT,
+            operation TEXT NOT NULL CHECK (
+                operation IN ('add_assignee', 'remove_assignee')
+            ),
+            ticket_id INTEGER NOT NULL,
+            transition_version INTEGER NOT NULL CHECK (transition_version >= 0),
+            repository_id INTEGER NOT NULL,
+            repository_full_name TEXT NOT NULL,
+            pr_number INTEGER NOT NULL CHECK (pr_number > 0),
+            github_login TEXT NOT NULL,
+            actor_user_id INTEGER,
+            state TEXT NOT NULL CHECK (
+                state IN ('pending', 'processing', 'retry', 'succeeded', 'failed')
+            ),
+            attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+            next_attempt_at TEXT,
+            processing_started_at TEXT,
+            error_summary TEXT CHECK (
+                error_summary IS NULL OR length(error_summary) <= 500
+            ),
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            UNIQUE (ticket_id, transition_version, operation, github_login),
+            CHECK (length(github_login) > 0),
+            CHECK (length(repository_full_name) > 0)
+        );
+        CREATE INDEX idx_github_outbox_pending
+            ON github_outbox (next_attempt_at, created_at, outbox_id)
+            WHERE state IN ('pending', 'retry');
+        CREATE INDEX idx_github_outbox_processing
+            ON github_outbox (processing_started_at, outbox_id)
+            WHERE state = 'processing';
+        CREATE INDEX idx_github_outbox_actor
+            ON github_outbox (actor_user_id)
+            WHERE actor_user_id IS NOT NULL;
+        """
+    for statement in schema.split(";"):
+        if statement.strip():
+            connection.execute(statement)
+
+
+def _add_category_prompt_retry(connection: sqlite3.Connection) -> None:
+    connection.execute(
+        "ALTER TABLE tickets ADD COLUMN category_prompt_retry_at TEXT"
+    )
+    connection.execute(
+        """
+        CREATE INDEX idx_ticket_category_prompt_retry
+        ON tickets (category_prompt_retry_at, ticket_id)
+        WHERE category_prompt_retry_at IS NOT NULL
+        """
+    )
+
+
+MIGRATIONS = (
+    _create_schema,
+    _migrate_to_github_durable_work,
+    _add_category_prompt_retry,
+)
 
 
 class GitHubTicketsStore:
@@ -469,109 +845,370 @@ async def create_ticket(self, new_ticket: NewTicket) -> Ticket:
         async with self._lock:
             return await asyncio.to_thread(self._create_ticket_sync, new_ticket)
 
-    async def activate_ticket(
+    async def create_ticket_for_pull_request(
         self,
-        ticket_id: int,
+        new_ticket: NewTicket,
+        pull_request: GitHubPullRequest,
+    ) -> Ticket:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._create_ticket_for_pull_request_sync,
+                new_ticket,
+                pull_request,
+            )
+
+    async def observe_pull_request(
+        self,
+        pull_request: GitHubPullRequest,
         *,
-        message_id: int,
-        thread_id: int,
-        protection_until: datetime | None,
-        next_action: NextAction | None,
-        next_action_at: datetime | None,
-        updated_at: datetime,
-    ) -> bool:
+        authoritative: bool = False,
+    ) -> PullRequestObservation:
         async with self._lock:
             return await asyncio.to_thread(
-                self._activate_ticket_sync,
-                ticket_id,
-                (message_id, thread_id),
-                (protection_until, next_action, next_action_at),
-                updated_at,
+                self._observe_pull_request_sync,
+                pull_request,
+                authoritative,
             )
 
-    async def record_ticket_message(
+    async def get_pull_request(
         self,
-        ticket_id: int,
-        message_id: int,
-        updated_at: datetime,
-    ) -> bool:
+        repository_id: int,
+        pr_number: int,
+    ) -> GitHubPullRequest | None:
         async with self._lock:
             return await asyncio.to_thread(
-                self._record_ticket_message_sync,
-                ticket_id,
-                message_id,
-                updated_at,
+                self._get_pull_request_sync,
+                repository_id,
+                pr_number,
             )
 
-    async def record_ticket_thread(
+    async def get_pull_request_for_ticket(
         self,
         ticket_id: int,
-        thread_id: int,
-        updated_at: datetime,
-    ) -> bool:
+    ) -> GitHubPullRequest | None:
         async with self._lock:
             return await asyncio.to_thread(
-                self._record_ticket_thread_sync,
+                self._get_pull_request_for_ticket_sync,
                 ticket_id,
-                thread_id,
-                updated_at,
             )
 
-    async def get_ticket(self, ticket_id: int) -> Ticket | None:
-        async with self._lock:
-            return await asyncio.to_thread(self._get_ticket_sync, ticket_id)
-
-    async def get_ticket_by_public_token(self, public_token: str) -> Ticket | None:
+    async def accept_delivery(
+        self,
+        *,
+        delivery_guid: str,
+        github_delivery_id: int | None,
+        event: str,
+        action: str | None,
+        installation_id: int,
+        repository_id: int | None,
+        pr_number: int | None,
+        received_at: datetime,
+        raw_body: bytes,
+    ) -> bool:
         async with self._lock:
             return await asyncio.to_thread(
-                self._get_ticket_by_public_token_sync,
-                public_token,
+                self._accept_delivery_sync,
+                (
+                    delivery_guid,
+                    github_delivery_id,
+                    event,
+                    action,
+                    installation_id,
+                ),
+                (repository_id, pr_number),
+                (received_at, raw_body),
             )
 
-    async def get_projection_sync_ticket(self, ticket_id: int) -> Ticket | None:
+    async def claim_next_delivery(
+        self,
+        *,
+        now: datetime,
+        stale_before: datetime,
+    ) -> GitHubDelivery | None:
         async with self._lock:
             return await asyncio.to_thread(
-                self._get_projection_sync_ticket_sync,
-                ticket_id,
+                self._claim_next_delivery_sync,
+                now,
+                stale_before,
             )
 
-    async def acknowledge_projection_sync(
+    async def get_delivery(self, delivery_guid: str) -> GitHubDelivery | None:
+        async with self._lock:
+            return await asyncio.to_thread(self._get_delivery_sync, delivery_guid)
+
+    async def prepare_delivery_redelivery(
         self,
-        ticket_id: int,
-        transition_version: int,
+        delivery_guid: str,
+        *,
+        github_delivery_id: int,
+        now: datetime,
+        next_attempt_at: datetime,
     ) -> bool:
+        if github_delivery_id < 1:
+            raise ValueError("GitHub delivery ID must be positive")
         async with self._lock:
             return await asyncio.to_thread(
-                self._acknowledge_projection_sync_sync,
-                ticket_id,
-                transition_version,
+                self._prepare_delivery_redelivery_sync,
+                delivery_guid,
+                github_delivery_id,
+                now,
+                next_attempt_at,
             )
 
-    async def defer_projection_sync(
+    async def restore_delivery_redelivery(
         self,
-        ticket_id: int,
-        transition_version: int,
-        retry_at: datetime,
+        delivery_guid: str,
+        *,
+        raw_body: bytes | None,
+        next_attempt_at: datetime | None,
+        error_summary: str,
     ) -> bool:
+        if raw_body is not None and len(raw_body) > MAX_DELIVERY_BODY_BYTES:
+            raise ValueError("delivery raw body exceeds the retention limit")
         async with self._lock:
             return await asyncio.to_thread(
-                self._defer_projection_sync_sync,
-                ticket_id,
-                transition_version,
-                retry_at,
+                self._restore_delivery_redelivery_sync,
+                delivery_guid,
+                raw_body,
+                next_attempt_at,
+                error_summary,
             )
 
-    async def get_ticket_by_message_id(self, message_id: int) -> Ticket | None:
+    async def get_delivery_recovery_checkpoint(self) -> tuple[int, int | None]:
         async with self._lock:
             return await asyncio.to_thread(
-                self._get_ticket_by_projection_id_sync,
-                "message_id",
-                message_id,
+                self._get_delivery_recovery_checkpoint_sync
             )
 
-    async def get_ticket_by_thread_id(self, thread_id: int) -> Ticket | None:
+    async def save_delivery_recovery_checkpoint(
+        self,
+        *,
+        next_page: int,
+        last_delivery_id: int | None,
+        checked_at: datetime,
+    ) -> None:
+        if next_page < 1 or (
+            last_delivery_id is not None and last_delivery_id < 1
+        ):
+            raise ValueError("delivery recovery checkpoint is invalid")
         async with self._lock:
-            return await asyncio.to_thread(
+            await asyncio.to_thread(
+                self._save_delivery_recovery_checkpoint_sync,
+                next_page,
+                last_delivery_id,
+                checked_at,
+            )
+
+    async def complete_delivery(
+        self,
+        delivery_guid: str,
+        *,
+        completed_at: datetime,
+        ignored: bool = False,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._complete_delivery_sync,
+                delivery_guid,
+                completed_at,
+                ignored,
+            )
+
+    async def defer_delivery(
+        self,
+        delivery_guid: str,
+        *,
+        next_attempt_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._defer_delivery_sync,
+                delivery_guid,
+                next_attempt_at,
+                error_summary,
+            )
+
+    async def fail_delivery(
+        self,
+        delivery_guid: str,
+        *,
+        completed_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._fail_delivery_sync,
+                delivery_guid,
+                completed_at,
+                error_summary,
+            )
+
+    async def prune_deliveries(self, now: datetime) -> tuple[int, int]:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._prune_deliveries_sync,
+                now,
+            )
+
+    async def activate_ticket(
+        self,
+        ticket_id: int,
+        *,
+        message_id: int,
+        thread_id: int,
+        protection_until: datetime | None,
+        next_action: NextAction | None,
+        next_action_at: datetime | None,
+        updated_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._activate_ticket_sync,
+                ticket_id,
+                (message_id, thread_id),
+                (protection_until, next_action, next_action_at),
+                updated_at,
+            )
+
+    async def start_automatic_routing(
+        self,
+        ticket_id: int,
+        *,
+        category_ids: tuple[int, ...],
+        category_display: str,
+        next_action_at: datetime,
+        updated_at: datetime,
+    ) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._start_automatic_routing_sync,
+                ticket_id,
+                category_ids,
+                category_display,
+                next_action_at,
+                updated_at,
+            )
+
+    async def record_ticket_message(
+        self,
+        ticket_id: int,
+        message_id: int,
+        updated_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._record_ticket_message_sync,
+                ticket_id,
+                message_id,
+                updated_at,
+            )
+
+    async def record_ticket_thread(
+        self,
+        ticket_id: int,
+        thread_id: int,
+        updated_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._record_ticket_thread_sync,
+                ticket_id,
+                thread_id,
+                updated_at,
+            )
+
+    async def get_ticket(self, ticket_id: int) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(self._get_ticket_sync, ticket_id)
+
+    async def update_ticket_title(
+        self,
+        ticket_id: int,
+        title: str,
+        updated_at: datetime,
+    ) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._update_ticket_title_sync,
+                ticket_id,
+                title,
+                updated_at,
+            )
+
+    async def get_ticket_by_public_token(self, public_token: str) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._get_ticket_by_public_token_sync,
+                public_token,
+            )
+
+    async def get_projection_sync_ticket(self, ticket_id: int) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._get_projection_sync_ticket_sync,
+                ticket_id,
+            )
+
+    async def acknowledge_projection_sync(
+        self,
+        ticket_id: int,
+        transition_version: int,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._acknowledge_projection_sync_sync,
+                ticket_id,
+                transition_version,
+            )
+
+    async def defer_projection_sync(
+        self,
+        ticket_id: int,
+        transition_version: int,
+        retry_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._defer_projection_sync_sync,
+                ticket_id,
+                transition_version,
+                retry_at,
+            )
+
+    async def acknowledge_category_prompt(
+        self,
+        ticket_id: int,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._acknowledge_category_prompt_sync,
+                ticket_id,
+            )
+
+    async def defer_category_prompt(
+        self,
+        ticket_id: int,
+        retry_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._defer_category_prompt_sync,
+                ticket_id,
+                retry_at,
+            )
+
+    async def get_ticket_by_message_id(self, message_id: int) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._get_ticket_by_projection_id_sync,
+                "message_id",
+                message_id,
+            )
+
+    async def get_ticket_by_thread_id(self, thread_id: int) -> Ticket | None:
+        async with self._lock:
+            return await asyncio.to_thread(
                 self._get_ticket_by_projection_id_sync,
                 "thread_id",
                 thread_id,
@@ -601,6 +1238,25 @@ async def claim(
                 updated_at,
             )
 
+    async def claim_with_github_assignment(
+        self,
+        ticket_id: int,
+        *,
+        assignee_id: int,
+        github_login: str,
+        github_write_required: bool,
+        protection_until: datetime,
+        updated_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._claim_with_github_assignment_sync,
+                ticket_id,
+                assignee_id,
+                github_login,
+                (github_write_required, protection_until, updated_at),
+            )
+
     async def decline(
         self,
         ticket_id: int,
@@ -639,6 +1295,82 @@ async def unassign(
                 updated_at,
             )
 
+    async def unassign_with_github_outbox(
+        self,
+        ticket_id: int,
+        *,
+        protection_until: datetime,
+        next_action: NextAction | None,
+        next_action_at: datetime | None,
+        updated_at: datetime,
+    ) -> int | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._unassign_with_github_outbox_sync,
+                ticket_id,
+                (protection_until, next_action, next_action_at, updated_at),
+            )
+
+    async def claim_next_outbox(
+        self,
+        *,
+        now: datetime,
+        stale_before: datetime,
+    ) -> GitHubOutboxItem | None:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._claim_next_outbox_sync,
+                now,
+                stale_before,
+            )
+
+    async def get_outbox_item(self, outbox_id: int) -> GitHubOutboxItem | None:
+        async with self._lock:
+            return await asyncio.to_thread(self._get_outbox_item_sync, outbox_id)
+
+    async def complete_outbox(
+        self,
+        outbox_id: int,
+        *,
+        completed_at: datetime,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._complete_outbox_sync,
+                outbox_id,
+                completed_at,
+            )
+
+    async def defer_outbox(
+        self,
+        outbox_id: int,
+        *,
+        next_attempt_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._defer_outbox_sync,
+                outbox_id,
+                next_attempt_at,
+                error_summary,
+            )
+
+    async def fail_outbox(
+        self,
+        outbox_id: int,
+        *,
+        failed_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        async with self._lock:
+            return await asyncio.to_thread(
+                self._fail_outbox_sync,
+                outbox_id,
+                failed_at,
+                error_summary,
+            )
+
     async def list_exclusions(self, ticket_id: int) -> tuple[TicketExclusion, ...]:
         async with self._lock:
             return await asyncio.to_thread(self._list_exclusions_sync, ticket_id)
@@ -1102,15 +1834,11 @@ def _list_profiles_for_category_sync(
                 guild_id=int(row["guild_id"]),
                 user_id=int(row["user_id"]),
                 github_username=(
-                    str(row["github_username"])
-                    if row["github_username"] is not None
-                    else None
+                    str(row["github_username"]) if row["github_username"] is not None else None
                 ),
                 automatic_pings=bool(row["automatic_pings"]),
                 category_ids=tuple(
-                    int(value)
-                    for value in str(row["category_ids"] or "").split(",")
-                    if value
+                    int(value) for value in str(row["category_ids"] or "").split(",") if value
                 ),
                 updated_at=_deserialize_datetime(str(row["updated_at"])),
             )
@@ -1243,63 +1971,666 @@ def _candidate_history_sync(
             for row in rows
         )
 
-    def _create_ticket_sync(self, new_ticket: NewTicket) -> Ticket:
+    def _insert_ticket(
+        self,
+        connection: sqlite3.Connection,
+        new_ticket: NewTicket,
+    ) -> Ticket:
         title = new_ticket.pr_title.strip()
         url = new_ticket.pr_url.strip()
         if not title or not url:
             raise ValueError("ticket title and URL cannot be empty")
-        category_ids = tuple(dict.fromkeys(new_ticket.category_ids))
+        category_ids = self._validate_ticket_category_ids(
+            connection,
+            new_ticket.guild_id,
+            new_ticket.category_ids,
+        )
+        timestamp = _serialize_datetime(new_ticket.created_at)
+        cursor = connection.execute(
+            """
+            INSERT INTO tickets (
+                public_token, guild_id, channel_id, author_id, origin,
+                pr_title, pr_url, category_display, routing_mode, state,
+                direct_target_id, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, ?)
+            """,
+            (
+                secrets.token_urlsafe(16),
+                new_ticket.guild_id,
+                new_ticket.channel_id,
+                new_ticket.author_id,
+                new_ticket.origin.value,
+                title,
+                url,
+                new_ticket.category_display,
+                new_ticket.routing_mode.value,
+                new_ticket.direct_target_id,
+                timestamp,
+                timestamp,
+            ),
+        )
+        if cursor.lastrowid is None:
+            raise RuntimeError("ticket insert did not return an ID")
+        ticket_id = int(cursor.lastrowid)
+        connection.executemany(
+            "INSERT INTO ticket_categories (ticket_id, category_id) VALUES (?, ?)",
+            ((ticket_id, category_id) for category_id in category_ids),
+        )
+        row = connection.execute(
+            "SELECT * FROM tickets WHERE ticket_id = ?",
+            (ticket_id,),
+        ).fetchone()
+        if row is None:
+            raise RuntimeError("created ticket could not be loaded")
+        return _decode_ticket(connection, row)
+
+    def _validate_ticket_category_ids(
+        self,
+        connection: sqlite3.Connection,
+        guild_id: int,
+        category_ids: tuple[int, ...],
+    ) -> tuple[int, ...]:
+        selected_category_ids = tuple(dict.fromkeys(category_ids))
+        valid_category_ids = {
+            int(row["category_id"])
+            for row in connection.execute(
+                "SELECT category_id FROM categories WHERE guild_id = ?",
+                (guild_id,),
+            )
+        }
+        if not set(selected_category_ids).issubset(valid_category_ids):
+            raise ValueError("ticket categories must belong to the guild")
+        return selected_category_ids
+
+    def _create_ticket_sync(self, new_ticket: NewTicket) -> Ticket:
+        self._validate_ticket_origin(new_ticket, pull_request_bound=False)
         with closing(self._connect()) as connection:
             connection.execute("BEGIN IMMEDIATE")
             try:
-                valid_category_ids = {
-                    int(row["category_id"])
-                    for row in connection.execute(
-                        "SELECT category_id FROM categories WHERE guild_id = ?",
-                        (new_ticket.guild_id,),
-                    )
-                }
-                if not set(category_ids).issubset(valid_category_ids):
-                    raise ValueError("ticket categories must belong to the guild")
-                timestamp = _serialize_datetime(new_ticket.created_at)
-                cursor = connection.execute(
+                ticket = self._insert_ticket(connection, new_ticket)
+                connection.commit()
+                return ticket
+            except Exception:
+                connection.rollback()
+                raise
+
+    @staticmethod
+    def _validate_ticket_origin(
+        new_ticket: NewTicket,
+        *,
+        pull_request_bound: bool,
+    ) -> None:
+        if new_ticket.origin is TicketOrigin.DISCORD and new_ticket.author_id is None:
+            raise ValueError("Discord-originated tickets require a Discord author")
+        if new_ticket.origin is TicketOrigin.GITHUB and not pull_request_bound:
+            raise ValueError("GitHub-originated tickets require a pull request binding")
+
+    def _upsert_pull_request(
+        self,
+        connection: sqlite3.Connection,
+        pull_request: GitHubPullRequest,
+    ) -> GitHubPullRequest:
+        repository_full_name = pull_request.repository_full_name.strip()
+        url = pull_request.url.strip()
+        title = pull_request.title.strip()
+        author_login = pull_request.github_author_login.strip()
+        if (
+            pull_request.repository_id <= 0
+            or pull_request.pr_number <= 0
+            or pull_request.github_pr_id <= 0
+            or pull_request.github_author_id <= 0
+            or not repository_full_name
+            or not url
+            or not author_login
+        ):
+            raise ValueError("pull request identity and display fields are required")
+        labels = tuple(
+            dict.fromkeys(label.strip() for label in pull_request.labels if label.strip())
+        )
+        assignees = tuple(
+            dict.fromkeys(
+                assignee.strip() for assignee in pull_request.assignees if assignee.strip()
+            )
+        )
+        existing = connection.execute(
+            """
+            SELECT * FROM github_pull_requests
+            WHERE repository_id = ? AND pr_number = ?
+            """,
+            (pull_request.repository_id, pull_request.pr_number),
+        ).fetchone()
+        if existing is not None and (
+            int(existing["github_pr_id"]) != pull_request.github_pr_id
+            or int(existing["github_author_id"]) != pull_request.github_author_id
+        ):
+            raise ValueError("immutable GitHub identity does not match stored identity")
+        timestamp = _serialize_datetime(pull_request.github_updated_at)
+        if existing is None:
+            connection.execute(
+                """
+                INSERT INTO github_pull_requests (
+                    repository_id, pr_number, github_pr_id, github_author_id,
+                    repository_full_name, pr_url, pr_title, github_author_login,
+                    draft, open, observed_labels, observed_assignees, github_updated_at,
+                    last_processed_action
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    pull_request.repository_id,
+                    pull_request.pr_number,
+                    pull_request.github_pr_id,
+                    pull_request.github_author_id,
+                    repository_full_name,
+                    url,
+                    title,
+                    author_login,
+                    int(pull_request.draft),
+                    int(pull_request.open),
+                    json.dumps(labels, separators=(",", ":")),
+                    json.dumps(assignees, separators=(",", ":")),
+                    timestamp,
+                    pull_request.last_processed_action,
+                ),
+            )
+        elif _deserialize_datetime(str(existing["github_updated_at"])) <= (
+            pull_request.github_updated_at
+        ):
+            connection.execute(
+                """
+                UPDATE github_pull_requests
+                SET repository_full_name = ?, pr_url = ?, pr_title = ?,
+                    github_author_login = ?, draft = ?, open = ?,
+                    observed_labels = ?, observed_assignees = ?, github_updated_at = ?,
+                    last_processed_action = COALESCE(?, last_processed_action)
+                WHERE repository_id = ? AND pr_number = ?
+                """,
+                (
+                    repository_full_name,
+                    url,
+                    title,
+                    author_login,
+                    int(pull_request.draft),
+                    int(pull_request.open),
+                    json.dumps(labels, separators=(",", ":")),
+                    json.dumps(assignees, separators=(",", ":")),
+                    timestamp,
+                    pull_request.last_processed_action,
+                    pull_request.repository_id,
+                    pull_request.pr_number,
+                ),
+            )
+        stored = connection.execute(
+            """
+            SELECT * FROM github_pull_requests
+            WHERE repository_id = ? AND pr_number = ?
+            """,
+            (pull_request.repository_id, pull_request.pr_number),
+        ).fetchone()
+        if stored is None:
+            raise RuntimeError("pull request observation could not be loaded")
+        return _decode_pull_request(stored)
+
+    def _create_ticket_for_pull_request_sync(
+        self,
+        new_ticket: NewTicket,
+        pull_request: GitHubPullRequest,
+    ) -> Ticket:
+        self._validate_ticket_origin(new_ticket, pull_request_bound=True)
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                observed = self._upsert_pull_request(connection, pull_request)
+                if observed.current_ticket_id is not None:
+                    raise ActivePullRequestTicketExists(
+                        (pull_request.repository_id, pull_request.pr_number)
+                    )
+                ticket = self._insert_ticket(connection, new_ticket)
+                changed = connection.execute(
                     """
-                    INSERT INTO tickets (
-                        public_token, guild_id, channel_id, author_id, pr_title, pr_url,
-                        category_display, routing_mode, state, direct_target_id,
-                        created_at, updated_at
-                    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, ?)
+                    UPDATE github_pull_requests
+                    SET current_ticket_id = ?
+                    WHERE repository_id = ? AND pr_number = ?
+                        AND current_ticket_id IS NULL
                     """,
                     (
-                        secrets.token_urlsafe(16),
-                        new_ticket.guild_id,
-                        new_ticket.channel_id,
-                        new_ticket.author_id,
-                        title,
-                        url,
-                        new_ticket.category_display,
-                        new_ticket.routing_mode.value,
-                        new_ticket.direct_target_id,
+                        ticket.ticket_id,
+                        pull_request.repository_id,
+                        pull_request.pr_number,
+                    ),
+                ).rowcount
+                if changed != 1:
+                    raise ActivePullRequestTicketExists(
+                        (pull_request.repository_id, pull_request.pr_number)
+                    )
+                connection.commit()
+                return ticket
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _observe_pull_request_sync(
+        self,
+        pull_request: GitHubPullRequest,
+        authoritative: bool,
+    ) -> PullRequestObservation:
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                existing_row = connection.execute(
+                    """
+                    SELECT * FROM github_pull_requests
+                    WHERE repository_id = ? AND pr_number = ?
+                    """,
+                    (pull_request.repository_id, pull_request.pr_number),
+                ).fetchone()
+                if existing_row is not None:
+                    existing = _decode_pull_request(existing_row)
+                    if (
+                        existing.github_pr_id != pull_request.github_pr_id
+                        or existing.github_author_id != pull_request.github_author_id
+                    ):
+                        raise ValueError("immutable GitHub identity does not match stored identity")
+                    if existing.github_updated_at > pull_request.github_updated_at:
+                        connection.commit()
+                        return PullRequestObservation(
+                            PullRequestObservationState.STALE,
+                            existing,
+                        )
+                    if (
+                        existing.github_updated_at == pull_request.github_updated_at
+                        and not authoritative
+                        and _pull_request_state(existing) != _pull_request_state(pull_request)
+                    ):
+                        connection.commit()
+                        return PullRequestObservation(
+                            PullRequestObservationState.CONFLICT,
+                            existing,
+                        )
+                observed = self._upsert_pull_request(connection, pull_request)
+                connection.commit()
+                return PullRequestObservation(
+                    PullRequestObservationState.APPLIED,
+                    observed,
+                )
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _get_pull_request_sync(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> GitHubPullRequest | None:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                """
+                SELECT * FROM github_pull_requests
+                WHERE repository_id = ? AND pr_number = ?
+                """,
+                (repository_id, pr_number),
+            ).fetchone()
+        return _decode_pull_request(row) if row is not None else None
+
+    def _get_pull_request_for_ticket_sync(
+        self,
+        ticket_id: int,
+    ) -> GitHubPullRequest | None:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                """
+                SELECT * FROM github_pull_requests WHERE current_ticket_id = ?
+                """,
+                (ticket_id,),
+            ).fetchone()
+        return _decode_pull_request(row) if row is not None else None
+
+    def _accept_delivery_sync(
+        self,
+        identity: tuple[str, int | None, str, str | None, int],
+        target: tuple[int | None, int | None],
+        content: tuple[datetime, bytes],
+    ) -> bool:
+        delivery_guid, github_delivery_id, event, action, installation_id = identity
+        repository_id, pr_number = target
+        received_at, raw_body = content
+        normalized_guid = delivery_guid.strip()
+        normalized_event = event.strip()
+        normalized_action = action.strip() if action else None
+        if not normalized_guid or not normalized_event or installation_id <= 0:
+            raise ValueError("delivery identity and event are required")
+        if (repository_id is None) != (pr_number is None):
+            raise ValueError("repository ID and pull request number must be paired")
+        if repository_id is not None and repository_id <= 0:
+            raise ValueError("repository ID must be positive")
+        if pr_number is not None and pr_number <= 0:
+            raise ValueError("pull request number must be positive")
+        if len(raw_body) > MAX_DELIVERY_BODY_BYTES:
+            raise ValueError("delivery raw body exceeds the retention limit")
+        timestamp = _serialize_datetime(received_at)
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                existing = connection.execute(
+                    "SELECT * FROM github_deliveries WHERE delivery_guid = ?",
+                    (normalized_guid,),
+                ).fetchone()
+                if existing is not None and not (
+                    str(existing["state"])
+                    == GitHubDeliveryState.AWAITING_REDELIVERY.value
+                    and str(existing["event"]) == normalized_event
+                    and (
+                        str(existing["action"])
+                        if existing["action"] is not None
+                        else None
+                    )
+                    == normalized_action
+                    and int(existing["installation_id"]) == installation_id
+                    and (
+                        int(existing["repository_id"])
+                        if existing["repository_id"] is not None
+                        else None
+                    )
+                    == repository_id
+                    and (
+                        int(existing["pr_number"])
+                        if existing["pr_number"] is not None
+                        else None
+                    )
+                    == pr_number
+                ):
+                    connection.rollback()
+                    return False
+                if existing is not None:
+                    connection.execute(
+                        """
+                        UPDATE github_deliveries
+                        SET github_delivery_id = COALESCE(?, github_delivery_id),
+                            received_at = ?, state = 'pending', attempts = 0,
+                            next_attempt_at = ?, processing_started_at = NULL,
+                            completed_at = NULL, error_summary = NULL, raw_body = ?
+                        WHERE delivery_guid = ? AND state = 'awaiting_redelivery'
+                        """,
+                        (
+                            github_delivery_id,
+                            timestamp,
+                            timestamp,
+                            raw_body,
+                            normalized_guid,
+                        ),
+                    )
+                    connection.commit()
+                    return True
+                connection.execute(
+                    """
+                    INSERT INTO github_deliveries (
+                        delivery_guid, github_delivery_id, event, action,
+                        installation_id, repository_id, pr_number, received_at,
+                        state, attempts, next_attempt_at, raw_body
+                    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', 0, ?, ?)
+                    """,
+                    (
+                        normalized_guid,
+                        github_delivery_id,
+                        normalized_event,
+                        normalized_action,
+                        installation_id,
+                        repository_id,
+                        pr_number,
                         timestamp,
                         timestamp,
+                        raw_body,
                     ),
                 )
-                if cursor.lastrowid is None:
-                    raise RuntimeError("ticket insert did not return an ID")
-                ticket_id = int(cursor.lastrowid)
-                connection.executemany(
-                    "INSERT INTO ticket_categories (ticket_id, category_id) VALUES (?, ?)",
-                    ((ticket_id, category_id) for category_id in category_ids),
+                connection.commit()
+                return True
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _claim_next_delivery_sync(
+        self,
+        now: datetime,
+        stale_before: datetime,
+    ) -> GitHubDelivery | None:
+        now_value = _serialize_datetime(now)
+        stale_value = _serialize_datetime(stale_before)
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                connection.execute(
+                    """
+                    UPDATE github_deliveries
+                    SET state = 'retry', next_attempt_at = ?,
+                        processing_started_at = NULL
+                    WHERE state = 'processing' AND processing_started_at <= ?
+                    """,
+                    (now_value, stale_value),
                 )
                 row = connection.execute(
-                    "SELECT * FROM tickets WHERE ticket_id = ?",
-                    (ticket_id,),
+                    """
+                    SELECT * FROM github_deliveries
+                    WHERE state IN ('pending', 'retry') AND next_attempt_at <= ?
+                    ORDER BY next_attempt_at, received_at, delivery_guid
+                    LIMIT 1
+                    """,
+                    (now_value,),
                 ).fetchone()
                 if row is None:
-                    raise RuntimeError("created ticket could not be loaded")
-                ticket = _decode_ticket(connection, row)
+                    connection.rollback()
+                    return None
+                connection.execute(
+                    """
+                    UPDATE github_deliveries
+                    SET state = 'processing', attempts = attempts + 1,
+                        processing_started_at = ?, next_attempt_at = NULL
+                    WHERE delivery_guid = ? AND state IN ('pending', 'retry')
+                    """,
+                    (now_value, row["delivery_guid"]),
+                )
+                claimed = connection.execute(
+                    "SELECT * FROM github_deliveries WHERE delivery_guid = ?",
+                    (row["delivery_guid"],),
+                ).fetchone()
                 connection.commit()
-                return ticket
+                return _decode_delivery(claimed)
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _get_delivery_sync(self, delivery_guid: str) -> GitHubDelivery | None:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                "SELECT * FROM github_deliveries WHERE delivery_guid = ?",
+                (delivery_guid,),
+            ).fetchone()
+        return _decode_delivery(row) if row is not None else None
+
+    def _prepare_delivery_redelivery_sync(
+        self,
+        delivery_guid: str,
+        github_delivery_id: int,
+        now: datetime,
+        next_attempt_at: datetime,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_deliveries
+            SET github_delivery_id = COALESCE(github_delivery_id, ?),
+                state = 'awaiting_redelivery', next_attempt_at = ?,
+                processing_started_at = NULL, completed_at = NULL
+            WHERE delivery_guid = ?
+                AND state IN ('failed', 'awaiting_redelivery')
+                AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+            """,
+            (
+                github_delivery_id,
+                _serialize_datetime(next_attempt_at),
+                delivery_guid,
+                _serialize_datetime(now),
+            ),
+        )
+        return changed > 0
+
+    def _restore_delivery_redelivery_sync(
+        self,
+        delivery_guid: str,
+        raw_body: bytes | None,
+        next_attempt_at: datetime | None,
+        error_summary: str,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_deliveries
+            SET state = 'failed', raw_body = ?, next_attempt_at = ?,
+                error_summary = ?
+            WHERE delivery_guid = ? AND state = 'awaiting_redelivery'
+            """,
+            (
+                raw_body,
+                _serialize_optional_datetime(next_attempt_at),
+                error_summary.strip()[:MAX_ERROR_SUMMARY_LENGTH],
+                delivery_guid,
+            ),
+        )
+        return changed > 0
+
+    def _get_delivery_recovery_checkpoint_sync(self) -> tuple[int, int | None]:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                """
+                SELECT next_page, last_delivery_id
+                FROM github_delivery_recovery WHERE singleton = 1
+                """
+            ).fetchone()
+        if row is None:
+            return 1, None
+        return (
+            int(row["next_page"]),
+            (
+                int(row["last_delivery_id"])
+                if row["last_delivery_id"] is not None
+                else None
+            ),
+        )
+
+    def _save_delivery_recovery_checkpoint_sync(
+        self,
+        next_page: int,
+        last_delivery_id: int | None,
+        checked_at: datetime,
+    ) -> None:
+        with closing(self._connect()) as connection:
+            connection.execute(
+                """
+                INSERT INTO github_delivery_recovery (
+                    singleton, next_page, last_delivery_id, checked_at
+                ) VALUES (1, ?, ?, ?)
+                ON CONFLICT(singleton) DO UPDATE SET
+                    next_page = excluded.next_page,
+                    last_delivery_id = excluded.last_delivery_id,
+                    checked_at = excluded.checked_at
+                """,
+                (
+                    next_page,
+                    last_delivery_id,
+                    _serialize_datetime(checked_at),
+                ),
+            )
+            connection.commit()
+
+    def _complete_delivery_sync(
+        self,
+        delivery_guid: str,
+        completed_at: datetime,
+        ignored: bool,
+    ) -> bool:
+        state = (
+            GitHubDeliveryState.IGNORED.value if ignored else GitHubDeliveryState.PROCESSED.value
+        )
+        changed = self._execute_update(
+            """
+            UPDATE github_deliveries
+            SET state = ?, next_attempt_at = NULL,
+                processing_started_at = NULL, completed_at = ?,
+                error_summary = NULL, raw_body = NULL
+            WHERE delivery_guid = ? AND state = 'processing'
+            """,
+            (state, _serialize_datetime(completed_at), delivery_guid),
+        )
+        return changed > 0
+
+    def _defer_delivery_sync(
+        self,
+        delivery_guid: str,
+        next_attempt_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_deliveries
+            SET state = 'retry', next_attempt_at = ?,
+                processing_started_at = NULL, error_summary = ?
+            WHERE delivery_guid = ? AND state = 'processing'
+            """,
+            (
+                _serialize_datetime(next_attempt_at),
+                error_summary.strip()[:MAX_ERROR_SUMMARY_LENGTH],
+                delivery_guid,
+            ),
+        )
+        return changed > 0
+
+    def _fail_delivery_sync(
+        self,
+        delivery_guid: str,
+        completed_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_deliveries
+            SET state = 'failed', next_attempt_at = NULL,
+                processing_started_at = NULL, completed_at = ?, error_summary = ?
+            WHERE delivery_guid = ? AND state = 'processing'
+            """,
+            (
+                _serialize_datetime(completed_at),
+                error_summary.strip()[:MAX_ERROR_SUMMARY_LENGTH],
+                delivery_guid,
+            ),
+        )
+        return changed > 0
+
+    def _prune_deliveries_sync(self, now: datetime) -> tuple[int, int]:
+        raw_body_cutoff = _serialize_datetime(now - DELIVERY_RAW_BODY_RETENTION)
+        identity_cutoff = _serialize_datetime(now - DELIVERY_IDENTITY_RETENTION)
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                cleared = connection.execute(
+                    """
+                    UPDATE github_deliveries SET raw_body = NULL
+                    WHERE received_at < ? AND raw_body IS NOT NULL
+                        AND state IN (
+                            'awaiting_redelivery', 'processed', 'ignored', 'failed'
+                        )
+                    """,
+                    (raw_body_cutoff,),
+                ).rowcount
+                deleted = connection.execute(
+                    """
+                    DELETE FROM github_deliveries
+                    WHERE (
+                        completed_at < ?
+                        AND state IN ('processed', 'ignored', 'failed')
+                    ) OR (
+                        received_at < ? AND state = 'awaiting_redelivery'
+                    )
+                    """,
+                    (identity_cutoff, identity_cutoff),
+                ).rowcount
+                connection.commit()
+                return cleared, deleted
             except Exception:
                 connection.rollback()
                 raise
@@ -1313,11 +2644,15 @@ def _activate_ticket_sync(
     ) -> bool:
         message_id, thread_id = projection_ids
         protection_until, next_action, next_action_at = schedule
-        cursor = self._update_ticket_state(
+        cursor = self._execute_update(
             """
             UPDATE tickets
             SET message_id = ?, thread_id = ?, state = 'open',
                 protection_until = ?, next_action = ?, next_action_at = ?,
+                category_prompt_retry_at = CASE
+                    WHEN origin = 'github' THEN ?
+                    ELSE NULL
+                END,
                 projection_sync_at = NULL, updated_at = ?,
                 transition_version = transition_version + 1
             WHERE ticket_id = ? AND state = 'creating'
@@ -1329,18 +2664,96 @@ def _activate_ticket_sync(
                 next_action.value if next_action is not None else None,
                 _serialize_optional_datetime(next_action_at),
                 _serialize_datetime(updated_at),
+                _serialize_datetime(updated_at),
                 ticket_id,
             ),
         )
         return cursor > 0
 
+    def _start_automatic_routing_sync(
+        self,
+        ticket_id: int,
+        category_ids: tuple[int, ...],
+        category_display: str,
+        next_action_at: datetime,
+        updated_at: datetime,
+    ) -> Ticket | None:
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                row = connection.execute(
+                    """
+                    SELECT guild_id FROM tickets
+                    WHERE ticket_id = ? AND state IN ('open', 'claimed')
+                        AND routing_mode = 'none'
+                    """,
+                    (ticket_id,),
+                ).fetchone()
+                if row is None:
+                    connection.rollback()
+                    return None
+                selected_category_ids = self._validate_ticket_category_ids(
+                    connection,
+                    int(row["guild_id"]),
+                    category_ids,
+                )
+
+                connection.execute(
+                    "DELETE FROM ticket_categories WHERE ticket_id = ?",
+                    (ticket_id,),
+                )
+                connection.executemany(
+                    """
+                    INSERT INTO ticket_categories (ticket_id, category_id)
+                    VALUES (?, ?)
+                    """,
+                    (
+                        (ticket_id, category_id)
+                        for category_id in selected_category_ids
+                    ),
+                )
+                timestamp = _serialize_datetime(updated_at)
+                connection.execute(
+                    """
+                    UPDATE tickets
+                    SET category_display = ?, routing_mode = 'automatic',
+                        category_prompt_retry_at = NULL,
+                        next_action = CASE state
+                            WHEN 'open' THEN 'automatic_ping'
+                            ELSE NULL
+                        END,
+                        next_action_at = CASE state WHEN 'open' THEN ? ELSE NULL END,
+                        projection_sync_at = ?, updated_at = ?,
+                        transition_version = transition_version + 1
+                    WHERE ticket_id = ? AND state IN ('open', 'claimed')
+                        AND routing_mode = 'none'
+                    """,
+                    (
+                        category_display,
+                        _serialize_datetime(next_action_at),
+                        timestamp,
+                        timestamp,
+                        ticket_id,
+                    ),
+                )
+                updated = connection.execute(
+                    "SELECT * FROM tickets WHERE ticket_id = ?",
+                    (ticket_id,),
+                ).fetchone()
+                routed = _decode_ticket(connection, updated)
+                connection.commit()
+                return routed
+            except Exception:
+                connection.rollback()
+                raise
+
     def _record_ticket_message_sync(
         self,
         ticket_id: int,
         message_id: int,
         updated_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET message_id = ?, updated_at = ?,
@@ -1361,7 +2774,7 @@ def _record_ticket_thread_sync(
         thread_id: int,
         updated_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET thread_id = ?, updated_at = ?,
@@ -1385,6 +2798,47 @@ def _get_ticket_sync(self, ticket_id: int) -> Ticket | None:
             ).fetchone()
             return _decode_ticket(connection, row) if row is not None else None
 
+    def _update_ticket_title_sync(
+        self,
+        ticket_id: int,
+        title: str,
+        updated_at: datetime,
+    ) -> Ticket | None:
+        normalized_title = title.strip()
+        if not normalized_title:
+            raise ValueError("ticket title is required")
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                changed = connection.execute(
+                    """
+                    UPDATE tickets
+                    SET pr_title = ?, updated_at = ?, projection_sync_at = ?,
+                        transition_version = transition_version + 1
+                    WHERE ticket_id = ? AND state IN ('open', 'claimed')
+                        AND pr_title != ?
+                    """,
+                    (
+                        normalized_title,
+                        _serialize_datetime(updated_at),
+                        _serialize_datetime(updated_at),
+                        ticket_id,
+                        normalized_title,
+                    ),
+                ).rowcount
+                if changed == 0:
+                    connection.rollback()
+                    return None
+                row = connection.execute(
+                    "SELECT * FROM tickets WHERE ticket_id = ?",
+                    (ticket_id,),
+                ).fetchone()
+                connection.commit()
+                return _decode_ticket(connection, row) if row is not None else None
+            except Exception:
+                connection.rollback()
+                raise
+
     def _get_ticket_by_public_token_sync(self, public_token: str) -> Ticket | None:
         with closing(self._connect()) as connection:
             row = connection.execute(
@@ -1410,7 +2864,7 @@ def _acknowledge_projection_sync_sync(
         ticket_id: int,
         transition_version: int,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET projection_sync_at = NULL
@@ -1427,7 +2881,7 @@ def _defer_projection_sync_sync(
         transition_version: int,
         retry_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET projection_sync_at = ?
@@ -1441,6 +2895,38 @@ def _defer_projection_sync_sync(
         )
         return changed > 0
 
+    def _acknowledge_category_prompt_sync(
+        self,
+        ticket_id: int,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE tickets
+            SET category_prompt_retry_at = NULL
+            WHERE ticket_id = ? AND category_prompt_retry_at IS NOT NULL
+            """,
+            (ticket_id,),
+        )
+        return changed > 0
+
+    def _defer_category_prompt_sync(
+        self,
+        ticket_id: int,
+        retry_at: datetime,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE tickets
+            SET category_prompt_retry_at = ?
+            WHERE ticket_id = ? AND category_prompt_retry_at IS NOT NULL
+            """,
+            (
+                _serialize_datetime(retry_at),
+                ticket_id,
+            ),
+        )
+        return changed > 0
+
     def _get_ticket_by_projection_id_sync(
         self,
         column: str,
@@ -1484,7 +2970,31 @@ def _claim_sync(
         protection_until: datetime,
         updated_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                changed = self._claim_ticket(
+                    connection,
+                    ticket_id,
+                    assignee_id,
+                    protection_until,
+                    updated_at,
+                )
+                connection.commit()
+                return changed
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _claim_ticket(
+        self,
+        connection: sqlite3.Connection,
+        ticket_id: int,
+        assignee_id: int,
+        protection_until: datetime,
+        updated_at: datetime,
+    ) -> bool:
+        changed = connection.execute(
             """
             UPDATE tickets
             SET state = 'claimed', assignee_id = ?, current_target_id = NULL,
@@ -1504,9 +3014,125 @@ def _claim_sync(
                 _serialize_datetime(updated_at),
                 ticket_id,
             ),
-        )
+        ).rowcount
         return changed > 0
 
+    def _pull_request_identity_for_ticket(
+        self,
+        connection: sqlite3.Connection,
+        ticket_id: int,
+    ) -> tuple[int, int, str]:
+        row = connection.execute(
+            """
+            SELECT repository_id, pr_number, repository_full_name
+            FROM github_pull_requests
+            WHERE current_ticket_id = ?
+            """,
+            (ticket_id,),
+        ).fetchone()
+        if row is None:
+            raise ValueError("ticket does not have an active GitHub pull request binding")
+        return (
+            int(row["repository_id"]),
+            int(row["pr_number"]),
+            str(row["repository_full_name"]).strip(),
+        )
+
+    def _insert_outbox_intent(
+        self,
+        connection: sqlite3.Connection,
+        *,
+        operation: GitHubOutboxOperation,
+        ticket_id: int,
+        repository_id: int,
+        repository_full_name: str,
+        pr_number: int,
+        github_login: str,
+        actor_user_id: int,
+        created_at: datetime,
+        state: GitHubOutboxState = GitHubOutboxState.PENDING,
+    ) -> None:
+        row = connection.execute(
+            "SELECT transition_version FROM tickets WHERE ticket_id = ?",
+            (ticket_id,),
+        ).fetchone()
+        if row is None:
+            raise RuntimeError("transitioned ticket could not be loaded")
+        timestamp = _serialize_datetime(created_at)
+        connection.execute(
+            """
+            INSERT INTO github_outbox (
+                operation, ticket_id, transition_version, repository_id,
+                repository_full_name, pr_number, github_login, actor_user_id,
+                state, attempts, next_attempt_at, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?)
+            """,
+            (
+                operation.value,
+                ticket_id,
+                int(row["transition_version"]),
+                repository_id,
+                repository_full_name,
+                pr_number,
+                github_login,
+                actor_user_id,
+                state.value,
+                timestamp if state is GitHubOutboxState.PENDING else None,
+                timestamp,
+                timestamp,
+            ),
+        )
+
+    def _claim_with_github_assignment_sync(
+        self,
+        ticket_id: int,
+        assignee_id: int,
+        github_login: str,
+        assignment: tuple[bool, datetime, datetime],
+    ) -> bool:
+        github_write_required, protection_until, updated_at = assignment
+        normalized_login = github_login.strip().casefold()
+        if not normalized_login:
+            raise ValueError("GitHub login cannot be empty")
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                (
+                    repository_id,
+                    pr_number,
+                    repository_full_name,
+                ) = self._pull_request_identity_for_ticket(connection, ticket_id)
+                if not self._claim_ticket(
+                    connection,
+                    ticket_id,
+                    assignee_id,
+                    protection_until,
+                    updated_at,
+                ):
+                    connection.rollback()
+                    return False
+                self._insert_outbox_intent(
+                    connection,
+                    operation=GitHubOutboxOperation.ADD_ASSIGNEE,
+                    ticket_id=ticket_id,
+                    repository_id=repository_id,
+                    repository_full_name=repository_full_name,
+                    pr_number=pr_number,
+                    github_login=normalized_login,
+                    actor_user_id=assignee_id,
+                    created_at=updated_at,
+                    state=(
+                        GitHubOutboxState.PENDING
+                        if github_write_required
+                        else GitHubOutboxState.SUCCEEDED
+                    ),
+                )
+                connection.commit()
+                return True
+            except Exception:
+                connection.rollback()
+                raise
+
     def _decline_sync(
         self,
         ticket_id: int,
@@ -1539,10 +3165,7 @@ def _decline_sync(
                 if inserted == 0:
                     connection.rollback()
                     return False
-                if (
-                    row["current_target_id"] == user_id
-                    or row["pending_target_id"] == user_id
-                ):
+                if row["current_target_id"] == user_id or row["pending_target_id"] == user_id:
                     connection.execute(
                         """
                         UPDATE tickets
@@ -1598,50 +3221,251 @@ def _unassign_sync(
         with closing(self._connect()) as connection:
             connection.execute("BEGIN IMMEDIATE")
             try:
-                row = connection.execute(
-                    "SELECT assignee_id FROM tickets WHERE ticket_id = ? AND state = 'claimed'",
+                assignee_id = self._unassign_ticket(
+                    connection,
+                    ticket_id,
+                    (protection_until, next_action, next_action_at, updated_at),
+                )
+                if assignee_id is None:
+                    connection.rollback()
+                    return None
+                connection.commit()
+                return assignee_id
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _unassign_ticket(
+        self,
+        connection: sqlite3.Connection,
+        ticket_id: int,
+        schedule: tuple[datetime, NextAction | None, datetime | None, datetime],
+    ) -> int | None:
+        protection_until, next_action, next_action_at, updated_at = schedule
+        row = connection.execute(
+            "SELECT assignee_id FROM tickets WHERE ticket_id = ? AND state = 'claimed'",
+            (ticket_id,),
+        ).fetchone()
+        if row is None or row["assignee_id"] is None:
+            return None
+        assignee_id = int(row["assignee_id"])
+        connection.execute(
+            """
+            INSERT OR IGNORE INTO ticket_exclusions (
+                ticket_id, user_id, reason, created_at
+            ) VALUES (?, ?, 'unassigned', ?)
+            """,
+            (ticket_id, assignee_id, _serialize_datetime(updated_at)),
+        )
+        connection.execute(
+            """
+            UPDATE tickets
+            SET state = 'open', assignee_id = NULL, current_target_id = NULL,
+                protection_until = ?, next_action = ?, next_action_at = ?,
+                pending_target_id = NULL, pending_presence_tier = NULL,
+                pending_ping_automatic = NULL,
+                pending_ping_reserved_at = NULL,
+                pending_response_deadline = NULL,
+                updated_at = ?, projection_sync_at = ?,
+                transition_version = transition_version + 1
+            WHERE ticket_id = ? AND state = 'claimed'
+            """,
+            (
+                _serialize_datetime(protection_until),
+                next_action.value if next_action is not None else None,
+                _serialize_optional_datetime(next_action_at),
+                _serialize_datetime(updated_at),
+                _serialize_datetime(updated_at),
+                ticket_id,
+            ),
+        )
+        return assignee_id
+
+    def _unassign_with_github_outbox_sync(
+        self,
+        ticket_id: int,
+        schedule: tuple[datetime, NextAction | None, datetime | None, datetime],
+    ) -> int | None:
+        protection_until, next_action, next_action_at, updated_at = schedule
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                add_intent = connection.execute(
+                    """
+                    SELECT outbox.repository_id, outbox.repository_full_name,
+                        outbox.pr_number, outbox.github_login
+                    FROM github_outbox AS outbox
+                    JOIN tickets AS ticket ON ticket.ticket_id = outbox.ticket_id
+                    WHERE outbox.ticket_id = ?
+                        AND outbox.outbox_id = (
+                            SELECT MAX(latest.outbox_id)
+                            FROM github_outbox AS latest
+                            WHERE latest.ticket_id = outbox.ticket_id
+                        )
+                        AND outbox.operation = 'add_assignee'
+                        AND outbox.actor_user_id = ticket.assignee_id
+                        AND outbox.state IN (
+                            'pending', 'processing', 'retry', 'succeeded'
+                        )
+                    ORDER BY outbox.outbox_id DESC
+                    LIMIT 1
+                    """,
                     (ticket_id,),
                 ).fetchone()
-                if row is None or row["assignee_id"] is None:
+                assignee_id = self._unassign_ticket(
+                    connection,
+                    ticket_id,
+                    schedule,
+                )
+                if assignee_id is None:
                     connection.rollback()
                     return None
-                assignee_id = int(row["assignee_id"])
+                if add_intent is not None:
+                    self._insert_outbox_intent(
+                        connection,
+                        operation=GitHubOutboxOperation.REMOVE_ASSIGNEE,
+                        ticket_id=ticket_id,
+                        repository_id=int(add_intent["repository_id"]),
+                        repository_full_name=str(
+                            add_intent["repository_full_name"]
+                        ),
+                        pr_number=int(add_intent["pr_number"]),
+                        github_login=str(add_intent["github_login"]),
+                        actor_user_id=assignee_id,
+                        created_at=updated_at,
+                    )
+                connection.commit()
+                return assignee_id
+            except Exception:
+                connection.rollback()
+                raise
+
+    def _claim_next_outbox_sync(
+        self,
+        now: datetime,
+        stale_before: datetime,
+    ) -> GitHubOutboxItem | None:
+        now_value = _serialize_datetime(now)
+        stale_value = _serialize_datetime(stale_before)
+        with closing(self._connect()) as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
                 connection.execute(
                     """
-                    INSERT OR IGNORE INTO ticket_exclusions (
-                        ticket_id, user_id, reason, created_at
-                    ) VALUES (?, ?, 'unassigned', ?)
+                    UPDATE github_outbox
+                    SET state = 'retry', next_attempt_at = ?,
+                        processing_started_at = NULL, updated_at = ?
+                    WHERE state = 'processing' AND processing_started_at <= ?
                     """,
-                    (ticket_id, assignee_id, _serialize_datetime(updated_at)),
+                    (now_value, now_value, stale_value),
                 )
+                row = connection.execute(
+                    """
+                    SELECT candidate.* FROM github_outbox AS candidate
+                    WHERE candidate.state IN ('pending', 'retry')
+                        AND candidate.next_attempt_at <= ?
+                        AND NOT EXISTS (
+                            SELECT 1 FROM github_outbox AS predecessor
+                            WHERE predecessor.repository_id = candidate.repository_id
+                                AND predecessor.pr_number = candidate.pr_number
+                                AND predecessor.outbox_id < candidate.outbox_id
+                                AND predecessor.state IN (
+                                    'pending', 'processing', 'retry'
+                                )
+                        )
+                    ORDER BY candidate.next_attempt_at,
+                        candidate.created_at, candidate.outbox_id
+                    LIMIT 1
+                    """,
+                    (now_value,),
+                ).fetchone()
+                if row is None:
+                    connection.rollback()
+                    return None
                 connection.execute(
                     """
-                    UPDATE tickets
-                    SET state = 'open', assignee_id = NULL, current_target_id = NULL,
-                        protection_until = ?, next_action = ?, next_action_at = ?,
-                        pending_target_id = NULL, pending_presence_tier = NULL,
-                        pending_ping_automatic = NULL,
-                        pending_ping_reserved_at = NULL,
-                        pending_response_deadline = NULL,
-                        updated_at = ?, projection_sync_at = ?,
-                        transition_version = transition_version + 1
-                    WHERE ticket_id = ? AND state = 'claimed'
+                    UPDATE github_outbox
+                    SET state = 'processing', attempts = attempts + 1,
+                        next_attempt_at = NULL, processing_started_at = ?,
+                        updated_at = ?
+                    WHERE outbox_id = ? AND state IN ('pending', 'retry')
                     """,
-                    (
-                        _serialize_datetime(protection_until),
-                        next_action.value if next_action is not None else None,
-                        _serialize_optional_datetime(next_action_at),
-                        _serialize_datetime(updated_at),
-                        _serialize_datetime(updated_at),
-                        ticket_id,
-                    ),
+                    (now_value, now_value, row["outbox_id"]),
                 )
+                claimed = connection.execute(
+                    "SELECT * FROM github_outbox WHERE outbox_id = ?",
+                    (row["outbox_id"],),
+                ).fetchone()
                 connection.commit()
-                return assignee_id
+                return _decode_outbox(claimed)
             except Exception:
                 connection.rollback()
                 raise
 
+    def _get_outbox_item_sync(self, outbox_id: int) -> GitHubOutboxItem | None:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                "SELECT * FROM github_outbox WHERE outbox_id = ?",
+                (outbox_id,),
+            ).fetchone()
+        return _decode_outbox(row) if row is not None else None
+
+    def _complete_outbox_sync(self, outbox_id: int, completed_at: datetime) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_outbox
+            SET state = 'succeeded', next_attempt_at = NULL,
+                processing_started_at = NULL, error_summary = NULL, updated_at = ?
+            WHERE outbox_id = ? AND state = 'processing'
+            """,
+            (_serialize_datetime(completed_at), outbox_id),
+        )
+        return changed > 0
+
+    def _defer_outbox_sync(
+        self,
+        outbox_id: int,
+        next_attempt_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        timestamp = _serialize_datetime(next_attempt_at)
+        changed = self._execute_update(
+            """
+            UPDATE github_outbox
+            SET state = 'retry', next_attempt_at = ?,
+                processing_started_at = NULL, error_summary = ?, updated_at = ?
+            WHERE outbox_id = ? AND state = 'processing'
+            """,
+            (
+                timestamp,
+                error_summary.strip()[:MAX_ERROR_SUMMARY_LENGTH],
+                timestamp,
+                outbox_id,
+            ),
+        )
+        return changed > 0
+
+    def _fail_outbox_sync(
+        self,
+        outbox_id: int,
+        failed_at: datetime,
+        error_summary: str,
+    ) -> bool:
+        changed = self._execute_update(
+            """
+            UPDATE github_outbox
+            SET state = 'failed', next_attempt_at = NULL,
+                processing_started_at = NULL, error_summary = ?, updated_at = ?
+            WHERE outbox_id = ? AND state = 'processing'
+            """,
+            (
+                error_summary.strip()[:MAX_ERROR_SUMMARY_LENGTH],
+                _serialize_datetime(failed_at),
+                outbox_id,
+            ),
+        )
+        return changed > 0
+
     def _list_exclusions_sync(self, ticket_id: int) -> tuple[TicketExclusion, ...]:
         with closing(self._connect()) as connection:
             rows = connection.execute(
@@ -1688,9 +3512,7 @@ def _reserve_ping_sync(
                             else None
                         ),
                         automatic=bool(row["pending_ping_automatic"]),
-                        reserved_at=_deserialize_datetime(
-                            str(row["pending_ping_reserved_at"])
-                        ),
+                        reserved_at=_deserialize_datetime(str(row["pending_ping_reserved_at"])),
                         response_deadline=_deserialize_datetime(
                             str(row["pending_response_deadline"])
                         ),
@@ -1758,9 +3580,7 @@ def _acknowledge_ping_sync(
                     else None
                 )
                 automatic = bool(row["pending_ping_automatic"])
-                response_deadline = _deserialize_datetime(
-                    str(row["pending_response_deadline"])
-                )
+                response_deadline = _deserialize_datetime(str(row["pending_response_deadline"]))
                 connection.execute(
                     """
                     INSERT INTO ticket_pings (
@@ -1880,7 +3700,7 @@ def _defer_due_ping_sync(
         next_action_at: datetime,
         updated_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET next_action_at = ?, updated_at = ?,
@@ -1902,7 +3722,7 @@ def _exhaust_due_routing_sync(
         expected_action: NextAction,
         updated_at: datetime,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET next_action = NULL, next_action_at = NULL,
@@ -1981,6 +3801,10 @@ def _nearest_deadline_sync(self) -> datetime | None:
                     SELECT projection_sync_at AS deadline
                     FROM tickets
                     WHERE projection_sync_at IS NOT NULL
+                    UNION ALL
+                    SELECT category_prompt_retry_at AS deadline
+                    FROM tickets
+                    WHERE category_prompt_retry_at IS NOT NULL
                 )
                 """
             ).fetchone()
@@ -1995,13 +3819,22 @@ def _due_ticket_ids_sync(self, now: datetime) -> tuple[int, ...]:
                     state = 'open' AND next_action_at <= ?
                 ) OR (
                     projection_sync_at <= ?
+                ) OR (
+                    category_prompt_retry_at <= ?
                 )
                 ORDER BY CASE
-                    WHEN projection_sync_at IS NOT NULL THEN projection_sync_at
+                    WHEN category_prompt_retry_at IS NOT NULL
+                        THEN category_prompt_retry_at
+                    WHEN projection_sync_at IS NOT NULL
+                        THEN projection_sync_at
                     ELSE next_action_at
                 END, ticket_id
                 """,
-                (_serialize_datetime(now), _serialize_datetime(now)),
+                (
+                    _serialize_datetime(now),
+                    _serialize_datetime(now),
+                    _serialize_datetime(now),
+                ),
             ).fetchall()
         return tuple(int(row["ticket_id"]) for row in rows)
 
@@ -2037,6 +3870,57 @@ def _delete_guild_state_sync(self, guild_id: int) -> bool:
             connection.execute("BEGIN IMMEDIATE")
             try:
                 changed = 0
+                connection.execute(
+                    """
+                    CREATE TEMP TABLE deleted_guild_pull_requests AS
+                    SELECT pull.repository_id, pull.pr_number
+                    FROM github_pull_requests AS pull
+                    JOIN tickets AS ticket
+                        ON ticket.ticket_id = pull.current_ticket_id
+                    WHERE ticket.guild_id = ?
+                    """,
+                    (guild_id,),
+                )
+                changed += connection.execute(
+                    """
+                    DELETE FROM github_deliveries
+                    WHERE EXISTS (
+                        SELECT 1 FROM deleted_guild_pull_requests AS deleted
+                        WHERE deleted.repository_id = github_deliveries.repository_id
+                            AND deleted.pr_number = github_deliveries.pr_number
+                    )
+                    """
+                ).rowcount
+                changed += connection.execute(
+                    """
+                    DELETE FROM github_pull_requests
+                    WHERE EXISTS (
+                        SELECT 1 FROM deleted_guild_pull_requests AS deleted
+                        WHERE deleted.repository_id = github_pull_requests.repository_id
+                            AND deleted.pr_number = github_pull_requests.pr_number
+                    )
+                    """
+                ).rowcount
+                changed += connection.execute(
+                    """
+                    DELETE FROM github_outbox
+                    WHERE state IN ('succeeded', 'failed')
+                        AND ticket_id IN (
+                            SELECT ticket_id FROM tickets WHERE guild_id = ?
+                        )
+                    """,
+                    (guild_id,),
+                ).rowcount
+                changed += connection.execute(
+                    """
+                    UPDATE github_outbox SET actor_user_id = NULL
+                    WHERE actor_user_id IS NOT NULL
+                        AND ticket_id IN (
+                            SELECT ticket_id FROM tickets WHERE guild_id = ?
+                        )
+                    """,
+                    (guild_id,),
+                ).rowcount
                 changed += connection.execute(
                     "DELETE FROM tickets WHERE guild_id = ?",
                     (guild_id,),
@@ -2049,6 +3933,15 @@ def _delete_guild_state_sync(self, guild_id: int) -> bool:
                     "DELETE FROM categories WHERE guild_id = ?",
                     (guild_id,),
                 ).rowcount
+                if connection.execute("SELECT 1 FROM tickets LIMIT 1").fetchone() is None:
+                    changed += connection.execute(
+                        """
+                        DELETE FROM github_outbox
+                        WHERE state IN ('succeeded', 'failed')
+                        """
+                    ).rowcount
+                    changed += connection.execute("DELETE FROM github_pull_requests").rowcount
+                    changed += connection.execute("DELETE FROM github_deliveries").rowcount
                 connection.commit()
                 return changed > 0
             except Exception:
@@ -2087,9 +3980,14 @@ def _user_reference_guild_ids_sync(self, user_id: int) -> tuple[int, ...]:
                 FROM ticket_pings AS ping
                 JOIN tickets AS ticket ON ticket.ticket_id = ping.ticket_id
                 WHERE ping.target_user_id = ?
+                UNION
+                SELECT ticket.guild_id
+                FROM github_outbox AS outbox
+                JOIN tickets AS ticket ON ticket.ticket_id = outbox.ticket_id
+                WHERE outbox.actor_user_id = ?
                 ORDER BY guild_id
                 """,
-                (user_id,) * 8,
+                (user_id,) * 9,
             ).fetchall()
         return tuple(int(row["guild_id"]) for row in rows)
 
@@ -2098,13 +3996,16 @@ def _user_reference_ticket_ids_sync(self, user_id: int) -> tuple[int, ...]:
             rows = connection.execute(
                 """
                 SELECT ticket_id FROM tickets
-                WHERE author_id <> ? AND (
+                WHERE (author_id IS NULL OR author_id <> ?) AND (
                     direct_target_id = ? OR current_target_id = ?
                     OR pending_target_id = ? OR assignee_id = ?
                 )
+                UNION
+                SELECT ticket_id FROM github_outbox
+                WHERE actor_user_id = ?
                 ORDER BY ticket_id
                 """,
-                (user_id, user_id, user_id, user_id, user_id),
+                (user_id, user_id, user_id, user_id, user_id, user_id),
             ).fetchall()
         return tuple(int(row["ticket_id"]) for row in rows)
 
@@ -2129,7 +4030,8 @@ def _redact_user_sync(
                             ELSE 0
                         END AS reopen
                     FROM tickets
-                    WHERE author_id <> ? AND state IN ('open', 'claimed')
+                    WHERE (author_id IS NULL OR author_id <> ?)
+                        AND state IN ('open', 'claimed')
                         AND (
                             current_target_id = ?
                             OR pending_target_id = ?
@@ -2150,21 +4052,13 @@ def _redact_user_sync(
                     ),
                 ).fetchall()
                 affected_guild_ids = {
-                    int(row["guild_id"])
-                    for row in affected_rows
-                    if bool(row["reopen"])
+                    int(row["guild_id"]) for row in affected_rows if bool(row["reopen"])
                 }
-                missing_deadlines = affected_guild_ids.difference(
-                    protection_until_by_guild
-                )
+                missing_deadlines = affected_guild_ids.difference(protection_until_by_guild)
                 if missing_deadlines:
-                    raise ValueError(
-                        "a protection deadline is required for every affected guild"
-                    )
+                    raise ValueError("a protection deadline is required for every affected guild")
                 serialized_deadlines = {
-                    guild_id: _serialize_datetime(
-                        protection_until_by_guild[guild_id]
-                    )
+                    guild_id: _serialize_datetime(protection_until_by_guild[guild_id])
                     for guild_id in affected_guild_ids
                 }
                 updated_timestamp = _serialize_datetime(updated_at)
@@ -2181,10 +4075,7 @@ def _redact_user_sync(
                     INSERT INTO redacted_user_affected_tickets (ticket_id, reopen)
                     VALUES (?, ?)
                     """,
-                    (
-                        (int(row["ticket_id"]), int(row["reopen"]))
-                        for row in affected_rows
-                    ),
+                    ((int(row["ticket_id"]), int(row["reopen"])) for row in affected_rows),
                 )
 
                 connection.execute(
@@ -2203,6 +4094,21 @@ def _redact_user_sync(
                     "DELETE FROM ticket_pings WHERE target_user_id = ?",
                     (user_id,),
                 )
+                connection.execute(
+                    """
+                    DELETE FROM github_outbox
+                    WHERE actor_user_id = ? AND state IN ('succeeded', 'failed')
+                    """,
+                    (user_id,),
+                )
+                connection.execute(
+                    """
+                    UPDATE github_outbox SET actor_user_id = NULL
+                    WHERE actor_user_id = ?
+                        AND state IN ('pending', 'processing', 'retry')
+                    """,
+                    (user_id,),
+                )
 
                 for guild_id in sorted(affected_guild_ids):
                     deadline = serialized_deadlines[guild_id]
@@ -2375,7 +4281,7 @@ def _begin_authored_ticket_cleanup_sync(
                 connection.execute(
                     """
                     UPDATE tickets
-                    SET state = 'finishing', author_id = 0,
+                    SET state = 'finishing', author_id = NULL,
                         pr_title = '', pr_url = '', category_display = '',
                         routing_mode = 'none', direct_target_id = NULL,
                         current_target_id = NULL, assignee_id = NULL,
@@ -2409,7 +4315,7 @@ def _begin_finishing_sync(
         message_absent: bool,
         thread_absent: bool,
     ) -> bool:
-        changed = self._update_ticket_state(
+        changed = self._execute_update(
             """
             UPDATE tickets
             SET state = 'finishing', next_action = NULL, next_action_at = NULL,
@@ -2439,7 +4345,7 @@ def _delete_ticket_sync(self, ticket_id: int) -> bool:
             connection.commit()
             return cursor.rowcount > 0
 
-    def _update_ticket_state(self, statement: str, parameters: tuple[object, ...]) -> int:
+    def _execute_update(self, statement: str, parameters: tuple[object, ...]) -> int:
         with closing(self._connect()) as connection:
             connection.execute("BEGIN IMMEDIATE")
             try:
diff --git a/NHCogs/githubtickets/ticket_views.py b/NHCogs/githubtickets/ticket_views.py
index d06d12a..b2c06a4 100644
--- a/NHCogs/githubtickets/ticket_views.py
+++ b/NHCogs/githubtickets/ticket_views.py
@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import logging
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Sequence
 from typing import TYPE_CHECKING
 
 import discord
@@ -12,8 +12,14 @@
 
 if TYPE_CHECKING:
     from .coordinator import TicketActor, TicketResult
+    from .models import Category
 
 TicketAction = Callable[[str, "TicketActor"], Awaitable["TicketResult"]]
+AddCategoriesAction = Callable[
+    [str, tuple[int, ...], "TicketActor"],
+    Awaitable["TicketResult"],
+]
+CategoriesGetter = Callable[[int], Awaitable[Sequence["Category"]]]
 ActorFactory = Callable[[discord.Interaction], "TicketActor"]
 
 
@@ -72,3 +78,232 @@ async def callback(interaction, selected_action=action):
 
             button.callback = callback
             self.add_item(button)
+
+
+class GitHubCategoryPrompt(discord.ui.View):
+    def __init__(
+        self,
+        guild_id: int,
+        public_token: str,
+        *,
+        actor_factory: ActorFactory,
+        get_categories: CategoriesGetter,
+        add_categories: AddCategoriesAction,
+    ) -> None:
+        super().__init__(timeout=None)
+        self.guild_id = guild_id
+        self.public_token = public_token
+        self._actor_factory = actor_factory
+        self._get_categories = get_categories
+        self._add_categories = add_categories
+
+        button = discord.ui.Button(
+            label=presentation.ADD_CATEGORIES,
+            style=discord.ButtonStyle.primary,
+            custom_id=f"githubtickets:{public_token}:add_categories",
+        )
+        button.callback = self._open_categories
+        self.add_item(button)
+
+    async def _open_categories(self, interaction: discord.Interaction) -> None:
+        try:
+            actor = self._actor_factory(interaction)
+            if not actor.can_participate:
+                await interaction.response.send_message(
+                    presentation.CANNOT_USE_ACTION,
+                    ephemeral=True,
+                )
+                return
+            categories = tuple(await self._get_categories(self.guild_id))
+        except Exception:
+            log.exception("GitHub Tickets category prompt failed")
+            await interaction.response.send_message(
+                presentation.COULD_NOT_COMPLETE_ACTION,
+                ephemeral=True,
+            )
+            return
+        if not categories:
+            await interaction.response.send_message(
+                presentation.NO_CATEGORIES_CONFIGURED,
+                ephemeral=True,
+            )
+            return
+        await interaction.response.send_message(
+            presentation.SELECT_CATEGORIES,
+            view=TicketCategorySelection(
+                self.guild_id,
+                self.public_token,
+                categories,
+                actor_factory=self._actor_factory,
+                get_categories=self._get_categories,
+                add_categories=self._add_categories,
+            ),
+            ephemeral=True,
+        )
+
+
+class TicketCategorySelection(discord.ui.View):
+    def __init__(
+        self,
+        guild_id: int,
+        public_token: str,
+        categories: Sequence[Category],
+        *,
+        actor_factory: ActorFactory,
+        get_categories: CategoriesGetter,
+        add_categories: AddCategoriesAction,
+    ) -> None:
+        super().__init__()
+        self.guild_id = guild_id
+        self.public_token = public_token
+        self._actor_factory = actor_factory
+        self._get_categories = get_categories
+        self._add_categories = add_categories
+        self.categories = discord.ui.Select(
+            placeholder=presentation.SELECT_CATEGORIES,
+            options=[
+                discord.SelectOption(
+                    label=category.name,
+                    value=str(category.category_id),
+                )
+                for category in categories
+            ],
+            min_values=1,
+            max_values=len(categories),
+            required=True,
+        )
+        self.add_item(self.categories)
+
+        confirm = discord.ui.Button(
+            label=presentation.CONFIRM_CATEGORIES,
+            style=discord.ButtonStyle.primary,
+        )
+        confirm.callback = self._confirm
+        self.add_item(confirm)
+
+    async def _confirm(self, interaction: discord.Interaction) -> None:
+        await interaction.response.defer()
+        try:
+            actor = self._actor_factory(interaction)
+            if not actor.can_participate:
+                await interaction.followup.send(
+                    presentation.CANNOT_USE_ACTION,
+                    ephemeral=True,
+                )
+                return
+            selected_ids = tuple(int(value) for value in self.categories.values)
+            current_ids = {
+                category.category_id
+                for category in await self._get_categories(self.guild_id)
+            }
+            if any(category_id not in current_ids for category_id in selected_ids):
+                await interaction.followup.send(
+                    presentation.CATEGORY_NO_LONGER_EXISTS,
+                    ephemeral=True,
+                )
+                return
+            result = await self._add_categories(
+                self.public_token,
+                selected_ids,
+                actor,
+            )
+        except Exception:
+            log.exception("GitHub Tickets category selection failed")
+            await interaction.followup.send(
+                presentation.COULD_NOT_COMPLETE_ACTION,
+                ephemeral=True,
+            )
+            return
+        if not result.success:
+            await interaction.followup.send(result.response, ephemeral=True)
+            return
+        await interaction.edit_original_response(
+            content=presentation.CATEGORIES_ADDED,
+            view=None,
+        )
+
+
+class DraftTicketControls(discord.ui.View):
+    def __init__(
+        self,
+        public_token: str,
+        *,
+        actor_factory: ActorFactory,
+        keep_ticket: TicketAction,
+        remove_ticket: TicketAction,
+    ) -> None:
+        super().__init__(timeout=None)
+        self.public_token = public_token
+        self._actor_factory = actor_factory
+        self._keep_ticket = keep_ticket
+        self._remove_ticket = remove_ticket
+
+        keep = discord.ui.Button(
+            label=presentation.KEEP_TICKET,
+            style=discord.ButtonStyle.primary,
+            custom_id=f"githubtickets:{public_token}:keep_draft_ticket",
+        )
+        keep.callback = self._keep
+        self.add_item(keep)
+        self._add_remove_button()
+
+    def _add_remove_button(self) -> None:
+        remove = discord.ui.Button(
+            label=presentation.REMOVE_TICKET,
+            style=discord.ButtonStyle.danger,
+            custom_id=f"githubtickets:{self.public_token}:remove_draft_ticket",
+        )
+        remove.callback = self._remove
+        self.add_item(remove)
+
+    async def _keep(self, interaction: discord.Interaction) -> None:
+        try:
+            actor = self._actor_factory(interaction)
+            result = await self._keep_ticket(self.public_token, actor)
+        except Exception:
+            log.exception("GitHub Tickets keep-draft callback failed")
+            await interaction.response.send_message(
+                presentation.COULD_NOT_COMPLETE_ACTION,
+                ephemeral=True,
+            )
+            return
+        if not result.success:
+            await interaction.response.send_message(result.response, ephemeral=True)
+            return
+        await interaction.response.edit_message(
+            view=RetainedDraftTicketControls(
+                self.public_token,
+                actor_factory=self._actor_factory,
+                remove_ticket=self._remove_ticket,
+            )
+        )
+
+    async def _remove(self, interaction: discord.Interaction) -> None:
+        await interaction.response.defer()
+        try:
+            actor = self._actor_factory(interaction)
+            result = await self._remove_ticket(self.public_token, actor)
+        except Exception:
+            log.exception("GitHub Tickets remove-draft callback failed")
+            await interaction.followup.send(
+                presentation.COULD_NOT_COMPLETE_ACTION,
+                ephemeral=True,
+            )
+            return
+        if not result.success:
+            await interaction.followup.send(result.response, ephemeral=True)
+
+
+class RetainedDraftTicketControls(DraftTicketControls):
+    def __init__(
+        self,
+        public_token: str,
+        *,
+        actor_factory: ActorFactory,
+        remove_ticket: TicketAction,
+    ) -> None:
+        discord.ui.View.__init__(self, timeout=None)
+        self.public_token = public_token
+        self._actor_factory = actor_factory
+        self._remove_ticket = remove_ticket
+        self._add_remove_button()
diff --git a/NHCogs/githubtickets/webhook.py b/NHCogs/githubtickets/webhook.py
new file mode 100644
index 0000000..90024e0
--- /dev/null
+++ b/NHCogs/githubtickets/webhook.py
@@ -0,0 +1,159 @@
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+from collections.abc import Mapping
+from datetime import datetime, timezone
+
+from aiohttp import web
+
+from .github_app import GitHubAppCredentials
+from .store import GitHubTicketsStore
+
+WEBHOOK_PATH = "/githubtickets/webhook"
+_MAX_BODY_BYTES = 1024 * 1024
+_PULL_REQUEST_EVENTS = frozenset({"pull_request", "pull_request_review"})
+
+
+class GitHubWebhookReceiver:
+    def __init__(
+        self,
+        store: GitHubTicketsStore,
+        credentials: GitHubAppCredentials,
+    ) -> None:
+        self._store = store
+        self._credentials = credentials
+        self._organization = credentials.organization.casefold()
+        self.application = web.Application(client_max_size=_MAX_BODY_BYTES)
+        self.application.router.add_post(WEBHOOK_PATH, self._receive)
+        self._runner: web.AppRunner | None = None
+
+    async def start(self, host: str, port: int) -> int:
+        if self._runner is not None:
+            raise RuntimeError("GitHub webhook receiver is already running")
+        runner = web.AppRunner(self.application)
+        await runner.setup()
+        site = web.TCPSite(runner, host, port)
+        try:
+            await site.start()
+        except BaseException:
+            await runner.cleanup()
+            raise
+        self._runner = runner
+        return port
+
+    async def close(self) -> None:
+        runner = self._runner
+        if runner is None:
+            return
+        await runner.cleanup()
+        self._runner = None
+
+    async def _receive(self, request: web.Request) -> web.Response:
+        body = await request.read()
+        if not self._valid_signature(request.headers.get("X-Hub-Signature-256"), body):
+            raise web.HTTPUnauthorized()
+
+        delivery_guid = request.headers.get("X-GitHub-Delivery")
+        event = request.headers.get("X-GitHub-Event")
+        if not delivery_guid or not event:
+            raise web.HTTPBadRequest()
+
+        try:
+            payload = json.loads(body)
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            raise web.HTTPBadRequest() from None
+        if not isinstance(payload, Mapping):
+            raise web.HTTPBadRequest()
+
+        installation_id, repository_id, pr_number, action = self._delivery_identity(
+            payload,
+            event,
+        )
+        try:
+            await self._store.accept_delivery(
+                delivery_guid=delivery_guid,
+                github_delivery_id=None,
+                event=event,
+                action=action,
+                installation_id=installation_id,
+                repository_id=repository_id,
+                pr_number=pr_number,
+                received_at=datetime.now(timezone.utc),
+                raw_body=body,
+            )
+        except ValueError:
+            raise web.HTTPBadRequest() from None
+        except Exception:
+            raise web.HTTPServiceUnavailable() from None
+        return web.Response(status=202)
+
+    def _delivery_identity(
+        self,
+        payload: Mapping[str, object],
+        event: str,
+    ) -> tuple[int, int | None, int | None, str | None]:
+        installation_id = _nested_integer(payload, "installation", "id")
+        if event == "ping" and installation_id is None:
+            installation_id = self._credentials.installation_id
+        organization = _nested_string(payload, "organization", "login")
+        if (
+            installation_id != self._credentials.installation_id
+            or organization is None
+            or organization.casefold() != self._organization
+        ):
+            raise web.HTTPForbidden()
+
+        repository_id = _nested_integer(payload, "repository", "id")
+        repository_name = _nested_string(payload, "repository", "full_name")
+        repository_owner, separator, repository = (repository_name or "").partition("/")
+        if repository_id is not None and (
+            not separator
+            or not repository
+            or repository_owner.casefold() != self._organization
+        ):
+            raise web.HTTPForbidden()
+
+        pr_number = _nested_integer(payload, "pull_request", "number")
+        if event in _PULL_REQUEST_EVENTS:
+            if repository_id is None or pr_number is None:
+                raise web.HTTPBadRequest()
+        else:
+            repository_id = None
+            pr_number = None
+        action = payload.get("action")
+        return (
+            installation_id,
+            repository_id,
+            pr_number,
+            action if isinstance(action, str) else None,
+        )
+
+    def _valid_signature(self, provided: str | None, body: bytes) -> bool:
+        if provided is None:
+            return False
+        expected = "sha256=" + hmac.new(
+            self._credentials.webhook_secret,
+            body,
+            hashlib.sha256,
+        ).hexdigest()
+        return hmac.compare_digest(provided, expected)
+
+
+def _nested_integer(payload: Mapping[str, object], key: str, nested: str) -> int | None:
+    value = payload.get(key)
+    if not isinstance(value, Mapping):
+        return None
+    nested_value = value.get(nested)
+    if isinstance(nested_value, bool) or not isinstance(nested_value, int):
+        return None
+    return nested_value
+
+
+def _nested_string(payload: Mapping[str, object], key: str, nested: str) -> str | None:
+    value = payload.get(key)
+    if not isinstance(value, Mapping):
+        return None
+    nested_value = value.get(nested)
+    return nested_value if isinstance(nested_value, str) else None
diff --git a/NHCogs/honeypot/README.md b/NHCogs/honeypot/README.md
index 8ae6bac..ce9bbce 100644
--- a/NHCogs/honeypot/README.md
+++ b/NHCogs/honeypot/README.md
@@ -20,7 +20,6 @@ Requires `AAA3A_utils`. Red will show the pip install command if missing.
 
 ```ini
 [p]honeypot channels honeypot create
-[p]honeypot channels errors #your-errors-channel
 [p]honeypot channels review #your-review-channel
 [p]honeypot channels daily-stats #your-public-stats-channel
 [p]honeypot honeypot action ban
@@ -88,7 +87,6 @@ By default, three GIFs from one member inside a rolling 60-second window trigger
 | Command | Description |
 |---------|-------------|
 | `!honeypot channels review [channel]` | Show or set the review destination |
-| `!honeypot channels errors [channel]` | Show or set the shared technical error destination |
 | `!honeypot channels daily-stats [channel]` | Show or set the public daily statistics destination |
 | `!honeypot channels manual-evidence [channel]` | Show or set the private manual evidence destination |
 | `!honeypot channels joinwatch [channel]` | Show or set the JoinWatch destination |
@@ -202,18 +200,6 @@ Detection cases expire 24 hours after the first detection. This lifetime is fixe
 | `!honeypot bait_role action <kick\|ban>` | Action to take when users take the bait role |
 | `!honeypot bait_role channel [channel]` | Show or set the bait-role destination |
 
-### errors
-
-`!honeypot errors` and `!honeypot errors maintainer` show their available subcommands.
-
-| Command | Description |
-|---------|-------------|
-| `!honeypot errors list` | List unacknowledged operational failures |
-| `!honeypot errors clear` | Acknowledge all currently visible operational failures |
-| `!honeypot errors maintainer show` | Show the configured error maintainer |
-| `!honeypot errors maintainer set <member>` | Set the person pinged for new failures |
-| `!honeypot errors maintainer clear` | Stop pinging the configured maintainer |
-
 ### other
 
 | Command | Description |
@@ -459,7 +445,7 @@ Channel routing is declared in `channel_routing.py`. To add a category:
 2. Otherwise add one `ChannelCategory` entry with its config field, type, permissions, central command, and module command
 3. Route publication through that category and use the shared configuration operations
 4. Add the declared static commands. The registry contract tests name any missing central or module path
-5. Send every technical failure through the shared `errors` category. Never add a cross-category fallback
+5. Send every technical failure through the process-wide OperationalErrors reporter
 
 ## Permissions
 
diff --git a/NHCogs/honeypot/channel_routing.py b/NHCogs/honeypot/channel_routing.py
index a9995cf..ba817ab 100644
--- a/NHCogs/honeypot/channel_routing.py
+++ b/NHCogs/honeypot/channel_routing.py
@@ -63,13 +63,6 @@ class ChannelCategory:
         central_command="review",
         module_command="review channel",
     ),
-    ChannelCategory(
-        "errors",
-        "errors_channel",
-        "Errors",
-        "destination",
-        central_command="errors",
-    ),
     ChannelCategory(
         "daily_stats",
         "daily_stats_channel",
diff --git a/NHCogs/honeypot/daily_stats.py b/NHCogs/honeypot/daily_stats.py
index 93be83f..860c29a 100644
--- a/NHCogs/honeypot/daily_stats.py
+++ b/NHCogs/honeypot/daily_stats.py
@@ -115,6 +115,7 @@ async def publish_completed_day(cog, now: datetime) -> None:
                     guild.id,
                     "daily_stats_publish",
                     f"Could not publish daily statistics for {report_date.isoformat()}: {error}",
+                    error=error,
                 )
             except Exception:
                 log.exception(
diff --git a/NHCogs/honeypot/detection.py b/NHCogs/honeypot/detection.py
index 079de4c..43e2526 100644
--- a/NHCogs/honeypot/detection.py
+++ b/NHCogs/honeypot/detection.py
@@ -27,6 +27,7 @@
 from redbot.core.i18n import Translator
 from redbot.core.utils.chat_formatting import box
 
+from ..operational_errors import mark_operational_error_recovered
 from . import detection_runtime, imagescan, review_publication
 from .case_review import case_feedback_items
 from .detection_cases import (
@@ -635,6 +636,7 @@ async def _settle_detection_operation_failure(
             operation_id=operation.operation_id,
             attempts=operation.attempts,
             terminal=retry_at is None,
+            error=error,
         )
     if operation.operation_type == OperationType.ROLE_APPLY:
         await review_publication._case_review_rerender_safely(cog, operation.case_id)
@@ -684,17 +686,13 @@ async def _settle_detection_operation_success(
     elif context.snapshot is not None and (
         operation.attempts > 1 or outcome.resolve_failure_on_first_attempt
     ):
-        recovered = await asyncio.to_thread(
-            cog._case_store.resolve_operational_failure,
-            operation.operation_id,
-            context.now,
+        await mark_operational_error_recovered(
+            cog.bot,
+            guild_id=context.snapshot.case.guild_id,
+            source="Honeypot",
+            action=operation.operation_type.value,
+            correlation_key=operation.operation_id,
         )
-        if recovered and operation.attempts > 1:
-            await cog._send_operational_alert(
-                context.snapshot.case.guild_id,
-                f"✅ Recovered: {operation.operation_type.value} succeeded after "
-                f"{operation.attempts} attempts.",
-            )
     elif outcome.role_was_added and context.snapshot is not None:
         guild = cog.bot.get_guild(context.snapshot.case.guild_id)
         if guild is not None:
@@ -1414,6 +1412,7 @@ async def _delete_cached_message_ref(cog, guild: discord.Guild, user_id: int, re
             guild.id,
             "cached_message_deletion",
             f"{type(exc).__name__}: {exc}",
+            error=exc,
         )
         log.debug(
             "Failed to delete cached message %s for user %s in channel %s: %r",
@@ -1501,6 +1500,7 @@ async def _post_ban_message_sweep(cog, guild_id: int, user_id: int) -> None:
             guild_id,
             "post_ban_cached_purge",
             f"{type(error).__name__}: {error}",
+            error=error,
         )
         log.exception(
             "Post-ban cached message purge failed for user %s in guild %s",
@@ -1628,6 +1628,7 @@ async def _spam_suspicion_reasons(
                 message.guild.id,
                 "message_registry_spam_lookup",
                 f"{type(error).__name__}: {error}",
+                error=error,
             )
         except Exception:
             log.exception("Failed to record message registry spam lookup error")
@@ -1783,6 +1784,7 @@ async def on_message(cog, message: discord.Message) -> None:
                 message.guild.id,
                 "message_registry_observation",
                 f"{type(error).__name__}: {error}",
+                error=error,
             )
         except Exception:
             log.exception("Failed to record message registry observation error")
diff --git a/NHCogs/honeypot/detection_cases.py b/NHCogs/honeypot/detection_cases.py
index c7442cc..7eafe3c 100644
--- a/NHCogs/honeypot/detection_cases.py
+++ b/NHCogs/honeypot/detection_cases.py
@@ -249,21 +249,6 @@ class OperationRecord:
     claimed_at: datetime | None
 
 
-@dataclass(frozen=True)
-class OperationalFailureRecord:
-    failure_id: str
-    guild_id: int
-    source: OperationType | str
-    summary: str
-    first_seen_at: datetime
-    last_seen_at: datetime
-    occurrences: int
-    case_id: str | None
-    operation_id: str | None
-    resolved_at: datetime | None
-    acknowledged_at: datetime | None
-
-
 @dataclass(frozen=True)
 class EvidencePublicationRecord:
     case_id: str
@@ -398,10 +383,10 @@ class CaseSnapshot:
 
 
 ACTION_PRIORITY = MappingProxyType({
-    ActionIntent.NONE: 0,
-    ActionIntent.REVIEW: 1,
-    ActionIntent.KICK: 2,
-    ActionIntent.BAN: 3,
+        ActionIntent.NONE: 0,
+        ActionIntent.REVIEW: 1,
+        ActionIntent.KICK: 2,
+        ActionIntent.BAN: 3,
 })
 
 
@@ -589,26 +574,6 @@ def migrate_schema_0(connection: sqlite3.Connection) -> None:
                         REFERENCES detection_messages(case_id, sequence) ON DELETE CASCADE
                 );
 
-                CREATE TABLE IF NOT EXISTS operational_failures (
-                    failure_id TEXT PRIMARY KEY,
-                    guild_id INTEGER NOT NULL,
-                    source TEXT NOT NULL,
-                    summary TEXT NOT NULL,
-                    first_seen_at INTEGER NOT NULL,
-                    last_seen_at INTEGER NOT NULL,
-                    occurrences INTEGER NOT NULL DEFAULT 1,
-                    case_id TEXT,
-                    operation_id TEXT,
-                    resolved_at INTEGER,
-                    acknowledged_at INTEGER
-                );
-                CREATE UNIQUE INDEX IF NOT EXISTS one_active_operational_failure
-                    ON operational_failures(guild_id, source, COALESCE(operation_id, ''),
-                                            COALESCE(case_id, ''))
-                    WHERE resolved_at IS NULL;
-                CREATE INDEX IF NOT EXISTS operational_failures_visible
-                    ON operational_failures(guild_id, acknowledged_at, resolved_at, last_seen_at);
-
                 CREATE TABLE IF NOT EXISTS detection_evidence_reservations (
                     case_id TEXT NOT NULL,
                     message_sequence INTEGER NOT NULL,
@@ -876,8 +841,8 @@ def _timeline_logical_key(
     def ensure_projection_endpoint(self, case_id: str) -> ProjectionEndpointRecord:
         with closing(self._connect()) as connection, connection:
             if connection.execute(
-                "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
-                (case_id,),
+                    "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
+                    (case_id,),
             ).fetchone() is not None:
                 raise KeyError(case_id)
             connection.execute(
@@ -946,8 +911,8 @@ def ensure_timeline_publication(
         )
         with closing(self._connect()) as connection, connection:
             if connection.execute(
-                "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
-                (case_id,),
+                    "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
+                    (case_id,),
             ).fetchone() is not None:
                 raise KeyError(logical_key)
             connection.execute(
@@ -1166,8 +1131,8 @@ def append_message(
                     (new_message.guild_id, new_message.user_id),
                 ).fetchone()
                 if case_row is not None and connection.execute(
-                    "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
-                    (case_row["case_id"],),
+                        "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
+                        (case_row["case_id"],),
                 ).fetchone() is not None:
                     return None
                 if case_row is None or case_row["status"] != CaseStatus.RESOLVING.value:
@@ -1885,8 +1850,8 @@ def claim_publication(self, case_id: str, slot: str, now: datetime) -> str | Non
         with closing(self._connect()) as connection, connection:
             connection.execute("BEGIN IMMEDIATE")
             if connection.execute(
-                "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
-                (case_id,),
+                    "SELECT 1 FROM detection_case_deletions WHERE case_id = ?",
+                    (case_id,),
             ).fetchone() is not None:
                 return None
             connection.execute(
@@ -2283,7 +2248,7 @@ def case_deletion_has_inflight_publications(self, case_id: str) -> bool:
                 (case_id, stale_before),
             )
             return connection.execute(
-                """SELECT 1
+                    """SELECT 1
                    WHERE EXISTS (
                        SELECT 1 FROM detection_publication_claims
                        WHERE case_id = ?
@@ -2291,7 +2256,7 @@ def case_deletion_has_inflight_publications(self, case_id: str) -> bool:
                        SELECT 1 FROM detection_timeline_publications
                        WHERE case_id = ? AND claim_token IS NOT NULL
                    )""",
-                (case_id, case_id),
+                    (case_id, case_id),
             ).fetchone() is not None
 
     def add_case_deletion_publication(
@@ -2341,9 +2306,9 @@ def record_orphan_publication(
             if cursor.rowcount == 1:
                 return True
             return connection.execute(
-                """SELECT 1 FROM detection_orphan_publications
+                    """SELECT 1 FROM detection_orphan_publications
                    WHERE case_id = ? AND channel_id = ? AND message_id = ?""",
-                (case_id, channel_id, message_id),
+                    (case_id, channel_id, message_id),
             ).fetchone() is not None
 
     def list_orphan_publications(
@@ -2828,13 +2793,13 @@ def _finalize_moderator_action_locked(
         if operation is None:
             return False
         if connection.execute(
-            """SELECT 1 FROM detection_attachments
+                """SELECT 1 FROM detection_attachments
                WHERE case_id = ? AND capture_status = 'pending' LIMIT 1""",
-            (case_id,),
+                (case_id,),
         ).fetchone() is not None:
             return False
         if connection.execute(
-            """SELECT 1 FROM detection_attachments
+                """SELECT 1 FROM detection_attachments
                WHERE case_id = ? AND capture_status = 'captured'
                  AND evidence_path IS NOT NULL AND learning_decision IS NULL
                  AND (
@@ -2845,8 +2810,8 @@ def _finalize_moderator_action_locked(
                    OR lower(filename) LIKE '%.webp'
                    OR lower(filename) LIKE '%.gif'
                  )
-               LIMIT 1""",
-            (case_id,),
+                LIMIT 1""",
+                (case_id,),
         ).fetchone() is not None:
             return False
         pending_sources = connection.execute(
@@ -2870,10 +2835,10 @@ def _finalize_moderator_action_locked(
             ):
                 return False
         if connection.execute(
-            """SELECT 1 FROM detection_operations
+                """SELECT 1 FROM detection_operations
                WHERE case_id = ? AND operation_type = 'cached_purge'
                  AND status NOT IN ('succeeded', 'abandoned') LIMIT 1""",
-            (case_id,),
+                (case_id,),
         ).fetchone() is not None:
             return False
         final_operations = [
@@ -2904,20 +2869,20 @@ def _finalize_moderator_action_locked(
                 ),
             )
         terminal = connection.execute(
-                """UPDATE detection_cases
+            """UPDATE detection_cases
                    SET status = 'resolved', resolution = ?, moderator_id = ?, resolved_at = ?,
                        resolving_since = NULL, resolving_token = NULL
                    WHERE case_id = ? AND status = 'resolving' AND resolving_token = ?""",
-                (
-                    operation["result"]
-                    if operation["result"].startswith("planned_")
-                    else operation["operation_type"].removeprefix("moderator_"),
-                    operation["actor_id"],
-                    now_value,
-                    case_id,
-                    operation["operation_id"],
-                ),
-            )
+            (
+                operation["result"]
+                if operation["result"].startswith("planned_")
+                else operation["operation_type"].removeprefix("moderator_"),
+                operation["actor_id"],
+                now_value,
+                case_id,
+                operation["operation_id"],
+            ),
+        )
         return terminal.rowcount == 1
 
     def ensure_operation(
@@ -3336,98 +3301,6 @@ def fail_operation(
             )
             return result.rowcount == 1
 
-    def record_operational_failure(
-        self,
-        *,
-        guild_id: int,
-        source: OperationType | str,
-        summary: str,
-        occurred_at: datetime,
-        case_id: str | None = None,
-        operation_id: str | None = None,
-    ) -> OperationalFailureRecord:
-        source_value = source.value if isinstance(source, OperationType) else source
-        with closing(self._connect()) as connection, connection:
-            connection.execute("BEGIN IMMEDIATE")
-            row = connection.execute(
-                """SELECT * FROM operational_failures
-                   WHERE guild_id = ? AND source = ?
-                     AND COALESCE(operation_id, '') = COALESCE(?, '')
-                     AND COALESCE(case_id, '') = COALESCE(?, '')
-                     AND resolved_at IS NULL""",
-                (guild_id, source_value, operation_id, case_id),
-            ).fetchone()
-            timestamp = _to_timestamp(occurred_at)
-            if row is None:
-                failure_id = str(uuid4())
-                connection.execute(
-                    """INSERT INTO operational_failures
-                       (failure_id, guild_id, source, summary, first_seen_at,
-                        last_seen_at, occurrences, case_id, operation_id)
-                       VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)""",
-                    (
-                        failure_id,
-                        guild_id,
-                        source_value,
-                        summary[:1000],
-                        timestamp,
-                        timestamp,
-                        case_id,
-                        operation_id,
-                    ),
-                )
-            else:
-                failure_id = row["failure_id"]
-                connection.execute(
-                    """UPDATE operational_failures
-                       SET summary = ?, last_seen_at = ?, occurrences = occurrences + 1,
-                           acknowledged_at = NULL
-                       WHERE failure_id = ?""",
-                    (summary[:1000], timestamp, failure_id),
-                )
-            return self._operational_failure_from_row(
-                connection.execute(
-                    "SELECT * FROM operational_failures WHERE failure_id = ?",
-                    (failure_id,),
-                ).fetchone()
-            )
-
-    def resolve_operational_failure(
-        self, operation_id: str, resolved_at: datetime
-    ) -> bool:
-        with closing(self._connect()) as connection, connection:
-            result = connection.execute(
-                """UPDATE operational_failures SET resolved_at = ?
-                   WHERE operation_id = ? AND resolved_at IS NULL""",
-                (_to_timestamp(resolved_at), operation_id),
-            )
-            return result.rowcount > 0
-
-    def list_operational_failures(
-        self, guild_id: int, *, include_resolved: bool = False, limit: int = 100
-    ) -> tuple[OperationalFailureRecord, ...]:
-        where = "guild_id = ? AND acknowledged_at IS NULL"
-        if not include_resolved:
-            where += " AND resolved_at IS NULL"
-        with closing(self._connect()) as connection:
-            return tuple(
-                self._operational_failure_from_row(row)
-                for row in connection.execute(
-                    f"""SELECT * FROM operational_failures WHERE {where}
-                        ORDER BY last_seen_at DESC LIMIT ?""",
-                    (guild_id, limit),
-                )
-            )
-
-    def clear_operational_failures(self, guild_id: int, acknowledged_at: datetime) -> int:
-        with closing(self._connect()) as connection, connection:
-            result = connection.execute(
-                """UPDATE operational_failures SET acknowledged_at = ?
-                   WHERE guild_id = ? AND acknowledged_at IS NULL""",
-                (_to_timestamp(acknowledged_at), guild_id),
-            )
-            return result.rowcount
-
     def _snapshot(self, connection: sqlite3.Connection, case_row: sqlite3.Row) -> CaseSnapshot:
         messages = tuple(
             self._message_from_row(row)
@@ -3605,20 +3478,3 @@ def _operation_from_row(row: sqlite3.Row) -> OperationRecord:
             row["actor_id"], row["idempotency_key"],
             row["claim_token"], _from_timestamp(row["claimed_at"]),
         )
-
-    @staticmethod
-    def _operational_failure_from_row(row: sqlite3.Row) -> OperationalFailureRecord:
-        source = next(
-            (
-                operation_type
-                for operation_type in OperationType
-                if operation_type.value == row["source"]
-            ),
-            row["source"],
-        )
-        return OperationalFailureRecord(
-            row["failure_id"], row["guild_id"], source, row["summary"],
-            _from_timestamp(row["first_seen_at"]), _from_timestamp(row["last_seen_at"]),
-            row["occurrences"], row["case_id"], row["operation_id"],
-            _from_timestamp(row["resolved_at"]), _from_timestamp(row["acknowledged_at"]),
-        )
diff --git a/NHCogs/honeypot/diagnostics.py b/NHCogs/honeypot/diagnostics.py
index dffc5d0..fb5588c 100644
--- a/NHCogs/honeypot/diagnostics.py
+++ b/NHCogs/honeypot/diagnostics.py
@@ -23,7 +23,6 @@
 from redbot.core.utils.chat_formatting import box, pagify
 
 from . import channel_routing
-from .detection_cases import OperationType
 from .remote_media import media_decoder_support
 from .settings import (
     CORE_ACTION_OPTIONS,
@@ -366,84 +365,6 @@ async def config_dump(
     return await cog._send_group_overview(ctx, config_sender)
 
 
-async def honeypot_errors(cog, ctx: commands.Context) -> None:
-    """Show unacknowledged Honeypot operational failures."""
-    failures = await asyncio.to_thread(
-        cog._case_store.list_operational_failures,
-        ctx.guild.id,
-        include_resolved=True,
-    )
-    if not failures:
-        await ctx.send(_("No unacknowledged Honeypot errors"))
-        return
-    lines = []
-    for failure in failures:
-        state = "recovered" if failure.resolved_at is not None else "active"
-        source = (
-            failure.source.value if isinstance(failure.source, OperationType) else failure.source
-        )
-        lines.append(
-            f"- <t:{int(failure.last_seen_at.timestamp())}:R> "
-            f"`{source}` ({state}, x{failure.occurrences}): "
-            f"{failure.summary[:500]}"
-        )
-    body = "\n".join(lines)
-    header = _("**Honeypot operational errors:**\n")
-    for page in pagify(body, page_length=2000 - len(header)):
-        await ctx.send(header + page)
-
-
-async def honeypot_errors_clear(cog, ctx: commands.Context) -> None:
-    """Acknowledge all currently visible Honeypot operational failures."""
-    count = await asyncio.to_thread(
-        cog._case_store.clear_operational_failures,
-        ctx.guild.id,
-        datetime.now(timezone.utc),
-    )
-    await ctx.send(_("Acknowledged {count} Honeypot errors").format(count=count))
-
-
-async def honeypot_errors_maintainer_show(cog, ctx: commands.Context) -> None:
-    """Show the person pinged for Honeypot operational failures."""
-    setting = cog.config.guild(ctx.guild).maintainer_id
-    maintainer_id = await setting()
-    maintainer = ctx.guild.get_member(maintainer_id) if maintainer_id else None
-    if maintainer is not None:
-        label = maintainer.mention
-    elif maintainer_id is not None:
-        label = f"<@{maintainer_id}>"
-    else:
-        label = _("Not configured")
-    prefix = ctx.clean_prefix
-    await ctx.send(
-        _(
-            "Error maintainer: {maintainer}\n"
-            "Set: `{prefix}honeypot errors maintainer set <member>`\n"
-            "Clear: `{prefix}honeypot errors maintainer clear`"
-        ).format(maintainer=label, prefix=prefix),
-        allowed_mentions=discord.AllowedMentions.none(),
-    )
-
-
-async def honeypot_errors_maintainer_set(
-    cog,
-    ctx: commands.Context,
-    member: discord.Member,
-) -> None:
-    """Set the person pinged for Honeypot operational failures."""
-    await cog.config.guild(ctx.guild).maintainer_id.set(member.id)
-    await ctx.send(
-        _("✅ Error maintainer set to {member.mention}").format(member=member),
-        allowed_mentions=discord.AllowedMentions.none(),
-    )
-
-
-async def honeypot_errors_maintainer_clear(cog, ctx: commands.Context) -> None:
-    """Stop pinging a maintainer for Honeypot operational failures."""
-    await cog.config.guild(ctx.guild).maintainer_id.set(None)
-    await ctx.send(_("✅ Error maintainer cleared"))
-
-
 async def honeypot_mod_stats(cog, ctx: commands.Context) -> None:
     """Show detailed moderation statistics."""
     stats = DEFAULT_STATS.copy()
@@ -625,21 +546,6 @@ async def _doctor_runtime_checks(cog, guild_id: int) -> tuple[DoctorResult, ...]
         return tuple(results)
 
     now = datetime.now(timezone.utc)
-    operational_failures = await asyncio.to_thread(
-        cog._case_store.list_operational_failures,
-        guild_id,
-    )
-    if operational_failures:
-        oldest = min(item.first_seen_at for item in operational_failures)
-        results.append(
-            DoctorResult(
-                f"Active operational failures: {len(operational_failures)}",
-                "failed",
-                f"Oldest: <t:{int(oldest.timestamp())}:R>. Run `honeypot errors`.",
-            )
-        )
-    else:
-        results.append(DoctorResult("Active operational failures: 0", "healthy"))
     case_counts = await asyncio.to_thread(
         cog._case_store.operational_counts,
         guild_id,
@@ -933,17 +839,6 @@ def _destination_is_required(key: str, settings: GuildSettings) -> bool:
         and settings.spam_action.value == "review"
     )
     return {
-        "errors": any(
-            (
-                settings.enabled,
-                settings.firstpost_enabled,
-                settings.spam_enabled,
-                settings.imagescan_detector_enabled,
-                settings.gif_detector_enabled,
-                settings.joinwatch_enabled,
-                settings.baitrole_enabled,
-            )
-        ),
         "review": review_required,
         "joinwatch": settings.joinwatch_enabled
         and settings.joinwatch_alert_enabled,
diff --git a/NHCogs/honeypot/gif_detector.py b/NHCogs/honeypot/gif_detector.py
index 35d0579..6847850 100644
--- a/NHCogs/honeypot/gif_detector.py
+++ b/NHCogs/honeypot/gif_detector.py
@@ -311,6 +311,7 @@ async def _record_http_failure(cog: Any, message: Any, action: str, error: Excep
         message.guild.id,
         "gif_detector",
         f"{action}: {type(error).__name__}: {error}",
+        error=error,
     )
 
 
@@ -357,6 +358,7 @@ async def finish(
                     "gif_debug",
                     f"Could not publish GIF diagnostic record: {type(error).__name__}: {error}",
                     terminal=True,
+                    error=error,
                 )
             except Exception:
                 log.warning(
@@ -1017,6 +1019,7 @@ async def on_raw_message_edit(cog: Any, payload: Any) -> None:
                 guild_id,
                 "gif_detector",
                 f"Could not fetch edited GIF message: {type(error).__name__}: {error}",
+                error=error,
             )
         return
     if local_evidence_source is not None:
diff --git a/NHCogs/honeypot/honeypot.py b/NHCogs/honeypot/honeypot.py
index 2f33caa..54d1fd8 100644
--- a/NHCogs/honeypot/honeypot.py
+++ b/NHCogs/honeypot/honeypot.py
@@ -14,6 +14,7 @@
 from redbot.core.i18n import Translator, cog_i18n
 
 from .. import command_overview
+from ..operational_errors import report_operational_error
 from . import (
     channel_routing,
     cleanup,
@@ -891,6 +892,7 @@ async def _is_protected_member(
                         guild.id,
                         "member_resolution",
                         f"Could not resolve guild member {member.id}: {error}",
+                        error=error,
                     )
                     return True
             member = resolved_member
@@ -1082,34 +1084,6 @@ async def detection_reconciliation_loop(self) -> None:
     async def before_detection_reconciliation_loop(self) -> None:
         await self.bot.wait_until_red_ready()
 
-    async def _send_operational_alert(self, guild_id: int, content: str) -> None:
-        try:
-            guild = self.bot.get_guild(guild_id)
-            if guild is None:
-                return
-            raw_config = await self.config.guild_from_id(guild_id).all()
-            guild_settings = GuildSettings.from_mapping(raw_config)
-            channel = self._get_text_channel_or_thread(
-                guild, guild_settings.errors_channel
-            )
-            if channel is None:
-                return
-            maintainer_id = guild_settings.maintainer_id
-            if maintainer_id is None:
-                alert_content = content
-                allowed_mentions = discord.AllowedMentions.none()
-            else:
-                alert_content = f"<@{maintainer_id}> {content}"
-                allowed_mentions = discord.AllowedMentions(
-                    everyone=False,
-                    roles=False,
-                    users=[discord.Object(id=maintainer_id)],
-                    replied_user=False,
-                )
-            await channel.send(alert_content, allowed_mentions=allowed_mentions)
-        except Exception:
-            log.warning("Could not publish Honeypot operational alert", exc_info=True)
-
     async def _record_operational_failure(
         self,
         guild_id: int,
@@ -1120,36 +1094,32 @@ async def _record_operational_failure(
         operation_id: str | None = None,
         attempts: int = 1,
         terminal: bool = False,
+        error: BaseException | None = None,
     ) -> None:
         source_value = source.value if isinstance(source, OperationType) else source
-        try:
-            failure = await asyncio.to_thread(
-                self._case_store.record_operational_failure,
-                guild_id=guild_id,
-                source=source,
-                summary=summary,
-                occurred_at=datetime.now(timezone.utc),
-                case_id=case_id,
-                operation_id=operation_id,
-            )
-        except Exception:
-            log.exception("Could not persist Honeypot operational failure")
-            return
-        slow_retry_started = (
-            not terminal and attempts == DETECTION_FAST_RETRY_LIMIT + 1
+        if terminal:
+            state = "terminal"
+        elif attempts == DETECTION_FAST_RETRY_LIMIT + 1:
+            state = "fast retries exhausted, slow retry scheduled"
+        else:
+            state = "will retry"
+        context = f"attempt {attempts}, {state}"
+        reported_error = (
+            error
+            if error is not None
+            else RuntimeError(f"{summary[:500]} ({context})")
+        )
+        action = (
+            f"{source_value} ({context})" if error is not None else source_value
+        )
+        await report_operational_error(
+            self.bot,
+            guild_id=guild_id,
+            source="Honeypot",
+            action=action,
+            error=reported_error,
+            correlation_key=operation_id or case_id,
         )
-        if failure.occurrences == 1 or slow_retry_started:
-            if terminal:
-                state = "terminal"
-            elif slow_retry_started:
-                state = "fast retries exhausted; slow retry scheduled"
-            else:
-                state = "will retry"
-            await self._send_operational_alert(
-                guild_id,
-                f"⚠️ Honeypot operation failed ({source_value}, attempt {attempts}, {state}): "
-                f"{summary[:500]}",
-            )
 
     async def _restore_detection_case_views(self) -> None:
         await self.bot.wait_until_red_ready()
@@ -1731,12 +1701,6 @@ async def channels_review(
     ) -> None:
         return await channel_routing.configure_single(self, ctx, "review", target)
 
-    @channels.command(name="errors")
-    async def channels_errors(
-        self, ctx: commands.Context, target: discord.TextChannel | discord.Thread = None
-    ) -> None:
-        return await channel_routing.configure_single(self, ctx, "errors", target)
-
     @channels.command(name="daily-stats")
     async def channels_daily_stats(
         self, ctx: commands.Context, target: discord.TextChannel | discord.Thread = None
@@ -2271,45 +2235,6 @@ async def config_all(self, ctx: commands.Context) -> None:
         """Show a compact summary of all honeypot settings."""
         return await detection.config_all(self, ctx)
 
-    @honeypot.group(name="errors", invoke_without_command=True)
-    async def honeypot_errors_group(self, ctx: commands.Context) -> None:
-        """Inspect and acknowledge Honeypot operational failures."""
-        return await self._send_group_overview(ctx)
-
-    @honeypot_errors_group.command(name="list")
-    async def honeypot_errors(self, ctx: commands.Context) -> None:
-        """Show unacknowledged Honeypot operational failures."""
-        return await diagnostics.honeypot_errors(self, ctx)
-
-    @honeypot_errors_group.command(name="clear")
-    async def honeypot_errors_clear(self, ctx: commands.Context) -> None:
-        """Acknowledge all currently visible Honeypot operational failures."""
-        return await diagnostics.honeypot_errors_clear(self, ctx)
-
-    @honeypot_errors_group.group(name="maintainer", invoke_without_command=True)
-    async def honeypot_errors_maintainer_group(self, ctx: commands.Context) -> None:
-        """Configure the person pinged for operational failures."""
-        return await self._send_group_overview(ctx)
-
-    @honeypot_errors_maintainer_group.command(name="show")
-    async def honeypot_errors_maintainer_show(self, ctx: commands.Context) -> None:
-        """Show the person pinged for operational failures."""
-        return await diagnostics.honeypot_errors_maintainer_show(self, ctx)
-
-    @honeypot_errors_maintainer_group.command(name="set")
-    async def honeypot_errors_maintainer_set(
-        self,
-        ctx: commands.Context,
-        member: discord.Member,
-    ) -> None:
-        """Set the person pinged for operational failures."""
-        return await diagnostics.honeypot_errors_maintainer_set(self, ctx, member)
-
-    @honeypot_errors_maintainer_group.command(name="clear")
-    async def honeypot_errors_maintainer_clear(self, ctx: commands.Context) -> None:
-        """Stop pinging a maintainer for operational failures."""
-        return await diagnostics.honeypot_errors_maintainer_clear(self, ctx)
-
     # ─── stats ────────────────────────────────────────────────────────
 
     @honeypot.command(name="modstats")
diff --git a/NHCogs/honeypot/imagescan.py b/NHCogs/honeypot/imagescan.py
index 30b8bc1..41f7a0b 100644
--- a/NHCogs/honeypot/imagescan.py
+++ b/NHCogs/honeypot/imagescan.py
@@ -692,6 +692,7 @@ async def _scan_case_message_images(
             "image_scan_setup",
             bounded,
             case_id=case_id,
+            error=error,
         )
         return
     reused_scans = ()
diff --git a/NHCogs/honeypot/joinwatch.py b/NHCogs/honeypot/joinwatch.py
index a1ad3d9..882257d 100644
--- a/NHCogs/honeypot/joinwatch.py
+++ b/NHCogs/honeypot/joinwatch.py
@@ -550,6 +550,7 @@ async def _apply_joinwatch_selected_work(
                 guild.id,
                 "joinwatch_timer_processing",
                 f"Could not process joinwatch timers: {exc}",
+                error=exc,
             )
 
 
@@ -574,6 +575,7 @@ async def joinwatch_auto_role_loop(cog) -> None:
                 guild.id,
                 "joinwatch_timer_processing",
                 f"Could not process joinwatch timers: {exc}",
+                error=exc,
             )
             continue
         await _apply_joinwatch_selected_work(
@@ -710,6 +712,7 @@ async def on_member_join(cog, member: discord.Member) -> None:
                             "joinwatch_role_assignment",
                             f"Could not apply auto-role to user {member.id}: {exc}",
                             terminal=True,
+                            error=exc,
                         )
                         status = _(
                             "I couldn't apply the configured joinwatch auto-role."
@@ -844,4 +847,5 @@ async def on_member_update(cog, before: discord.Member, after: discord.Member) -
                     "bait_role_alert",
                     f"Could not publish bait-role alert for user {after.id}: {exc}",
                     terminal=True,
+                    error=exc,
                 )
diff --git a/NHCogs/honeypot/joinwatch_publication.py b/NHCogs/honeypot/joinwatch_publication.py
index 2cddb17..0fbbff9 100644
--- a/NHCogs/honeypot/joinwatch_publication.py
+++ b/NHCogs/honeypot/joinwatch_publication.py
@@ -118,6 +118,7 @@ async def _record_update_failure(
         guild.id,
         "joinwatch_alert_update",
         f"Could not update joinwatch alert {message_id}: {error}",
+        error=error,
     )
 
 
@@ -261,6 +262,7 @@ async def publish_joinwatch_incident(
             "joinwatch_alert_publish",
             f"Could not publish joinwatch alert for user {member_id}: {exc}",
             terminal=True,
+            error=exc,
         )
 
 
@@ -302,4 +304,5 @@ async def publish_legacy_timer_result(
             guild.id,
             "joinwatch_timer_alert",
             f"Could not publish timer result for user {member_id}: {exc}",
+            error=exc,
         )
diff --git a/NHCogs/honeypot/operations/message_process.py b/NHCogs/honeypot/operations/message_process.py
index ba5d0d1..6e998b4 100644
--- a/NHCogs/honeypot/operations/message_process.py
+++ b/NHCogs/honeypot/operations/message_process.py
@@ -405,6 +405,7 @@ async def _trigger_publication_preview(
                 f"{type(error).__name__}: {error}",
                 case_id=context.operation.case_id,
                 operation_id=review_publication.operation_id,
+                error=error,
             )
             log.warning(
                 "Detection case preview publication failed case=%s "
diff --git a/NHCogs/honeypot/review_publication.py b/NHCogs/honeypot/review_publication.py
index db53817..3055397 100644
--- a/NHCogs/honeypot/review_publication.py
+++ b/NHCogs/honeypot/review_publication.py
@@ -154,6 +154,7 @@ async def _finish_detection_case_deletions(cog, cases: tuple[tuple[int, str], ..
                     "case_publication_deletion",
                     f"{type(error).__name__}: {error}",
                     case_id=case_id,
+                    error=error,
                 )
                 errors.append(error)
         local_deleted = job.local_deleted
@@ -174,6 +175,7 @@ async def _finish_detection_case_deletions(cog, cases: tuple[tuple[int, str], ..
                     "case_evidence_deletion",
                     f"{type(error).__name__}: {error}",
                     case_id=case_id,
+                    error=error,
                 )
                 errors.append(error)
         if not job.rows_deleted and local_deleted:
@@ -798,6 +800,7 @@ async def _retry_detection_orphan_publications(cog) -> None:
                 "orphan_publication_deletion",
                 f"{type(error).__name__}: {error}",
                 case_id=case_id,
+                error=error,
             )
             continue
         await asyncio.to_thread(
diff --git a/NHCogs/honeypot/settings.py b/NHCogs/honeypot/settings.py
index e07b43f..b719e4c 100644
--- a/NHCogs/honeypot/settings.py
+++ b/NHCogs/honeypot/settings.py
@@ -150,9 +150,7 @@ class BaitActionOption(str, Enum):
         "action": None,
         "fallback_action": "review",
         "dry_run": False,
-        "errors_channel": None,
         "daily_stats_channel": None,
-        "maintainer_id": None,
         "manual_evidence_channel": None,
         "manual_punishment_roles": {},
         "honeypot_channels": [],
@@ -387,9 +385,7 @@ class GuildSettings:
     action: CoreActionOption | None
     fallback_action: FallbackActionOption
     dry_run: bool
-    errors_channel: int | None
     daily_stats_channel: int | None
-    maintainer_id: int | None
     manual_evidence_channel: int | None
     manual_punishment_roles: dict[int, ManualPunishmentRoleSettings]
     honeypot_channels: list[int]
@@ -455,9 +451,7 @@ def from_mapping(cls, raw: Mapping[str, object]) -> GuildSettings:
                 raw, "fallback_action", FallbackActionOption, FallbackActionOption.REVIEW
             ),
             dry_run=_bool(raw, "dry_run"),
-            errors_channel=_optional_int(raw, "errors_channel"),
             daily_stats_channel=_optional_int(raw, "daily_stats_channel"),
-            maintainer_id=_optional_int(raw, "maintainer_id"),
             manual_evidence_channel=_optional_int(raw, "manual_evidence_channel"),
             manual_punishment_roles=_manual_punishment_roles(raw),
             honeypot_channels=_list(raw, "honeypot_channels", int),
diff --git a/NHCogs/info.json b/NHCogs/info.json
index 0b6eb4a..99a0ab5 100644
--- a/NHCogs/info.json
+++ b/NHCogs/info.json
@@ -5,7 +5,7 @@
   "name": "NHCogs",
   "install_msg": "Thank you for installing NHCogs.\nLoad it with `[p]load NHCogs`.",
   "short": "NewHorizons utility and moderation cogs in one extension.",
-  "description": "Loads ConsoleDump, NHMisc, Honeypot, Cleanup, GitHubTickets, NHModeration, and Custom Commands together while preserving their separate commands, configuration, and stored data",
+  "description": "Loads ConsoleDump, OperationalErrors, NHMisc, Honeypot, Cleanup, GitHubTickets, NHModeration, and Custom Commands together while preserving their separate commands, configuration, and stored data",
   "tags": [
     "misc",
     "utility",
@@ -25,5 +25,5 @@
     10,
     0
   ],
-  "end_user_data_statement": "NHMisc stores Discord IDs needed for its activity, sticky-role, role-analytics, achievement, and operational error features.\n\nActivity tracking stores user IDs with message counts for a configurable number of days. It also stores channel and thread IDs. Older daily summaries keep anonymous totals and channel IDs, but no user IDs.\n\nSticky roles store guild, user, and role IDs. Optional role analytics stores the current user IDs, bot flags, and role IDs for each enabled guild. Usernames and display names are used only when creating an export and are not saved.\n\nAchievements store guild and user IDs, achievement keys and display names, optional bound role IDs, timestamps, state, and optional proof-message IDs. Gate increment also stores the source message, moderator, recipients, target roles, result message, and operation status. This prevents the same message from being processed twice and allows interrupted changes to resume. Message content and usernames are not saved.\n\nOperational error records store the guild, source, action, short error summary, exception type, occurrence times and count, failure fingerprint, recovery state, and optional Discord location IDs. Tracebacks are sent only to the configured private Discord error channel and are not stored in SQLite.\n\nCustom Commands stores guild IDs, command names and response content, response weights and order, cooldown settings, revisions, author and editor IDs and names, and create or edit timestamps. Its one-time migration keeps a JSON backup and validation report. User-data deletion replaces matching author and editor identity while preserving command content.\n\nUser-data deletion removes that user's activity details, sticky roles, role-analytics records, and achievement history. Completed Gate operations are anonymized when it is safe to do so. An unfinished Gate operation retains user IDs for recovery. Source-message locks and anonymous totals are retained to prevent duplicate processing.\n\nManaged Cleanup commands do not create additional data.\n\nHoneypot stores moderation case metadata about detected users and messages in SQLite and publishes a summary, thread timeline, and captured attachment copies to a configured Discord review channel. It also retains Gateway-observed message, guild, channel, and author IDs, timestamps, pin state, author kind, and optional one-way spam fingerprints for 14 days to support purge, spam detection, and managed cleanup; it stores no message content or attachments in that registry. Case evidence files are removed by resolution cleanup; the resolved Discord thread is locked and archived. Attachments selected as image-learning samples are copied to separate image-scan storage and may remain there under its own retention controls. Red user-data deletion and guild removal delete matching registry rows, Discord case workspaces, local evidence, and case rows; channel and thread deletion removes matching registry rows, while unavailable Discord case deletions remain queued for retry.\n\nNHModeration stores source observations and canonical moderation actions in SQLite. Observations may contain guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration run identity, and attribution hints. It also stores synchronization cursors, migration state, and operational failure records. User-data deletion anonymizes matching identities and reasons, then rebuilds affected projections. Guild removal deletes that guild's history, synchronization state, migration state, failures, and configuration.\n\nGitHubTickets stores guild and user IDs, optional GitHub usernames, expertise categories, pull request titles and links, Discord ticket locations, reviewer routing state, exclusions, ping history, and deadlines in SQLite. Finished tickets, deleted ticket messages or threads, guild removal, and Red user-data deletion remove the corresponding data. Discord message content is not read back into the database."
+  "end_user_data_statement": "NHMisc stores Discord IDs needed for its activity, sticky-role, role-analytics, and achievement features. Activity tracking stores user IDs with message counts for a configurable number of days, plus channel and thread IDs. Sticky roles store guild, user, and role IDs. Role analytics stores current user IDs, bot flags, and role IDs. Achievements and Gate operations store the IDs and state needed for history, proof, duplicate prevention, and recovery. User-data deletion removes or anonymizes matching NHMisc records where recovery and duplicate-prevention contracts allow it.\n\nOperational error records store the guild, source, action, short error summary, exception type, occurrence times and count, failure fingerprint, recovery state, and optional Discord location IDs. OperationalErrors owns this process-wide data and its one global private channel and maintainer configuration. Tracebacks are sent only to that private channel and are not stored in SQLite.\n\nCustom Commands stores guild IDs, command names and response content, response weights and order, cooldown settings, revisions, author and editor IDs and names, and create or edit timestamps. User-data deletion replaces matching author and editor identity while preserving command content.\n\nManaged Cleanup commands do not create additional data. Honeypot stores moderation case metadata about detected users and messages in SQLite. It also retains Gateway-observed message, guild, channel, and author IDs, timestamps, pin state, author kind, and optional one-way spam fingerprints for 14 days. Case evidence files and image-learning samples follow the retention and deletion behavior documented by Honeypot.\n\nNHModeration stores source observations and canonical moderation actions in SQLite. Observations may contain guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration identity, and attribution hints. It also stores synchronization cursors and migration state. User-data deletion anonymizes matching identities and reasons, then rebuilds affected projections.\n\nGitHubTickets stores Discord guild and user IDs, optional GitHub user IDs and logins, categories, pull request repository IDs, pull request IDs and numbers, URLs, titles, authors, labels, draft and open state, update timestamps, Discord ticket locations, reviewer routing state, exclusions, ping history, and deadlines in SQLite. It stores GitHub delivery GUIDs and related event metadata for deduplication and recovery. Raw webhook request bodies are cleared after successful processing. Pending and failed deliveries, including terminal failures, may retain raw request bodies until the three-day delivery-body pruning window expires. Delivery identity and minimal result metadata are retained for at least seven days. GitHub add-assignee and remove-assignee outbox intents store ticket and transition IDs, repository and pull request identity, normalized GitHub login, state, retry counters, error summaries, and timestamps until their work is completed or cleaned up. Finished tickets and deleted ticket messages or threads remove corresponding ticket data. Guild removal clears the guild's GitHubTickets data. Red user-data deletion removes or redacts matching Discord-user profile and ticket data, but does not delete GitHub delivery identities or pull request rows that remain unbound. Discord message content is not read back into the database."
 }
diff --git a/NHCogs/nhmisc/README.md b/NHCogs/nhmisc/README.md
index 5f3aa92..d052fb5 100644
--- a/NHCogs/nhmisc/README.md
+++ b/NHCogs/nhmisc/README.md
@@ -326,8 +326,8 @@ is unavailable in channels visible to `@everyone`. Attach missing proofs with
 
 Gate increments, proof attachments and revokes, achievement grants and revokes,
 achievement definition changes, and role binding changes are recorded in the configured
-moderator action channel. Operational failures and partial results are sent to the
-maintenance channel.
+moderator action channel. Partial results are sent to the maintenance channel.
+Unexpected failures use the process-wide OperationalErrors reporter.
 
 ## Tier Distribution
 
@@ -682,24 +682,6 @@ permissions described above.
 `[p]selfchart` is available to regular guild users because it only returns the caller's
 own activity.
 
-## Operational errors
-
-NHMisc and Custom Commands share one private operational error destination. Configure it
-with:
-
-```ini
-[p]nhmisc errors
-[p]nhmisc errors channel [channel]
-[p]nhmisc errors channel clear
-[p]nhmisc errors maintainer [member]
-[p]nhmisc errors maintainer clear
-```
-
-The channel must be hidden from `@everyone`, and the bot needs View Channel, Send
-Messages, and Attach Files there. Alerts include a short summary and a traceback file.
-Only the configured maintainer can be pinged. If the alert itself cannot be sent, the
-error remains in SQLite and the failure is written to the bot console.
-
 ## Stored Data
 
 The cog stores Discord user IDs with passively collected message-count aggregates for
@@ -732,8 +714,3 @@ definition and all associated award records.
 
 The cleanup commands do not add an NHMisc database. They delegate to Honeypot,
 which owns its 14-day Gateway-observed message registry and its privacy deletion.
-
-Operational error records store the guild, source, action, bounded error summary,
-exception type, first and last occurrence times, occurrence count, failure fingerprint,
-recovery state, and optional channel, thread, and message IDs. Tracebacks are attached to
-the private Discord alert and are not stored in SQLite.
diff --git a/NHCogs/nhmisc/nhmisc.py b/NHCogs/nhmisc/nhmisc.py
index 5008031..29858ec 100644
--- a/NHCogs/nhmisc/nhmisc.py
+++ b/NHCogs/nhmisc/nhmisc.py
@@ -17,7 +17,7 @@
 from redbot.core import Config, commands
 from redbot.core.data_manager import cog_data_path
 
-from ..operational_errors import OperationalErrorReporter, OperationalFailure
+from ..operational_errors import report_operational_error
 from ..ranked_donut_chart import OTHER_COLOR, SERIES_COLORS, render_ranked_donut_chart
 from .achievement_definitions import (
     SOLO_GATER_DEFINITION,
@@ -446,8 +446,6 @@ def __init__(self, bot):
             bot_proxy_channel=None,
             bot_proxy_delete_closed_sessions=False,
             bot_proxy_enabled=True,
-            error_channel=None,
-            error_maintainer_id=None,
             vcjumping_visit_count=DEFAULT_VCJUMPING_VISIT_COUNT,
             vcjumping_window_seconds=DEFAULT_VCJUMPING_WINDOW_SECONDS,
             activity_channel=None,
@@ -456,12 +454,6 @@ def __init__(self, bot):
             sticky_debug_logging_enabled=False,
             forum_autopin_channel_ids=[],
         )
-        self._operational_errors = OperationalErrorReporter(
-            self.bot,
-            self.config,
-            cog_data_path(self) / "operational_errors.sqlite",
-            logger=log,
-        )
         self._bot_proxy_store = BotProxyStore(cog_data_path(self) / "bot_proxy.sqlite")
         self._bot_proxy = None
         self._voice_visits = VoiceChannelVisitTracker()
@@ -547,7 +539,6 @@ def __init__(self, bot):
         self._achievement_commands_registered = False
 
     async def cog_load(self) -> None:
-        await self._operational_errors.initialize()
         await self._activity_store.initialize()
         await self._sticky_roles.initialize()
         await self._role_analytics_store.initialize()
@@ -568,10 +559,6 @@ async def cog_load(self) -> None:
             self._recover_interrupted_gate_increments()
         )
 
-    @property
-    def operational_errors(self) -> OperationalErrorReporter:
-        return self._operational_errors
-
     async def report_operational_error(
         self,
         *,
@@ -582,23 +569,17 @@ async def report_operational_error(
         channel_id: int | None = None,
         thread_id: int | None = None,
         message_id: int | None = None,
-    ) -> OperationalFailure | None:
-        try:
-            return await self._operational_errors.report(
-                guild_id=guild_id,
-                source=source,
-                action=action,
-                error=error,
-                channel_id=channel_id,
-                thread_id=thread_id,
-                message_id=message_id,
-            )
-        except Exception:
-            log.exception(
-                "Failed to persist NH operational error for guild %s",
-                guild_id,
-            )
-            return None
+    ):
+        return await report_operational_error(
+            self.bot,
+            guild_id=guild_id,
+            source=source,
+            action=action,
+            error=error,
+            channel_id=channel_id,
+            thread_id=thread_id,
+            message_id=message_id,
+        )
 
     async def cog_command_error(
         self,
@@ -1168,9 +1149,6 @@ async def red_delete_data_for_user(self, *, requester, user_id: int) -> None:
         await self._role_analytics_store.delete_user_everywhere(user_id)
         await self._achievement_store.delete_user_everywhere(user_id)
         await self._gate_increment_store.redact_user_data(user_id)
-        for guild_id, guild_data in (await self.config.all_guilds()).items():
-            if guild_data.get("error_maintainer_id") == user_id:
-                await self.config.guild_from_id(guild_id).error_maintainer_id.clear()
 
     @staticmethod
     async def _defer_achievement_interaction(
@@ -4225,7 +4203,6 @@ async def nhmisc(self, ctx: commands.Context) -> None:
                 ctx,
                 preferred_order=(
                     "log",
-                    "errors",
                     "vcjumping",
                     "forumautopin",
                     "stickyroles",
@@ -4240,108 +4217,6 @@ async def nhmisc(self, ctx: commands.Context) -> None:
         )
         await ctx.send(embed=embed)
 
-    @nhmisc.group(name="errors", invoke_without_command=True)
-    async def nhmisc_errors(self, ctx: commands.Context) -> None:
-        """Configure private operational error reporting."""
-        guild_config = self.config.guild(ctx.guild)
-        channel_id = await guild_config.error_channel()
-        maintainer_id = await guild_config.error_maintainer_id()
-        active_failures = await self._operational_errors.active_count(ctx.guild.id)
-        if self._channel_is_public(ctx):
-            channel_label = "Run this command in a channel hidden from @everyone."
-            maintainer_label = channel_label
-            failure_label = channel_label
-        else:
-            channel_label = self._configured_channel_label(ctx.guild, channel_id)
-            maintainer = (
-                ctx.guild.get_member(maintainer_id)
-                if maintainer_id is not None
-                else None
-            )
-            maintainer_label = (
-                maintainer.mention if maintainer is not None else "Not configured"
-            )
-            failure_label = str(active_failures)
-        embed = self._configuration_embed(
-            ctx=ctx,
-            title="Operational errors",
-            current=(
-                f"Channel: {channel_label}",
-                f"Maintainer: {maintainer_label}",
-                f"Active failures: {failure_label}",
-            ),
-        )
-        await ctx.send(embed=embed, allowed_mentions=discord.AllowedMentions.none())
-
-    @nhmisc_errors.group(name="channel", invoke_without_command=True)
-    async def nhmisc_errors_channel(
-        self,
-        ctx: commands.Context,
-        channel: discord.TextChannel | None = None,
-    ) -> None:
-        """Show or set the private operational error channel."""
-        if channel is None:
-            await self._show_log_destination(
-                ctx,
-                title="Operational error channel",
-                config_key="error_channel",
-            )
-            return
-        missing_permissions = self._missing_log_permissions(
-            ctx.guild,
-            channel,
-            require_attach_files=True,
-        )
-        if missing_permissions is not None:
-            raise commands.UserFeedbackCheckFailure(missing_permissions)
-        if self._channel_allows_everyone(channel, ctx.guild):
-            raise commands.UserFeedbackCheckFailure(
-                "Configure a channel that is private from @everyone"
-            )
-        await self.config.guild(ctx.guild).error_channel.set(channel.id)
-        await ctx.send(f"Operational error channel set to {channel.mention}.")
-
-    @nhmisc_errors_channel.command(name="clear")
-    async def nhmisc_errors_channel_clear(self, ctx: commands.Context) -> None:
-        """Clear the operational error channel."""
-        await self.config.guild(ctx.guild).error_channel.clear()
-        await ctx.send("Operational error channel cleared.")
-
-    @nhmisc_errors.group(name="maintainer", invoke_without_command=True)
-    async def nhmisc_errors_maintainer(
-        self,
-        ctx: commands.Context,
-        member: discord.Member | None = None,
-    ) -> None:
-        """Show or set the maintainer pinged for operational errors."""
-        setting = self.config.guild(ctx.guild).error_maintainer_id
-        if member is not None:
-            await setting.set(member.id)
-            await ctx.send(
-                f"Operational error maintainer set to {member.mention}.",
-                allowed_mentions=discord.AllowedMentions.none(),
-            )
-            return
-        maintainer_id = await setting()
-        if self._channel_is_public(ctx):
-            value = "Run this command in a channel hidden from @everyone."
-        else:
-            maintainer = (
-                ctx.guild.get_member(maintainer_id)
-                if maintainer_id is not None
-                else None
-            )
-            value = maintainer.mention if maintainer is not None else "Not configured"
-        embed = discord.Embed(title="Operational error maintainer")
-        embed.add_field(name="Current configuration", value=value, inline=False)
-        await ctx.send(embed=embed, allowed_mentions=discord.AllowedMentions.none())
-
-    @nhmisc_errors_maintainer.command(name="clear")
-    async def nhmisc_errors_maintainer_clear(self, ctx: commands.Context) -> None:
-        """Clear the operational error maintainer."""
-        await self.config.guild(ctx.guild).error_maintainer_id.clear()
-        await ctx.send("Operational error maintainer cleared.")
-
     @nhmisc.group(name="roleanalytics", invoke_without_command=True)
     @commands.has_permissions(manage_messages=True)
     async def nhmisc_roleanalytics(self, ctx: commands.Context) -> None:
@@ -6585,17 +6460,6 @@ async def _require_private_alert_channel(
             "alert",
         )
 
-    async def require_private_error_channel(
-        self,
-        guild: discord.Guild,
-    ) -> discord.TextChannel:
-        """Return the configured private operational error channel."""
-        return await self._require_private_log_channel(
-            guild,
-            "error_channel",
-            "operational error",
-        )
-
     async def _require_private_moderation_log_channel(
         self,
         guild: discord.Guild,
diff --git a/NHCogs/nhmoderation/README.md b/NHCogs/nhmoderation/README.md
index 8ded097..97f8a45 100644
--- a/NHCogs/nhmoderation/README.md
+++ b/NHCogs/nhmoderation/README.md
@@ -77,12 +77,12 @@ Weekly reconciliation runs every Sunday at `04:20 UTC`. It re-reads a 14-day aud
 
 ## Operational errors
 
-Unexpected command, event, migration, synchronization, repair, scheduler, database, and rendering failures are stored in SQLite and written to the Python logger. NHModeration does not own separate error channel or maintainer commands.
+Unexpected command, event, migration, synchronization, repair, scheduler, database, and rendering failures are written to the Python logger and sent through the process-wide OperationalErrors reporter. NHModeration does not own separate error channel or maintainer commands.
 
 Expected input and permission errors return a short useful response. Public output never includes raw exceptions, audit IDs, case numbers, source keys, reasons, or database identifiers.
 
 ## Stored data and deletion
 
-NHModeration stores immutable source observations and rebuildable canonical actions. Stored fields may include guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration identity, attribution, synchronization cursors, and operational failures. Configured message filter phrases are stored per guild in Red Config.
+NHModeration stores immutable source observations and rebuildable canonical actions. Stored fields may include guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration identity, attribution, and synchronization cursors. Configured message filter phrases are stored per guild in Red Config.
 
-Red user-data deletion anonymizes matching identities and reasons, then rebuilds affected actions. Guild removal deletes the guild's history, synchronization state, migration state, failures, and configuration.
+Red user-data deletion anonymizes matching identities and reasons, then rebuilds affected actions. Guild removal deletes the guild's history, synchronization state, and migration state.
diff --git a/NHCogs/nhmoderation/info.json b/NHCogs/nhmoderation/info.json
index a360046..d4e98b3 100644
--- a/NHCogs/nhmoderation/info.json
+++ b/NHCogs/nhmoderation/info.json
@@ -21,5 +21,5 @@
     10,
     0
   ],
-  "end_user_data_statement": "NHModeration stores source observations and canonical moderation actions in SQLite. Observations may contain guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration run identity, and attribution hints. It also stores synchronization cursors, migration state, and operational failure records. User-data deletion anonymizes matching identities and reasons, then rebuilds affected projections. Guild removal deletes that guild's history, synchronization state, migration state, failures, and configuration. Tracebacks are written to the Python logger and are not stored in SQLite."
+  "end_user_data_statement": "NHModeration stores source observations and canonical moderation actions in SQLite. Observations may contain guild, target, technical executor, credited moderator, and channel IDs, action type, timestamps, reasons, expiry, source identity, migration run identity, and attribution hints. It also stores synchronization cursors and migration state. User-data deletion anonymizes matching identities and reasons, then rebuilds affected projections. Guild removal deletes that guild's history, synchronization state, and migration state. Operational reports are owned by the process-wide OperationalErrors cog."
 }
diff --git a/NHCogs/nhmoderation/nhmoderation.py b/NHCogs/nhmoderation/nhmoderation.py
index 6edb02c..b355345 100644
--- a/NHCogs/nhmoderation/nhmoderation.py
+++ b/NHCogs/nhmoderation/nhmoderation.py
@@ -18,7 +18,10 @@
     overview_embeds,
     send_group_overview,
 )
-from ..operational_errors import OperationalErrorReporter, OperationalFailure
+from ..operational_errors import (
+    mark_operational_error_recovered,
+    report_operational_error,
+)
 from ..ranked_donut_chart import render_ranked_donut_chart
 from .command_inputs import parse_banchart_arguments
 from .history import NHModerationHistory
@@ -47,16 +50,9 @@ def __init__(self, bot: Red) -> None:
             identifier=self.CONFIG_IDENTIFIER,
             force_registration=True,
         )
-        self.config.register_guild(
-            error_channel=None,
-            error_maintainer_id=None,
-            message_filter_phrases=[],
-        )
+        self.config.register_guild(message_filter_phrases=[])
         database_path = cog_data_path(self) / "moderation.sqlite"
         self.history = NHModerationHistory(database_path)
-        self._operational_errors = OperationalErrorReporter(
-            bot, self.config, database_path, logger=log
-        )
         self._synchronizer: ModerationSynchronizer | None = None
         self._scheduler_task: asyncio.Task[None] | None = None
         self._startup_task: asyncio.Task[None] | None = None
@@ -67,7 +63,6 @@ def __init__(self, bot: Red) -> None:
 
     async def cog_load(self) -> None:
         await self.history.initialize()
-        await self._operational_errors.initialize()
         guild_configs = await self.config.all_guilds()
         self._message_filter_phrases = {
             int(guild_id): tuple(settings.get("message_filter_phrases", ()))
@@ -114,7 +109,6 @@ async def red_delete_data_for_user(self, *, requester: str, user_id: int) -> Non
     @commands.Cog.listener()
     async def on_guild_remove(self, guild: discord.Guild) -> None:
         await self.history.delete_guild_data(guild.id)
-        await self._operational_errors.delete_guild(guild.id)
         async with self._message_filter_lock:
             self._message_filter_phrases.pop(guild.id, None)
             await self.config.guild(guild).clear()
@@ -155,28 +149,22 @@ async def report_operational_error(
         error: BaseException,
         channel_id: int | None = None,
         message_id: int | None = None,
-    ) -> OperationalFailure | None:
+    ):
         log.error(
             "NHModeration operational error during %s for guild %s",
             action,
             guild_id,
             exc_info=(type(error), error, error.__traceback__),
         )
-        try:
-            return await self._operational_errors.report(
-                guild_id=guild_id,
-                source="NHModeration",
-                action=action,
-                error=error,
-                channel_id=channel_id,
-                message_id=message_id,
-            )
-        except Exception:
-            log.exception(
-                "Failed to persist NHModeration operational error for guild %s",
-                guild_id,
-            )
-            return None
+        return await report_operational_error(
+            self.bot,
+            guild_id=guild_id,
+            source="NHModeration",
+            action=action,
+            error=error,
+            channel_id=channel_id,
+            message_id=message_id,
+        )
 
     async def cog_command_error(
         self, ctx: commands.Context, error: commands.CommandError
@@ -246,17 +234,12 @@ async def _report_background_error(
     async def _mark_operational_recovered(
         self, guild: discord.Guild, action: str
     ) -> None:
-        try:
-            await self._operational_errors.mark_action_recovered(
-                guild_id=guild.id,
-                source="NHModeration",
-                action=action,
-            )
-        except Exception:
-            log.exception(
-                "Failed to mark NHModeration action recovered for guild %s",
-                guild.id,
-            )
+        await mark_operational_error_recovered(
+            self.bot,
+            guild_id=guild.id,
+            source="NHModeration",
+            action=action,
+        )
 
     async def _fetch_audit_entries(
         self,
diff --git a/NHCogs/operational_errors.py b/NHCogs/operational_errors.py
index ad726e3..f297b69 100644
--- a/NHCogs/operational_errors.py
+++ b/NHCogs/operational_errors.py
@@ -1,375 +1,96 @@
 from __future__ import annotations
 
-import asyncio
-import hashlib
-import io
-import sqlite3
-import traceback
-from contextlib import closing
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from pathlib import Path
+import logging
 from typing import Any
 
-import discord
-
-MAX_SUMMARY_LENGTH = 1_000
-
-
-@dataclass(frozen=True)
-class OperationalFailure:
-    guild_id: int
-    fingerprint: str
-    source: str
-    action: str
-    summary: str
-    exception_type: str
-    first_seen_at: datetime
-    last_seen_at: datetime
-    occurrences: int
-    recovered_at: datetime | None
-    channel_id: int | None
-    thread_id: int | None
-    message_id: int | None
-
-
-def _timestamp(value: datetime) -> str:
-    return value.astimezone(timezone.utc).isoformat()
-
-
-def _datetime(value: str | None) -> datetime | None:
-    return datetime.fromisoformat(value) if value is not None else None
-
-
-class OperationalErrorReporter:
-    """Persist NH operational failures and publish private Discord alerts."""
-
-    def __init__(self, bot: Any, config: Any, database_path: Path, *, logger: Any):
-        self._bot = bot
-        self._config = config
-        self._database_path = Path(database_path)
-        self._logger = logger
-
-    async def initialize(self) -> None:
-        await asyncio.to_thread(self._initialize_sync)
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self._database_path)
-        connection.row_factory = sqlite3.Row
-        return connection
-
-    def _initialize_sync(self) -> None:
-        self._database_path.parent.mkdir(parents=True, exist_ok=True)
-        with closing(self._connect()) as connection, connection:
-            connection.execute(
-                """CREATE TABLE IF NOT EXISTS operational_failures (
-                    failure_id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    guild_id INTEGER NOT NULL,
-                    fingerprint TEXT NOT NULL,
-                    source TEXT NOT NULL,
-                    action TEXT NOT NULL,
-                    summary TEXT NOT NULL,
-                    exception_type TEXT NOT NULL,
-                    first_seen_at TEXT NOT NULL,
-                    last_seen_at TEXT NOT NULL,
-                    occurrences INTEGER NOT NULL,
-                    recovered_at TEXT,
-                    channel_id INTEGER,
-                    thread_id INTEGER,
-                    message_id INTEGER
-                )"""
-            )
-            connection.execute(
-                """CREATE UNIQUE INDEX IF NOT EXISTS operational_failures_open
-                   ON operational_failures(guild_id, fingerprint)
-                   WHERE recovered_at IS NULL"""
-            )
-
-    @staticmethod
-    def _fingerprint(
-        *, source: str, action: str, summary: str, exception_type: str
-    ) -> str:
-        payload = "\n".join((source, action, exception_type, summary))
-        return hashlib.sha256(payload.encode("utf-8")).hexdigest()
-
-    @staticmethod
-    def _from_row(row: sqlite3.Row) -> OperationalFailure:
-        first_seen_at = _datetime(row["first_seen_at"])
-        last_seen_at = _datetime(row["last_seen_at"])
-        if first_seen_at is None or last_seen_at is None:
-            raise RuntimeError("operational failure timestamps are missing")
-        return OperationalFailure(
-            guild_id=row["guild_id"],
-            fingerprint=row["fingerprint"],
-            source=row["source"],
-            action=row["action"],
-            summary=row["summary"],
-            exception_type=row["exception_type"],
-            first_seen_at=first_seen_at,
-            last_seen_at=last_seen_at,
-            occurrences=row["occurrences"],
-            recovered_at=_datetime(row["recovered_at"]),
-            channel_id=row["channel_id"],
-            thread_id=row["thread_id"],
-            message_id=row["message_id"],
-        )
-
-    def _record_sync(
-        self,
-        *,
-        guild_id: int,
-        fingerprint: str,
-        source: str,
-        action: str,
-        summary: str,
-        exception_type: str,
-        occurred_at: datetime,
-        channel_id: int | None,
-        thread_id: int | None,
-        message_id: int | None,
-    ) -> OperationalFailure:
-        timestamp = _timestamp(occurred_at)
-        with closing(self._connect()) as connection, connection:
-            connection.execute("BEGIN IMMEDIATE")
-            row = connection.execute(
-                """SELECT failure_id FROM operational_failures
-                   WHERE guild_id = ? AND fingerprint = ? AND recovered_at IS NULL""",
-                (guild_id, fingerprint),
-            ).fetchone()
-            if row is None:
-                cursor = connection.execute(
-                    """INSERT INTO operational_failures
-                       (guild_id, fingerprint, source, action, summary, exception_type,
-                        first_seen_at, last_seen_at, occurrences, channel_id,
-                        thread_id, message_id)
-                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)""",
-                    (
-                        guild_id,
-                        fingerprint,
-                        source,
-                        action,
-                        summary,
-                        exception_type,
-                        timestamp,
-                        timestamp,
-                        channel_id,
-                        thread_id,
-                        message_id,
-                    ),
-                )
-                failure_id = cursor.lastrowid
-            else:
-                failure_id = row["failure_id"]
-                connection.execute(
-                    """UPDATE operational_failures
-                       SET summary = ?, last_seen_at = ?, occurrences = occurrences + 1,
-                           channel_id = ?, thread_id = ?, message_id = ?
-                       WHERE failure_id = ?""",
-                    (
-                        summary,
-                        timestamp,
-                        channel_id,
-                        thread_id,
-                        message_id,
-                        failure_id,
-                    ),
+log = logging.getLogger("red.OperationalErrors")
+
+COG_NAME = "OperationalErrors"
+
+
+def _log_report_failure(message: str, *args: Any) -> None:
+    try:
+        log.exception(message, *args)
+    except BaseException:
+        pass
+
+
+async def report_operational_error(
+    bot: Any,
+    *,
+    guild_id: int,
+    source: str,
+    action: str,
+    error: BaseException,
+    channel_id: int | None = None,
+    thread_id: int | None = None,
+    message_id: int | None = None,
+    correlation_key: str | None = None,
+) -> Any | None:
+    """Report one operational failure without allowing reporting to escape."""
+    try:
+        reporter = bot.get_cog(COG_NAME)
+        report = getattr(reporter, "report", None)
+        if not callable(report):
+            try:
+                log.error(
+                    "OperationalErrors is unavailable while reporting %s during %s",
+                    source,
+                    action,
+                    exc_info=(type(error), error, error.__traceback__),
                 )
-            stored = connection.execute(
-                "SELECT * FROM operational_failures WHERE failure_id = ?",
-                (failure_id,),
-            ).fetchone()
-        if stored is None:
-            raise RuntimeError("operational failure write could not be read back")
-        return self._from_row(stored)
-
-    async def report(
-        self,
-        *,
-        guild_id: int,
-        source: str,
-        action: str,
-        error: BaseException,
-        channel_id: int | None = None,
-        thread_id: int | None = None,
-        message_id: int | None = None,
-    ) -> OperationalFailure:
-        exception_type = type(error).__name__
-        summary = (str(error).strip() or exception_type)[:MAX_SUMMARY_LENGTH]
-        fingerprint = self._fingerprint(
-            source=source,
-            action=action,
-            summary=summary,
-            exception_type=exception_type,
-        )
-        failure = await asyncio.to_thread(
-            self._record_sync,
+            except BaseException:
+                pass
+            return None
+        return await report(
             guild_id=guild_id,
-            fingerprint=fingerprint,
             source=source,
             action=action,
-            summary=summary,
-            exception_type=exception_type,
-            occurred_at=datetime.now(timezone.utc),
+            error=error,
             channel_id=channel_id,
             thread_id=thread_id,
             message_id=message_id,
+            correlation_key=correlation_key,
         )
-        trace = "".join(traceback.format_exception(type(error), error, error.__traceback__))
-        try:
-            await self._publish_alert(failure, trace)
-        except Exception:
-            self._logger.exception(
-                "Failed to publish NH operational error alert for guild %s",
-                guild_id,
-            )
-        return failure
-
-    async def _publish_alert(self, failure: OperationalFailure, trace: str) -> None:
-        guild = self._bot.get_guild(failure.guild_id)
-        if guild is None:
-            self._logger.error(
-                "Cannot publish NH operational error because guild %s is unavailable",
-                failure.guild_id,
-            )
-            return
-        guild_config = self._config.guild_from_id(failure.guild_id)
-        channel_id = await guild_config.error_channel()
-        maintainer_id = await guild_config.error_maintainer_id()
-        channel = guild.get_channel(channel_id) if channel_id is not None else None
-        if channel is None:
-            self._logger.error(
-                "Cannot publish NH operational error because its channel is not configured"
-            )
-            return
-        if channel.permissions_for(guild.default_role).view_channel:
-            self._logger.error(
-                "Cannot publish NH operational error because channel %s is public",
-                channel.id,
-            )
-            return
-
-        maintainer = guild.get_member(maintainer_id) if maintainer_id is not None else None
-        mention = maintainer.mention if maintainer is not None else None
-        mention_target = maintainer
-        if maintainer_id is not None and mention_target is None:
-            mention = f"<@{maintainer_id}>"
-            mention_target = discord.Object(id=maintainer_id)
-        lines = []
-        if mention is not None:
-            lines.append(mention)
-        lines.extend(
-            (
-                f"**{failure.source} operational error**",
-                f"Action: {failure.action}",
-                f"Error: {failure.exception_type}: {failure.summary}",
-                f"Occurrences: {failure.occurrences}",
-            )
-        )
-        context = self._format_context(failure)
-        if context is not None:
-            lines.append(f"Context: {context}")
-        allowed_mentions = discord.AllowedMentions(
-            everyone=False,
-            users=[mention_target] if mention_target is not None else False,
-            roles=False,
-            replied_user=False,
-        )
-        payload = trace or f"{failure.exception_type}: {failure.summary}\n"
-        await channel.send(
-            "\n".join(lines),
-            file=discord.File(
-                io.BytesIO(payload.encode("utf-8")),
-                filename=f"nh-error-{failure.fingerprint[:12]}.txt",
-            ),
-            allowed_mentions=allowed_mentions,
-        )
-
-    @staticmethod
-    def _format_context(failure: OperationalFailure) -> str | None:
-        context_channel_id = failure.thread_id or failure.channel_id
-        if context_channel_id is None:
-            return None
-        channel = f"<#{context_channel_id}>"
-        if failure.message_id is None:
-            return channel
-        return (
-            f"{channel} "
-            f"https://discord.com/channels/{failure.guild_id}/"
-            f"{context_channel_id}/{failure.message_id}"
+    except BaseException:
+        _log_report_failure(
+            "OperationalErrors failed while reporting %s during %s",
+            source,
+            action,
         )
-
-    async def mark_recovered(self, *, guild_id: int, fingerprint: str) -> bool:
-        return await asyncio.to_thread(
-            self._mark_recovered_sync,
-            guild_id=guild_id,
-            fingerprint=fingerprint,
-            recovered_at=datetime.now(timezone.utc),
-        )
-
-    async def mark_action_recovered(
-        self,
-        *,
-        guild_id: int,
-        source: str,
-        action: str,
-    ) -> int:
-        return await asyncio.to_thread(
-            self._mark_action_recovered_sync,
+        return None
+
+
+async def mark_operational_error_recovered(
+    bot: Any,
+    *,
+    guild_id: int,
+    source: str,
+    action: str,
+    correlation_key: str | None = None,
+) -> int:
+    """Mark matching reports recovered when the process-wide reporter is available."""
+    try:
+        reporter = bot.get_cog(COG_NAME)
+        mark_recovered = getattr(reporter, "mark_action_recovered", None)
+        if not callable(mark_recovered):
+            return 0
+        return await mark_recovered(
             guild_id=guild_id,
             source=source,
             action=action,
-            recovered_at=datetime.now(timezone.utc),
+            correlation_key=correlation_key,
         )
+    except BaseException:
+        _log_report_failure(
+            "OperationalErrors failed to mark %s during %s recovered",
+            source,
+            action,
+        )
+        return 0
 
-    async def active_count(self, guild_id: int) -> int:
-        return await asyncio.to_thread(self._active_count_sync, guild_id)
-
-    async def delete_guild(self, guild_id: int) -> None:
-        await asyncio.to_thread(self._delete_guild_sync, guild_id)
-
-    def _delete_guild_sync(self, guild_id: int) -> None:
-        with closing(self._connect()) as connection, connection:
-            connection.execute(
-                "DELETE FROM operational_failures WHERE guild_id = ?", (guild_id,)
-            )
-
-    def _active_count_sync(self, guild_id: int) -> int:
-        with closing(self._connect()) as connection:
-            row = connection.execute(
-                """SELECT COUNT(*) AS count FROM operational_failures
-                   WHERE guild_id = ? AND recovered_at IS NULL""",
-                (guild_id,),
-            ).fetchone()
-        return int(row["count"]) if row is not None else 0
-
-    def _mark_recovered_sync(
-        self,
-        *,
-        guild_id: int,
-        fingerprint: str,
-        recovered_at: datetime,
-    ) -> bool:
-        with closing(self._connect()) as connection, connection:
-            cursor = connection.execute(
-                """UPDATE operational_failures SET recovered_at = ?
-                   WHERE guild_id = ? AND fingerprint = ? AND recovered_at IS NULL""",
-                (_timestamp(recovered_at), guild_id, fingerprint),
-            )
-            return cursor.rowcount > 0
 
-    def _mark_action_recovered_sync(
-        self,
-        *,
-        guild_id: int,
-        source: str,
-        action: str,
-        recovered_at: datetime,
-    ) -> int:
-        with closing(self._connect()) as connection, connection:
-            cursor = connection.execute(
-                """UPDATE operational_failures SET recovered_at = ?
-                   WHERE guild_id = ? AND source = ? AND action = ?
-                     AND recovered_at IS NULL""",
-                (_timestamp(recovered_at), guild_id, source, action),
-            )
-            return cursor.rowcount
+__all__ = (
+    "mark_operational_error_recovered",
+    "report_operational_error",
+)
diff --git a/NHCogs/operationalerrors/README.md b/NHCogs/operationalerrors/README.md
new file mode 100644
index 0000000..99946d2
--- /dev/null
+++ b/NHCogs/operationalerrors/README.md
@@ -0,0 +1,42 @@
+# Operational errors
+
+OperationalErrors is the process-wide private error reporter for the combined NHCogs
+extension. It stores bounded failure summaries in SQLite and attempts one private alert
+for every report.
+
+## Setup
+
+Load the combined `NHCogs` extension. The configured channel must be hidden from
+`@everyone`. The bot needs View Channel, Send Messages, and Attach Files there. Every
+command requires Manage Messages.
+
+```ini
+[p]nhcogs
+[p]nhcogs errors
+[p]nhcogs errors channel
+[p]nhcogs errors channel set <channel>
+[p]nhcogs errors channel clear
+[p]nhcogs errors maintainer
+[p]nhcogs errors maintainer set <member>
+[p]nhcogs errors maintainer clear
+```
+
+Bare groups show their current private configuration and registered command paths. In a
+channel visible to `@everyone`, they show the safe command catalog without reading or
+displaying the protected configuration. The root shows its direct categories. Nested
+groups show every leaf below them.
+
+`channel set` selects the one process-wide private alert destination. `channel clear`
+removes it. `maintainer set` selects the only member an alert may ping, and `maintainer
+clear` disables the ping.
+
+Alerts contain the source, action, bounded error summary, occurrence count, optional
+Discord location, and a traceback attachment. If persistence or Discord delivery fails,
+the reporting entry point logs the failure and returns without raising it to the caller.
+
+## Stored data
+
+Operational error records store the guild, source, action, bounded error summary,
+exception type, first and last occurrence times, occurrence count, failure fingerprint,
+recovery state, and optional channel, thread, and message IDs. Tracebacks are attached to
+the private Discord alert and are not stored in SQLite.
diff --git a/NHCogs/operationalerrors/__init__.py b/NHCogs/operationalerrors/__init__.py
new file mode 100644
index 0000000..113de45
--- /dev/null
+++ b/NHCogs/operationalerrors/__init__.py
@@ -0,0 +1,17 @@
+from ..operational_errors import (
+    mark_operational_error_recovered,
+    report_operational_error,
+)
+from .cog import OperationalErrors, OperationalFailure
+
+
+async def setup(bot) -> None:
+    await bot.add_cog(OperationalErrors(bot))
+
+
+__all__ = (
+    "OperationalErrors",
+    "OperationalFailure",
+    "mark_operational_error_recovered",
+    "report_operational_error",
+)
diff --git a/NHCogs/operationalerrors/cog.py b/NHCogs/operationalerrors/cog.py
new file mode 100644
index 0000000..99b6c27
--- /dev/null
+++ b/NHCogs/operationalerrors/cog.py
@@ -0,0 +1,598 @@
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import io
+import logging
+import sqlite3
+import traceback
+from contextlib import closing
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Any
+
+import discord
+from redbot.core import Config, commands
+from redbot.core.data_manager import cog_data_path
+
+from .. import command_overview
+from ..operational_errors import _log_report_failure
+
+log = logging.getLogger("red.OperationalErrors")
+
+MAX_SUMMARY_LENGTH = 1_000
+
+
+@dataclass(frozen=True, slots=True)
+class OperationalFailure:
+    guild_id: int
+    fingerprint: str
+    source: str
+    action: str
+    summary: str
+    exception_type: str
+    first_seen_at: datetime
+    last_seen_at: datetime
+    occurrences: int
+    recovered_at: datetime | None
+    channel_id: int | None
+    thread_id: int | None
+    message_id: int | None
+
+
+def _timestamp(value: datetime) -> str:
+    return value.astimezone(timezone.utc).isoformat()
+
+
+def _datetime(value: str | None) -> datetime | None:
+    return datetime.fromisoformat(value) if value is not None else None
+
+
+class OperationalErrors(commands.Cog):
+    """Persist operational failures and publish private Discord alerts."""
+
+    CONFIG_IDENTIFIER = 208949585754543553992613466368209142183
+
+    def __init__(self, bot: Any) -> None:
+        self.bot = bot
+        self.config = Config.get_conf(
+            self,
+            identifier=self.CONFIG_IDENTIFIER,
+            force_registration=True,
+        )
+        self.config.register_global(
+            error_channel=None,
+            error_maintainer_id=None,
+        )
+        self._database_path = cog_data_path(self) / "operational_errors.sqlite"
+
+    async def cog_load(self) -> None:
+        await asyncio.to_thread(self._initialize_sync)
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self._database_path)
+        connection.row_factory = sqlite3.Row
+        return connection
+
+    def _initialize_sync(self) -> None:
+        self._database_path.parent.mkdir(parents=True, exist_ok=True)
+        with closing(self._connect()) as connection, connection:
+            connection.execute(
+                """CREATE TABLE IF NOT EXISTS operational_failures (
+                    failure_id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    guild_id INTEGER NOT NULL,
+                    fingerprint TEXT NOT NULL,
+                    source TEXT NOT NULL,
+                    action TEXT NOT NULL,
+                    summary TEXT NOT NULL,
+                    exception_type TEXT NOT NULL,
+                    first_seen_at TEXT NOT NULL,
+                    last_seen_at TEXT NOT NULL,
+                    occurrences INTEGER NOT NULL,
+                    recovered_at TEXT,
+                    channel_id INTEGER,
+                    thread_id INTEGER,
+                    message_id INTEGER
+                )"""
+            )
+            connection.execute(
+                """CREATE UNIQUE INDEX IF NOT EXISTS operational_failures_open
+                   ON operational_failures(guild_id, fingerprint)
+                   WHERE recovered_at IS NULL"""
+            )
+
+    @staticmethod
+    def _fingerprint(
+        *, source: str, action: str, summary: str, exception_type: str
+    ) -> str:
+        payload = "\n".join((source, action, exception_type, summary))
+        return hashlib.sha256(payload.encode("utf-8")).hexdigest()
+
+    @staticmethod
+    def _correlation_fingerprint(
+        *, source: str, action: str, correlation_key: str
+    ) -> str:
+        payload = "\n".join((source, action, "correlation", correlation_key))
+        return hashlib.sha256(payload.encode("utf-8")).hexdigest()
+
+    @staticmethod
+    def _from_row(row: sqlite3.Row) -> OperationalFailure:
+        first_seen_at = _datetime(row["first_seen_at"])
+        last_seen_at = _datetime(row["last_seen_at"])
+        if first_seen_at is None or last_seen_at is None:
+            raise RuntimeError("Operational failure timestamps are missing")
+        return OperationalFailure(
+            guild_id=row["guild_id"],
+            fingerprint=row["fingerprint"],
+            source=row["source"],
+            action=row["action"],
+            summary=row["summary"],
+            exception_type=row["exception_type"],
+            first_seen_at=first_seen_at,
+            last_seen_at=last_seen_at,
+            occurrences=row["occurrences"],
+            recovered_at=_datetime(row["recovered_at"]),
+            channel_id=row["channel_id"],
+            thread_id=row["thread_id"],
+            message_id=row["message_id"],
+        )
+
+    def _record_sync(
+        self,
+        *,
+        guild_id: int,
+        fingerprint: str,
+        source: str,
+        action: str,
+        summary: str,
+        exception_type: str,
+        occurred_at: datetime,
+        channel_id: int | None,
+        thread_id: int | None,
+        message_id: int | None,
+    ) -> OperationalFailure:
+        timestamp = _timestamp(occurred_at)
+        with closing(self._connect()) as connection, connection:
+            connection.execute("BEGIN IMMEDIATE")
+            row = connection.execute(
+                """SELECT failure_id FROM operational_failures
+                   WHERE guild_id = ? AND fingerprint = ? AND recovered_at IS NULL""",
+                (guild_id, fingerprint),
+            ).fetchone()
+            if row is None:
+                cursor = connection.execute(
+                    """INSERT INTO operational_failures
+                       (guild_id, fingerprint, source, action, summary, exception_type,
+                        first_seen_at, last_seen_at, occurrences, channel_id,
+                        thread_id, message_id)
+                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)""",
+                    (
+                        guild_id,
+                        fingerprint,
+                        source,
+                        action,
+                        summary,
+                        exception_type,
+                        timestamp,
+                        timestamp,
+                        channel_id,
+                        thread_id,
+                        message_id,
+                    ),
+                )
+                failure_id = cursor.lastrowid
+            else:
+                failure_id = row["failure_id"]
+                connection.execute(
+                    """UPDATE operational_failures
+                       SET summary = ?, last_seen_at = ?, occurrences = occurrences + 1,
+                           channel_id = ?, thread_id = ?, message_id = ?
+                       WHERE failure_id = ?""",
+                    (
+                        summary,
+                        timestamp,
+                        channel_id,
+                        thread_id,
+                        message_id,
+                        failure_id,
+                    ),
+                )
+            stored = connection.execute(
+                "SELECT * FROM operational_failures WHERE failure_id = ?",
+                (failure_id,),
+            ).fetchone()
+        if stored is None:
+            raise RuntimeError("Operational failure write could not be read back")
+        return self._from_row(stored)
+
+    async def report(
+        self,
+        *,
+        guild_id: int,
+        source: str,
+        action: str,
+        error: BaseException,
+        channel_id: int | None = None,
+        thread_id: int | None = None,
+        message_id: int | None = None,
+        correlation_key: str | None = None,
+    ) -> OperationalFailure | None:
+        exception_type = type(error).__name__
+        summary = (str(error).strip() or exception_type)[:MAX_SUMMARY_LENGTH]
+        fingerprint = (
+            self._correlation_fingerprint(
+                source=source,
+                action=action,
+                correlation_key=correlation_key,
+            )
+            if correlation_key is not None
+            else self._fingerprint(
+                source=source,
+                action=action,
+                summary=summary,
+                exception_type=exception_type,
+            )
+        )
+        now = datetime.now(timezone.utc)
+        failure: OperationalFailure | None = None
+        try:
+            failure = await asyncio.to_thread(
+                self._record_sync,
+                guild_id=guild_id,
+                fingerprint=fingerprint,
+                source=source,
+                action=action,
+                summary=summary,
+                exception_type=exception_type,
+                occurred_at=now,
+                channel_id=channel_id,
+                thread_id=thread_id,
+                message_id=message_id,
+            )
+        except BaseException:
+            _log_report_failure(
+                "Failed to persist operational error for guild %s",
+                guild_id,
+            )
+
+        alert_failure = failure or OperationalFailure(
+            guild_id=guild_id,
+            fingerprint=fingerprint,
+            source=source,
+            action=action,
+            summary=summary,
+            exception_type=exception_type,
+            first_seen_at=now,
+            last_seen_at=now,
+            occurrences=1,
+            recovered_at=None,
+            channel_id=channel_id,
+            thread_id=thread_id,
+            message_id=message_id,
+        )
+        trace = "".join(
+            traceback.format_exception(type(error), error, error.__traceback__)
+        )
+        try:
+            await self._publish_alert(alert_failure, trace)
+        except BaseException:
+            _log_report_failure(
+                "Failed to publish operational error alert for guild %s",
+                guild_id,
+            )
+        return failure
+
+    async def _publish_alert(
+        self,
+        failure: OperationalFailure,
+        trace: str,
+    ) -> None:
+        channel_id = await self.config.error_channel()
+        maintainer_id = await self.config.error_maintainer_id()
+        channel = self.bot.get_channel(channel_id) if channel_id is not None else None
+        if channel is None:
+            log.error(
+                "Cannot publish operational error because its channel is not configured"
+            )
+            return
+        guild = channel.guild
+        if channel.permissions_for(guild.default_role).view_channel:
+            log.error(
+                "Cannot publish operational error because channel %s is public",
+                channel.id,
+            )
+            return
+
+        maintainer = guild.get_member(maintainer_id) if maintainer_id is not None else None
+        mention = maintainer.mention if maintainer is not None else None
+        mention_target: Any = maintainer
+        if maintainer_id is not None and mention_target is None:
+            mention = f"<@{maintainer_id}>"
+            mention_target = discord.Object(id=maintainer_id)
+        lines = []
+        if mention is not None:
+            lines.append(mention)
+        lines.extend(
+            (
+                f"**{failure.source} operational error**",
+                f"Action: {failure.action}",
+                f"Error: {failure.exception_type}: {failure.summary}",
+                f"Occurrences: {failure.occurrences}",
+            )
+        )
+        context = self._format_context(failure)
+        if context is not None:
+            lines.append(f"Context: {context}")
+        allowed_mentions = discord.AllowedMentions(
+            everyone=False,
+            users=[mention_target] if mention_target is not None else False,
+            roles=False,
+            replied_user=False,
+        )
+        payload = trace or f"{failure.exception_type}: {failure.summary}\n"
+        await channel.send(
+            "\n".join(lines),
+            file=discord.File(
+                io.BytesIO(payload.encode("utf-8")),
+                filename=f"nh-error-{failure.fingerprint[:12]}.txt",
+            ),
+            allowed_mentions=allowed_mentions,
+        )
+
+    @staticmethod
+    def _format_context(failure: OperationalFailure) -> str | None:
+        context_channel_id = failure.thread_id or failure.channel_id
+        if context_channel_id is None:
+            return None
+        channel = f"<#{context_channel_id}>"
+        if failure.message_id is None:
+            return channel
+        return (
+            f"{channel} "
+            f"https://discord.com/channels/{failure.guild_id}/"
+            f"{context_channel_id}/{failure.message_id}"
+        )
+
+    async def mark_action_recovered(
+        self,
+        *,
+        guild_id: int,
+        source: str,
+        action: str,
+        correlation_key: str | None = None,
+    ) -> int:
+        try:
+            return await asyncio.to_thread(
+                self._mark_action_recovered_sync,
+                guild_id=guild_id,
+                source=source,
+                action=action,
+                fingerprint=(
+                    self._correlation_fingerprint(
+                        source=source,
+                        action=action,
+                        correlation_key=correlation_key,
+                    )
+                    if correlation_key is not None
+                    else None
+                ),
+                recovered_at=datetime.now(timezone.utc),
+            )
+        except BaseException:
+            _log_report_failure(
+                "Failed to mark operational error recovered for guild %s",
+                guild_id,
+            )
+            return 0
+
+    def _mark_action_recovered_sync(
+        self,
+        *,
+        guild_id: int,
+        source: str,
+        action: str,
+        fingerprint: str | None,
+        recovered_at: datetime,
+    ) -> int:
+        with closing(self._connect()) as connection, connection:
+            if fingerprint is None:
+                cursor = connection.execute(
+                    """UPDATE operational_failures SET recovered_at = ?
+                       WHERE guild_id = ? AND source = ? AND action = ?
+                         AND recovered_at IS NULL""",
+                    (_timestamp(recovered_at), guild_id, source, action),
+                )
+            else:
+                cursor = connection.execute(
+                    """UPDATE operational_failures SET recovered_at = ?
+                       WHERE guild_id = ? AND source = ? AND action = ?
+                         AND fingerprint = ? AND recovered_at IS NULL""",
+                    (
+                        _timestamp(recovered_at),
+                        guild_id,
+                        source,
+                        action,
+                        fingerprint,
+                    ),
+                )
+            return cursor.rowcount
+
+    async def active_count(self, guild_id: int) -> int:
+        try:
+            return await asyncio.to_thread(self._active_count_sync, guild_id)
+        except BaseException:
+            _log_report_failure(
+                "Failed to count operational errors for guild %s",
+                guild_id,
+            )
+            return 0
+
+    def _active_count_sync(self, guild_id: int) -> int:
+        with closing(self._connect()) as connection:
+            row = connection.execute(
+                """SELECT COUNT(*) AS count FROM operational_failures
+                   WHERE guild_id = ? AND recovered_at IS NULL""",
+                (guild_id,),
+            ).fetchone()
+        return int(row["count"]) if row is not None else 0
+
+    async def _delete_guild(self, guild_id: int) -> None:
+        try:
+            await asyncio.to_thread(self._delete_guild_sync, guild_id)
+        except BaseException:
+            _log_report_failure(
+                "Failed to delete operational errors for guild %s",
+                guild_id,
+            )
+
+    def _delete_guild_sync(self, guild_id: int) -> None:
+        with closing(self._connect()) as connection, connection:
+            connection.execute(
+                "DELETE FROM operational_failures WHERE guild_id = ?",
+                (guild_id,),
+            )
+
+    @commands.Cog.listener()
+    async def on_guild_remove(self, guild: discord.Guild) -> None:
+        await self._delete_guild(guild.id)
+        channel_id = await self.config.error_channel()
+        if channel_id is None or guild.get_channel(channel_id) is None:
+            return
+        await self.config.error_channel.clear()
+        await self.config.error_maintainer_id.clear()
+
+    async def red_delete_data_for_user(
+        self,
+        *,
+        requester: str,
+        user_id: int,
+    ) -> None:
+        del requester
+        if await self.config.error_maintainer_id() == user_id:
+            await self.config.error_maintainer_id.clear()
+
+    async def _send_group_overview(
+        self,
+        ctx: commands.Context,
+        *,
+        include_descendants: bool = True,
+    ) -> None:
+        await command_overview.send_group_overview(
+            ctx,
+            lambda: self._send_configuration_overview(ctx),
+            include_descendants=include_descendants,
+            title="NHCogs" if ctx.command.name == "nhcogs" else "Operational errors",
+        )
+
+    async def _send_configuration_overview(self, ctx: commands.Context) -> None:
+        channel_id = await self.config.error_channel()
+        maintainer_id = await self.config.error_maintainer_id()
+        active_failures = await self.active_count(ctx.guild.id)
+        channel = self.bot.get_channel(channel_id) if channel_id is not None else None
+        maintainer = (
+            ctx.guild.get_member(maintainer_id) if maintainer_id is not None else None
+        )
+        channel_label = f"#{channel.name}" if channel is not None else "Not configured"
+        maintainer_label = (
+            f"@{maintainer.display_name}"
+            if maintainer is not None
+            else "Not configured"
+        )
+        embed = discord.Embed(title="Operational error configuration")
+        embed.add_field(name="Channel", value=channel_label, inline=False)
+        embed.add_field(name="Maintainer", value=maintainer_label, inline=False)
+        embed.add_field(name="Active failures", value=str(active_failures), inline=False)
+        await ctx.send(embed=embed, allowed_mentions=discord.AllowedMentions.none())
+
+    @staticmethod
+    def _require_private_channel(ctx: commands.Context) -> None:
+        if not command_overview.channel_is_private(ctx.guild, ctx.channel):
+            raise commands.UserFeedbackCheckFailure(
+                "Run this command in a channel hidden from @everyone"
+            )
+
+    @commands.group(name="nhcogs", invoke_without_command=True)
+    @commands.guild_only()
+    @commands.has_permissions(manage_messages=True)
+    async def nhcogs(self, ctx: commands.Context) -> None:
+        """Configure process-wide NHCogs services."""
+        await self._send_group_overview(ctx, include_descendants=False)
+
+    @nhcogs.group(name="errors", invoke_without_command=True)
+    async def nhcogs_errors(self, ctx: commands.Context) -> None:
+        """Configure private process-wide operational error reporting."""
+        await self._send_group_overview(ctx)
+
+    @nhcogs_errors.group(name="channel", invoke_without_command=True)
+    async def nhcogs_errors_channel(self, ctx: commands.Context) -> None:
+        """Configure the private operational error channel."""
+        await self._send_group_overview(ctx)
+
+    @nhcogs_errors_channel.command(name="set")
+    async def nhcogs_errors_channel_set(
+        self,
+        ctx: commands.Context,
+        channel: discord.TextChannel,
+    ) -> None:
+        """Set the private operational error channel."""
+        self._require_private_channel(ctx)
+        if channel.guild.id != ctx.guild.id:
+            raise commands.UserFeedbackCheckFailure(
+                "The error channel must belong to this server"
+            )
+        if channel.permissions_for(ctx.guild.default_role).view_channel:
+            raise commands.UserFeedbackCheckFailure(
+                "The error channel must be hidden from @everyone"
+            )
+        bot_permissions = channel.permissions_for(ctx.guild.me)
+        if not all(
+            getattr(bot_permissions, permission, False)
+            for permission in ("view_channel", "send_messages", "attach_files")
+        ):
+            raise commands.UserFeedbackCheckFailure(
+                "I need View Channel, Send Messages, and Attach Files there"
+            )
+        await self.config.error_channel.set(channel.id)
+        await ctx.send(
+            f"Operational errors will be sent to #{channel.name}",
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
+
+    @nhcogs_errors_channel.command(name="clear")
+    async def nhcogs_errors_channel_clear(self, ctx: commands.Context) -> None:
+        """Clear the private operational error channel."""
+        self._require_private_channel(ctx)
+        await self.config.error_channel.clear()
+        await ctx.send(
+            "Operational error channel cleared",
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
+
+    @nhcogs_errors.group(name="maintainer", invoke_without_command=True)
+    async def nhcogs_errors_maintainer(self, ctx: commands.Context) -> None:
+        """Configure the maintainer pinged by operational alerts."""
+        await self._send_group_overview(ctx)
+
+    @nhcogs_errors_maintainer.command(name="set")
+    async def nhcogs_errors_maintainer_set(
+        self,
+        ctx: commands.Context,
+        member: discord.Member,
+    ) -> None:
+        """Set the maintainer pinged by operational alerts."""
+        self._require_private_channel(ctx)
+        await self.config.error_maintainer_id.set(member.id)
+        await ctx.send(
+            f"Operational error maintainer set to @{member.display_name}",
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
+
+    @nhcogs_errors_maintainer.command(name="clear")
+    async def nhcogs_errors_maintainer_clear(self, ctx: commands.Context) -> None:
+        """Clear the maintainer pinged by operational alerts."""
+        self._require_private_channel(ctx)
+        await self.config.error_maintainer_id.clear()
+        await ctx.send(
+            "Operational error maintainer cleared",
+            allowed_mentions=discord.AllowedMentions.none(),
+        )
diff --git a/NHCogs/operationalerrors/info.json b/NHCogs/operationalerrors/info.json
new file mode 100644
index 0000000..3e534f7
--- /dev/null
+++ b/NHCogs/operationalerrors/info.json
@@ -0,0 +1,21 @@
+{
+  "author": [
+    "Pxx500"
+  ],
+  "name": "OperationalErrors",
+  "install_msg": "OperationalErrors is loaded automatically by the combined NHCogs extension.",
+  "short": "Report process-wide operational failures to one private channel.",
+  "description": "Persist process-wide operational failures and publish one private alert for each report.",
+  "tags": [
+    "utility",
+    "moderation",
+    "errors"
+  ],
+  "min_bot_version": "3.5.23",
+  "min_python_version": [
+    3,
+    10,
+    0
+  ],
+  "end_user_data_statement": "Operational error records store the guild, source, action, bounded error summary, exception type, occurrence times and count, failure fingerprint, recovery state, and optional Discord location IDs. Tracebacks are sent only to the configured private Discord error channel and are not stored in SQLite."
+}
diff --git a/README.md b/README.md
index 0943ed3..0bde48f 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,8 @@ Red-DiscordBot V3 cogs maintained for the NewHorizons Discord server.
 
 The combined `NHCogs` extension loads the maintained cogs:
 
+- [`OperationalErrors`](NHCogs/operationalerrors/README.md) provides one private
+  process-wide error channel and maintainer.
 - [`Honeypot`](NHCogs/honeypot/README.md) detects and reviews suspicious activity,
   captures moderation evidence, and supports automated containment.
 - [`NHMisc`](NHCogs/nhmisc/README.md) provides voice logging, sticky roles, activity
diff --git a/tests/githubtickets_loader.py b/tests/githubtickets_loader.py
index 63aa641..d18209b 100644
--- a/tests/githubtickets_loader.py
+++ b/tests/githubtickets_loader.py
@@ -12,6 +12,12 @@
     "NHCogs.githubtickets",
     "NHCogs.githubtickets.models",
     "NHCogs.githubtickets.store",
+    "NHCogs.githubtickets.github_app",
+    "NHCogs.githubtickets.credentials",
+    "NHCogs.githubtickets.webhook",
+    "NHCogs.githubtickets.events",
+    "NHCogs.githubtickets.runtime",
+    "NHCogs.githubtickets.event_handler",
     "NHCogs.githubtickets.settings",
     "NHCogs.githubtickets.presentation",
     "NHCogs.githubtickets.routing",
@@ -47,12 +53,18 @@ def isolated_githubtickets_modules(data_path: Path):
             for short_name in (
                 "models",
                 "store",
+                "github_app",
+                "credentials",
+                "webhook",
+                "events",
+                "runtime",
                 "settings",
                 "presentation",
                 "routing",
                 "scheduler",
                 "projection",
                 "coordinator",
+                "event_handler",
                 "ticket_views",
                 "discord_projection",
                 "dashboard",
diff --git a/tests/harness.py b/tests/harness.py
index 1185c04..2f57449 100644
--- a/tests/harness.py
+++ b/tests/harness.py
@@ -21,135 +21,6 @@
 PACKAGE_DIR = Path(__file__).resolve().parents[1] / "NHCogs" / "honeypot"
 _MISSING = object()
 
-EXPECTED_GUILD_DEFAULTS = {
-    "enabled": False,
-    "action": None,
-    "fallback_action": "review",
-    "dry_run": False,
-    "errors_channel": None,
-    "daily_stats_channel": None,
-    "maintainer_id": None,
-    "manual_evidence_channel": None,
-    "manual_punishment_roles": {},
-    "honeypot_channels": [],
-    "mute_role": None,
-    "purge_backward_seconds": 60,
-    "purge_forward_seconds": 10,
-    "whitelisted_roles": [],
-    "firstpost_collect_enabled": False,
-    "firstpost_enabled": False,
-    "firstpost_action": "review",
-    "spam_enabled": False,
-    "spam_action": "review",
-    "spam_window_seconds": 10,
-    "spam_min_channels": 2,
-    "imagescan_detector_enabled": False,
-    "imagescan_detector_action": "review",
-    "imagescan_detector_threshold": 20,
-    "review_enabled": False,
-    "review_channel": None,
-    "review_kick_fail_warning": "false",
-    "automated_kick_fail_warning": False,
-    "whitelist_mode": "bypass",
-    "stats": {
-        "detections": 0,
-        "suspicious": 0,
-        "reviewed": 0,
-        "review_expired": 0,
-        "ignored": 0,
-        "kicked": 0,
-        "banned": 0,
-        "failed_actions": 0,
-        "dry_run_actions": 0,
-        "whitelisted": 0,
-        "pending_mutes": 0,
-        "pending_mute_failures": 0,
-        "purged_messages": 0,
-        "cached_purge_deletes": 0,
-        "forward_purge_deletes": 0,
-        "forward_purge_delete_failures": 0,
-        "evidence_capture_failures": 0,
-        "delete_forbidden": 0,
-        "delete_transient_failures": 0,
-        "firstpost_seen": 0,
-        "firstpost_hits": 0,
-        "firstpost_reviews": 0,
-        "firstpost_kicks": 0,
-        "firstpost_bans": 0,
-        "early_catches": 0,
-        "spam_hits": 0,
-        "spam_reviews": 0,
-        "spam_kicks": 0,
-        "spam_bans": 0,
-        "spam_catches": 0,
-        "honeypot_hits": 0,
-        "honeypot_reviews": 0,
-        "honeypot_kicks": 0,
-        "honeypot_bans": 0,
-        "honeypot_catches": 0,
-        "image_hits": 0,
-        "image_reviews": 0,
-        "image_kicks": 0,
-        "image_bans": 0,
-        "image_catches": 0,
-        "joinwatch_total_joins": 0,
-        "joinwatch_young_joins": 0,
-        "joinwatch_auto_roles_scheduled": 0,
-        "joinwatch_auto_roles": 0,
-        "joinwatch_auto_role_failures": 0,
-        "joinwatch_auto_roles_cleared": 0,
-        "joinwatch_auto_role_punishments": 0,
-    },
-    "scam_keywords": [
-        "free nitro",
-        "giveaway",
-        "steam gift",
-        "free discord",
-        "discord.gift",
-        "claim your",
-        "you won",
-        "free vbucks",
-        "free robux",
-        "free coins",
-        "boost your server",
-        "limited time",
-        "exclusive offer",
-        "free membership",
-        "hack",
-        "crack",
-        "generator",
-    ],
-    "attachment_patterns": ["^image$", "^image ?\\(\\d+\\)$", "^\\d+$"],
-    "gif_detector_enabled": False,
-    "gif_detector_debug_enabled": False,
-    "gif_detector_debug_channel": None,
-    "gif_detector_animation_enabled": True,
-    "gif_detector_channels": [],
-    "gif_detector_secondary_message": "No gifs!",
-    "gif_detector_retention_seconds": 5,
-    "gif_detector_threshold": 3,
-    "gif_detector_window_seconds": 60,
-    "gif_detector_mute_duration_seconds": 3600,
-    "joinwatch_enabled": False,
-    "joinwatch_alert_enabled": True,
-    "joinwatch_channel": None,
-    "joinwatch_min_age_hours": 24,
-    "joinwatch_auto_role_enabled": False,
-    "joinwatch_auto_role_id": None,
-    "joinwatch_auto_role_timer_minutes": 1440,
-    "joinwatch_auto_role_action": "none",
-    "joinwatch_auto_role_random_delay_enabled": False,
-    "joinwatch_auto_role_random_delay_min_minutes": 1,
-    "joinwatch_auto_role_random_delay_max_minutes": 10,
-    "joinwatch_pending_role_assignments": {},
-    "joinwatch_pending_roles": {},
-    "baitrole_enabled": False,
-    "baitrole_channel": None,
-    "baitrole_id": None,
-    "baitrole_action": "ban",
-}
-
-
 def _load_module(name: str, path: Path):
     spec = util.spec_from_file_location(name, path)
     module = util.module_from_spec(spec)
@@ -244,12 +115,30 @@ async def stats(self):
 class _Config:
     def __init__(self):
         self.defaults = {}
+        self.global_defaults = {}
+        self.global_values = {}
         self._guilds = {}
         self._stats = {}
 
     def register_guild(self, **defaults):
         self.defaults = defaults
 
+    def register_global(self, **defaults):
+        self.global_defaults = defaults
+
+    async def all(self):
+        return {**self.global_defaults, **self.global_values}
+
+    async def get_raw(self, key, *, default=None):
+        key = str(key)
+        return self.global_values.get(key, self.global_defaults.get(key, default))
+
+    async def set_raw(self, key, *, value):
+        self.global_values[str(key)] = value
+
+    async def clear_raw(self, key):
+        self.global_values.pop(str(key), None)
+
     def guild(self, guild):
         return self.guild_from_id(guild.id)
 
diff --git a/tests/operations/test_review_publish.py b/tests/operations/test_review_publish.py
index 331113f..ae7fc6d 100644
--- a/tests/operations/test_review_publish.py
+++ b/tests/operations/test_review_publish.py
@@ -4,6 +4,7 @@
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from types import SimpleNamespace
+from unittest import mock
 
 from tests.harness import _Bot, _isolated_honeypot_modules
 
@@ -240,39 +241,6 @@ async def test_configured_review_channel_is_used(self):
                 self.assertIsNone(outcome.result)
                 self.assertEqual(outcome.follow_ups, ())
 
-    async def test_errors_channel_is_not_a_review_publication_fallback(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                handler_module = import_module("NHCogs.honeypot.operations.review_publish")
-                now = datetime.now(timezone.utc)
-                cog = honeypot.Honeypot(_Bot())
-                appended, _operation, _claimed, context = (
-                    self._claim_review_publish(honeypot, cog, now)
-                )
-                self._configure(
-                    cog,
-                    review_channel=None,
-                    extra={"errors_channel": 202},
-                )
-                publications = []
-
-                async def publish_case(*args, **kwargs):
-                    publications.append((args, kwargs))
-
-                cog._publish_detection_case = publish_case
-
-                await handler_module.review_publish_handler(cog, context)
-
-                self.assertEqual(
-                    publications,
-                    [
-                        (
-                            (appended.case.case_id, None),
-                            {"message_sequence": appended.message.sequence},
-                        )
-                    ],
-                )
-
     async def test_guild_unavailable_still_uses_configured_review_channel_id(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
@@ -312,6 +280,7 @@ async def test_publication_exception_identity_reaches_shared_retry_settlement(
                     self._claim_review_publish(honeypot, cog, now)
                 )
                 self._configure(cog)
+                cog._record_operational_failure = mock.AsyncMock()
                 publication_error = RuntimeError("review publication unavailable")
 
                 async def fail_publication(*args, **kwargs):
@@ -332,9 +301,6 @@ async def fail_publication(*args, **kwargs):
                     for item in snapshot.operations
                     if item.operation_id == operation.operation_id
                 )
-                failures = cog._case_store.list_operational_failures(
-                    appended.case.guild_id
-                )
                 self.assertIs(failed.status, honeypot.OperationStatus.FAILED)
                 self.assertIsNone(failed.result)
                 self.assertEqual(
@@ -342,10 +308,13 @@ async def fail_publication(*args, **kwargs):
                     timedelta(seconds=10),
                 )
                 self.assertIn("review publication unavailable", failed.last_error)
-                self.assertEqual(len(failures), 1)
-                self.assertEqual(failures[0].operation_id, operation.operation_id)
+                cog._record_operational_failure.assert_awaited_once()
+                self.assertEqual(
+                    cog._record_operational_failure.await_args.kwargs["operation_id"],
+                    operation.operation_id,
+                )
 
-    async def test_first_attempt_resolves_failure_without_recovery_alert_or_follow_up(
+    async def test_first_attempt_marks_matching_shared_failure_recovered_without_follow_up(
         self,
     ):
         with TemporaryDirectory() as directory:
@@ -357,22 +326,10 @@ async def test_first_attempt_resolves_failure_without_recovery_alert_or_follow_u
                     self._claim_review_publish(honeypot, cog, now)
                 )
                 self._configure(cog)
-                cog._case_store.record_operational_failure(
-                    guild_id=appended.case.guild_id,
-                    source=honeypot.OperationType.REVIEW_PUBLISH,
-                    summary="previous publication failure",
-                    occurred_at=now,
-                    case_id=appended.case.case_id,
-                    operation_id=operation.operation_id,
-                )
                 publications = []
-                recovery_alerts = []
-
-                async def send_recovery_alert(guild_id, message):
-                    recovery_alerts.append((guild_id, message))
 
                 cog._publish_detection_case = self._record_publications(publications)
-                cog._send_operational_alert = send_recovery_alert
+                honeypot.detection.mark_operational_error_recovered = mock.AsyncMock()
 
                 await cog._execute_detection_case_operation(claimed, now)
 
@@ -382,21 +339,17 @@ async def send_recovery_alert(guild_id, message):
                     for item in snapshot.operations
                     if item.operation_id == operation.operation_id
                 )
-                unresolved = cog._case_store.list_operational_failures(
-                    appended.case.guild_id
-                )
-                failures = cog._case_store.list_operational_failures(
-                    appended.case.guild_id,
-                    include_resolved=True,
-                )
                 policy = operations.executor_operation_policy(
                     honeypot.OperationType.REVIEW_PUBLISH
                 )
                 self.assertEqual(len(publications), 1)
                 self.assertIs(completed.status, honeypot.OperationStatus.SUCCEEDED)
                 self.assertIsNone(completed.result)
-                self.assertEqual(unresolved, ())
-                self.assertEqual(len(failures), 1)
-                self.assertIsNotNone(failures[0].resolved_at)
-                self.assertEqual(recovery_alerts, [])
+                honeypot.detection.mark_operational_error_recovered.assert_awaited_once_with(
+                    cog.bot,
+                    guild_id=appended.case.guild_id,
+                    source="Honeypot",
+                    action="review_publish",
+                    correlation_key=operation.operation_id,
+                )
                 self.assertEqual(policy.follow_ups, ())
diff --git a/tests/test_achievement_commands.py b/tests/test_achievement_commands.py
index b814fb2..9a500b4 100644
--- a/tests/test_achievement_commands.py
+++ b/tests/test_achievement_commands.py
@@ -305,10 +305,16 @@ async def test_achievement_interactions_do_not_emit_routine_info_logs(self):
             list_definitions=mock.AsyncMock(return_value=()),
         )
         cog._build_achievements_embed = mock.Mock(return_value=object())
+        cog._respond_with_achievement_profile = mock.AsyncMock()
 
         with mock.patch.object(nhmisc.log, "info") as info:
             await cog._achievements_slash(interaction, target)
 
+        cog._respond_with_achievement_profile.assert_awaited_once_with(
+            interaction,
+            target,
+            command_mention="`/achievements`",
+        )
         info.assert_not_called()
 
     async def test_achievements_user_action_defers_before_waiting_for_store(self):
diff --git a/tests/test_case_lifecycle.py b/tests/test_case_lifecycle.py
index b610bbb..1594e27 100644
--- a/tests/test_case_lifecycle.py
+++ b/tests/test_case_lifecycle.py
@@ -6,7 +6,6 @@
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from tempfile import TemporaryDirectory
-from types import SimpleNamespace
 from unittest import mock
 
 from tests.detection_case_fixtures import capture_attachment, publish_primary
@@ -264,60 +263,6 @@ async def test_unknown_persisted_operation_fails_without_escaping_worker(self):
                     "\n".join(operation_logs.output),
                 )
 
-    async def test_recovered_operation_alert_uses_persisted_value(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                now = datetime.now(timezone.utc)
-                channel = SimpleNamespace(send=mock.AsyncMock())
-                guild = SimpleNamespace(
-                    id=10,
-                    get_channel=lambda channel_id: channel,
-                )
-                bot = _Bot()
-                bot.get_guild = lambda guild_id: guild
-                cog = honeypot.Honeypot(bot)
-                cog.config = self._config({"errors_channel": 30})
-                honeypot.discord.AllowedMentions = SimpleNamespace(none=lambda: None)
-                appended = self._append_case(honeypot, cog, now)
-                operation = cog._case_store.ensure_operation(
-                    appended.case.case_id,
-                    honeypot.OperationType.EVIDENCE_CLEANUP,
-                    f"evidence-cleanup:{appended.case.case_id}",
-                )
-                first = cog._case_store.claim_operation(operation.operation_id, now)
-                self.assertTrue(
-                    cog._case_store.fail_operation(
-                        first.operation_id,
-                        first.claim_token,
-                        "temporary",
-                        now,
-                        now,
-                    )
-                )
-                cog._case_store.record_operational_failure(
-                    guild_id=10,
-                    source=honeypot.OperationType.EVIDENCE_CLEANUP,
-                    summary="temporary",
-                    occurred_at=now,
-                    case_id=appended.case.case_id,
-                    operation_id=operation.operation_id,
-                )
-                retried = cog._case_store.claim_operation(
-                    operation.operation_id,
-                    now + timedelta(seconds=1),
-                )
-
-                await cog._execute_detection_case_operation(
-                    retried,
-                    now + timedelta(seconds=1),
-                )
-
-                channel.send.assert_awaited_once()
-                self.assertEqual(
-                    channel.send.await_args.args[0],
-                    "✅ Recovered: evidence_cleanup succeeded after 2 attempts.",
-                )
-
     async def test_terminal_capture_failure_is_a_current_case_note(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
diff --git a/tests/test_cog_assembly.py b/tests/test_cog_assembly.py
index 36b3f3f..d68db7b 100644
--- a/tests/test_cog_assembly.py
+++ b/tests/test_cog_assembly.py
@@ -1,17 +1,11 @@
 """Assembly and contract guards for the Honeypot cog.
 
-These do not exercise the detection pipeline: they pin the shape of the cog as
-it is assembled - the command, listener and loop inventory against
-tests/honeypot_command_contract.json, the README divergence that contract
-records, the Phase 5 domain-shell delegation, and the runtime help and
-info.json metadata.
+These do not exercise the detection pipeline. They cover runtime command,
+listener, and loop assembly plus help and info.json metadata.
 """
 
-import ast
 import json
-import re
 import unittest
-from hashlib import sha256
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from types import SimpleNamespace
@@ -74,7 +68,6 @@ def test_channel_configuration_exposes_central_semantic_categories(self):
         self.assertNotIn("honeypot channel logs", command_names)
         for category in (
             "review",
-            "errors",
             "manual-evidence",
             "joinwatch",
             "bait-role",
@@ -127,32 +120,6 @@ def test_command_listener_and_loop_assembly_matches_contract(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
                 registered = getattr(honeypot.Honeypot, "__cog_commands__", ())
-                self.assertEqual(len(registered), contract["command_count"])
-                structure = sorted(
-                    (
-                        {
-                            "kind": command.kind,
-                            "name": command.qualified_name,
-                            "parent": (
-                                command.parent.qualified_name
-                                if command.parent is not None
-                                else None
-                            ),
-                        }
-                        for command in registered
-                    ),
-                    key=lambda item: item["name"],
-                )
-                encoded = json.dumps(
-                    structure,
-                    sort_keys=True,
-                    separators=(",", ":"),
-                ).encode()
-
-                self.assertEqual(
-                    sha256(encoded).hexdigest(),
-                    contract["command_structure_sha256"],
-                )
                 self.assertEqual(
                     sorted(honeypot.Honeypot.__cog_listeners__),
                     contract["listeners"],
@@ -175,196 +142,3 @@ def test_command_listener_and_loop_assembly_matches_contract(self):
                             isinstance(command, honeypot.commands.Group),
                             command.kind == "group",
                         )
-
-    def test_readme_command_divergence_matches_the_contract(self):
-        """Phase 5 rail 2, as an assertion rather than a claim in the ledger.
-
-        The plan wanted `inventory - allowlist == readme_rows`. That is not
-        reachable: the README documents whole sections under command paths that
-        do not exist (`honeypot core ...` for the `honeypot honeypot ...` group,
-        `honeypot bait ...` for `bait_role`), and several real commands have no
-        row at all. Both sets are therefore frozen exactly, so a split that
-        loses a command, or a README edit, has to face this test.
-        """
-        contract = json.loads(
-            (Path(__file__).with_name("honeypot_command_contract.json")).read_text(
-                encoding="utf-8"
-            )
-        )
-        expected = contract["readme"]
-        readme_row = re.compile(r"^\|\s*`([^`]+)`\s*\|")
-        rows = set()
-        readme_path = PACKAGE_DIR / "README.md"
-        for line in readme_path.read_text(encoding="utf-8").splitlines():
-            match = readme_row.match(line)
-            if match is None:
-                continue
-            command = match.group(1).strip()
-            if command.startswith("!"):
-                command = command[1:]
-            elif command.startswith("[p]"):
-                command = command[3:]
-            else:
-                continue
-            tokens = []
-            for token in command.split():
-                if token.startswith(("<", "[")):
-                    break
-                tokens.append(token)
-            rows.add(" ".join(tokens))
-
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                leaves = {
-                    command.qualified_name
-                    for command in honeypot.Honeypot.__cog_commands__
-                    if command.kind == "command"
-                }
-
-        self.assertEqual(len(rows), expected["row_count"])
-        self.assertEqual(len(leaves), expected["leaf_count"])
-        self.assertEqual(
-            sorted(leaves - rows),
-            expected["undocumented_commands"],
-            "a command gained or lost its README row; fix the README or update "
-            "the contract in the same commit",
-        )
-        self.assertEqual(
-            sorted(rows - leaves),
-            expected["rows_without_command"],
-            "the README documents a command path that does not exist, or a "
-            "documented command disappeared from the cog",
-        )
-        self.assertLessEqual(
-            set(contract["intentionally_undocumented_debug_commands"]),
-            leaves - rows,
-            "the debug allow-list must stay a subset of the undocumented set",
-        )
-
-    def test_domain_shells_delegate_to_a_matching_twin(self):
-        """Structural guard for the Phase 5 fallback across every domain module.
-
-        A shell that delegates to the wrong twin - `imagescan_remove` calling
-        `imagescan.imagescan_add` - renders no test failure for the commands the
-        suite does not drive. Counts are exact so a lost delegation fails too;
-        a new split row updates them deliberately.
-        """
-        expected_counts = {
-            "channel_routing": 23,
-            "detection": 73,
-            "diagnostics": 12,
-            "gif_detector": 9,
-            "imagescan": 21,
-            "joinwatch": 3,
-            "joinwatch_commands": 12,
-            "review_publication": 13,
-        }
-        tree = ast.parse((PACKAGE_DIR / "honeypot.py").read_text(encoding="utf-8"))
-        cog_class = next(
-            node
-            for node in tree.body
-            if isinstance(node, ast.ClassDef) and node.name == "Honeypot"
-        )
-        # A seam can also be re-exported as `name = staticmethod(module.name)`.
-        # That is an Assign, invisible to the delegation scan, so it is counted
-        # and name-checked separately rather than silently escaping the guard.
-        expected_static_reexports = {"detection": 4, "review_publication": 2}
-        static_reexports = {}
-        delegations = {}
-        for node in cog_class.body:
-            if isinstance(node, ast.Assign) and isinstance(node.value, ast.Call):
-                call = node.value
-                is_staticmethod = (
-                    isinstance(call.func, ast.Name)
-                    and call.func.id == "staticmethod"
-                    and len(call.args) == 1
-                    and isinstance(call.args[0], ast.Attribute)
-                    and isinstance(call.args[0].value, ast.Name)
-                )
-                if is_staticmethod and len(node.targets) == 1:
-                    target = node.targets[0]
-                    owner = call.args[0].value.id
-                    if isinstance(target, ast.Name) and owner in expected_counts:
-                        static_reexports.setdefault(owner, []).append(
-                            (target.id, call.args[0].attr)
-                        )
-                continue
-            if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
-                continue
-            body = [
-                statement
-                for statement in node.body
-                if not (
-                    isinstance(statement, ast.Expr)
-                    and isinstance(statement.value, ast.Constant)
-                )
-            ]
-            if len(body) != 1 or not isinstance(body[0], ast.Return):
-                continue
-            call = body[0].value
-            if isinstance(call, ast.Await):
-                call = call.value
-            if not isinstance(call, ast.Call) or not isinstance(call.func, ast.Attribute):
-                continue
-            owner = call.func.value
-            if not isinstance(owner, ast.Name) or owner.id not in expected_counts:
-                continue
-            delegations.setdefault(owner.id, []).append(
-                (node.name, call.func.attr, call.args[0] if call.args else None)
-            )
-
-        self.assertEqual(
-            {name: len(items) for name, items in sorted(delegations.items())},
-            expected_counts,
-        )
-        self.assertEqual(
-            {name: len(items) for name, items in sorted(static_reexports.items())},
-            expected_static_reexports,
-        )
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                for module_name, items in sorted(static_reexports.items()):
-                    module = getattr(honeypot, module_name, None)
-                    self.assertIsNotNone(module, f"{module_name} is not importable")
-                    for attribute_name, target_name in items:
-                        with self.subTest(reexport=f"{module_name}.{attribute_name}"):
-                            self.assertEqual(
-                                target_name,
-                                attribute_name,
-                                "re-export points at a differently named twin",
-                            )
-                            self.assertIs(
-                                getattr(honeypot.Honeypot, attribute_name),
-                                getattr(module, target_name),
-                            )
-                for module_name, items in sorted(delegations.items()):
-                    module = getattr(honeypot, module_name, None)
-                    self.assertIsNotNone(module, f"{module_name} is not importable")
-                    for method_name, target_name, first_argument in items:
-                        with self.subTest(shell=f"{module_name}.{method_name}"):
-                            if module_name == "channel_routing":
-                                self.assertIn(
-                                    target_name,
-                                    {
-                                        "add_multiple",
-                                        "configure_single",
-                                        "list_multiple",
-                                        "remove_multiple",
-                                        "send_overview",
-                                    },
-                                )
-                            else:
-                                self.assertEqual(
-                                    target_name,
-                                    method_name,
-                                    "shell delegates to a differently named twin",
-                                )
-                            self.assertTrue(
-                                isinstance(first_argument, ast.Name)
-                                and first_argument.id == "self",
-                                "delegation must pass the cog as its first argument",
-                            )
-                            self.assertTrue(
-                                callable(getattr(module, target_name, None)),
-                                f"{module_name}.{target_name} is missing",
-                            )
diff --git a/tests/test_console_dump.py b/tests/test_console_dump.py
index 510d239..19ea8b5 100644
--- a/tests/test_console_dump.py
+++ b/tests/test_console_dump.py
@@ -108,6 +108,21 @@ def test_redaction_covers_webhooks_query_secrets_and_discord_tokens(self):
         self.assertNotIn(discord_token, redacted)
         self.assertGreaterEqual(redacted.count("[REDACTED]"), 3)
 
+    def test_redaction_removes_github_app_secrets_and_private_key_blocks(self):
+        original = (
+            "webhook_secret=hook-value private_key=inline-value\n"
+            "-----BEGIN PRIVATE KEY-----\n"
+            "private-key-material\n"
+            "-----END PRIVATE KEY-----"
+        )
+
+        redacted = console_dump.redact_log_text(original)
+
+        self.assertNotIn("hook-value", redacted)
+        self.assertNotIn("inline-value", redacted)
+        self.assertNotIn("private-key-material", redacted)
+        self.assertNotIn("BEGIN PRIVATE KEY", redacted)
+
     def test_redaction_removes_complete_plain_and_structured_authorization_values(self):
         original = (
             "Authorization: Basic dXNlcjpwYXNz\n"
diff --git a/tests/test_custom_commands_cog.py b/tests/test_custom_commands_cog.py
index 7b7f3d7..937f11a 100644
--- a/tests/test_custom_commands_cog.py
+++ b/tests/test_custom_commands_cog.py
@@ -44,7 +44,11 @@ def decorator(target):
 
 
 def load_cog_module():  # noqa: PLR0915
-    package_name = "custom_commands_cog_subject"
+    root_name = "custom_commands_cog_subject"
+    root = types.ModuleType(root_name)
+    root.__path__ = [str(PACKAGE_PATH.parent)]
+    sys.modules[root_name] = root
+    package_name = f"{root_name}.custom_commands"
     package = types.ModuleType(package_name)
     package.__path__ = [str(PACKAGE_PATH)]
     sys.modules[package_name] = package
@@ -259,11 +263,20 @@ def humanize_list(values):
 cog, migration_controller = load_cog_module()
 
 
+def _reporting_bot(**values):
+    report = mock.AsyncMock()
+    reporter = types.SimpleNamespace(report=report)
+    return types.SimpleNamespace(
+        get_cog=mock.Mock(return_value=reporter),
+        **values,
+    ), report
+
+
 class CustomCommandsStartupTests(unittest.IsolatedAsyncioTestCase):
     async def test_startup_reports_catalog_initialization_failure(self):
         failure = OSError("database is unavailable")
-        bot = types.SimpleNamespace(guilds=[types.SimpleNamespace(id=100)])
-        nhmisc = types.SimpleNamespace(report_operational_error=mock.AsyncMock())
+        bot, report = _reporting_bot(guilds=[types.SimpleNamespace(id=100)])
+        nhmisc = types.SimpleNamespace()
         catalog = types.SimpleNamespace(
             initialize=mock.AsyncMock(side_effect=failure)
         )
@@ -276,16 +289,20 @@ async def test_startup_reports_catalog_initialization_failure(self):
             with self.assertRaisesRegex(OSError, "database is unavailable"):
                 await migration_controller.build_custom_commands_component(bot, nhmisc)
 
-        nhmisc.report_operational_error.assert_awaited_once_with(
+        report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="activate replacement startup",
             error=failure,
+            channel_id=None,
+            thread_id=None,
+            message_id=None,
+            correlation_key=None,
         )
 
     async def test_startup_activates_replacement_without_reading_migration_state(self):
-        bot = types.SimpleNamespace(guilds=[types.SimpleNamespace(id=100)])
-        nhmisc = types.SimpleNamespace(report_operational_error=mock.AsyncMock())
+        bot, report = _reporting_bot(guilds=[types.SimpleNamespace(id=100)])
+        nhmisc = types.SimpleNamespace()
         catalog = types.SimpleNamespace(initialize=mock.AsyncMock())
         runtime = object()
         activator = types.SimpleNamespace(activate=mock.AsyncMock(return_value=runtime))
@@ -316,12 +333,12 @@ async def test_startup_activates_replacement_without_reading_migration_state(sel
         self.assertIs(result, runtime)
         catalog.initialize.assert_awaited_once()
         activator.activate.assert_awaited_once()
-        nhmisc.report_operational_error.assert_not_awaited()
+        report.assert_not_awaited()
 
     async def test_startup_reports_activation_failure_and_never_returns_migrator(self):
         failure = RuntimeError("replacement registration failed")
-        bot = types.SimpleNamespace(guilds=[types.SimpleNamespace(id=100)])
-        nhmisc = types.SimpleNamespace(report_operational_error=mock.AsyncMock())
+        bot, report = _reporting_bot(guilds=[types.SimpleNamespace(id=100)])
+        nhmisc = types.SimpleNamespace()
         catalog = types.SimpleNamespace(initialize=mock.AsyncMock())
         activator = types.SimpleNamespace(
             activate=mock.AsyncMock(side_effect=failure)
@@ -346,11 +363,15 @@ async def test_startup_reports_activation_failure_and_never_returns_migrator(sel
             ):
                 await migration_controller.build_custom_commands_component(bot, nhmisc)
 
-        nhmisc.report_operational_error.assert_awaited_once_with(
+        report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="activate replacement startup",
             error=failure,
+            channel_id=None,
+            thread_id=None,
+            message_id=None,
+            correlation_key=None,
         )
 
 
@@ -584,9 +605,7 @@ async def test_listener_reports_only_unexpected_errors_from_this_cog(self):
         self.assertIsNotNone(listener)
 
         subject = object.__new__(cog.CustomCommands)
-        subject.nhmisc = types.SimpleNamespace(
-            report_operational_error=mock.AsyncMock()
-        )
+        subject.bot, report = _reporting_bot()
         command = types.SimpleNamespace(qualified_name="customcom raw")
         ctx = types.SimpleNamespace(
             cog=subject,
@@ -601,26 +620,28 @@ async def test_listener_reports_only_unexpected_errors_from_this_cog(self):
             ctx,
             cog.commands.UserFeedbackCheckFailure("expected"),
         )
-        subject.nhmisc.report_operational_error.assert_not_awaited()
+        report.assert_not_awaited()
 
         await listener(subject, ctx, cog.commands.UserInputError("invalid input"))
-        subject.nhmisc.report_operational_error.assert_not_awaited()
+        report.assert_not_awaited()
 
         failure = RuntimeError("paginator failed")
         await listener(subject, ctx, types.SimpleNamespace(original=failure))
-        subject.nhmisc.report_operational_error.assert_awaited_once_with(
+        report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="customcom raw",
             error=failure,
             channel_id=200,
+            thread_id=None,
             message_id=300,
+            correlation_key=None,
         )
 
-        subject.nhmisc.report_operational_error.reset_mock()
+        report.reset_mock()
         ctx.cog = object()
         await listener(subject, ctx, failure)
-        subject.nhmisc.report_operational_error.assert_not_awaited()
+        report.assert_not_awaited()
 
 
 class CustomCommandsCopyTests(unittest.IsolatedAsyncioTestCase):
@@ -889,12 +910,9 @@ async def test_list_keeps_escaped_long_entries_within_embed_limits(self):
 class CustomCommandsMessageListenerTests(unittest.IsolatedAsyncioTestCase):
     def _subject(self):
         subject = object.__new__(cog.CustomCommands)
-        subject.bot = types.SimpleNamespace(
+        subject.bot, subject.report = _reporting_bot(
             cog_disabled_in_guild=mock.AsyncMock(return_value=False)
         )
-        subject.nhmisc = types.SimpleNamespace(
-            report_operational_error=mock.AsyncMock()
-        )
         subject.workflows = types.SimpleNamespace(
             on_message=mock.AsyncMock(return_value=False)
         )
@@ -918,7 +936,7 @@ async def test_listener_reports_unexpected_workflow_dispatch_failure(self):
         await subject.on_message_without_command(message)
 
         subject.runtime.handle_message.assert_not_awaited()
-        subject.nhmisc.report_operational_error.assert_awaited_once_with(
+        subject.report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="process custom command message",
@@ -926,6 +944,7 @@ async def test_listener_reports_unexpected_workflow_dispatch_failure(self):
             channel_id=200,
             thread_id=200,
             message_id=300,
+            correlation_key=None,
         )
 
     async def test_listener_reports_unexpected_runtime_dispatch_failure(self):
@@ -936,7 +955,7 @@ async def test_listener_reports_unexpected_runtime_dispatch_failure(self):
 
         await subject.on_message_without_command(message)
 
-        subject.nhmisc.report_operational_error.assert_awaited_once_with(
+        subject.report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="process custom command message",
@@ -944,6 +963,7 @@ async def test_listener_reports_unexpected_runtime_dispatch_failure(self):
             channel_id=200,
             thread_id=200,
             message_id=300,
+            correlation_key=None,
         )
 
 
@@ -1004,9 +1024,7 @@ async def test_raw_uses_an_invoker_owned_button_view_and_exact_code_block(self):
 
     async def test_raw_timeout_reports_a_failed_message_edit(self):
         subject = object.__new__(cog.CustomCommands)
-        subject.nhmisc = types.SimpleNamespace(
-            report_operational_error=mock.AsyncMock()
-        )
+        subject.bot, report = _reporting_bot()
         view = cog.RawResponseView(
             subject,
             requester_id=200,
@@ -1022,20 +1040,20 @@ async def test_raw_timeout_reports_a_failed_message_edit(self):
 
         await view.on_timeout()
 
-        subject.nhmisc.report_operational_error.assert_awaited_once_with(
+        report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="expire raw custom command response browser",
             error=failure,
             channel_id=200,
+            thread_id=None,
             message_id=300,
+            correlation_key=None,
         )
 
     async def test_raw_pagination_error_is_reported_to_the_user(self):
         subject = object.__new__(cog.CustomCommands)
-        subject.nhmisc = types.SimpleNamespace(
-            report_operational_error=mock.AsyncMock()
-        )
+        subject.bot, _report = _reporting_bot()
         view = cog.RawResponseView(
             subject,
             requester_id=200,
@@ -1140,9 +1158,7 @@ async def test_cancelled_and_timed_out_delete_prompts_remove_controls(self):
 class CustomCommandsDeleteTimeoutTests(unittest.IsolatedAsyncioTestCase):
     async def test_delete_timeout_reports_a_failed_message_edit(self):
         subject = object.__new__(cog.CustomCommands)
-        subject.nhmisc = types.SimpleNamespace(
-            report_operational_error=mock.AsyncMock()
-        )
+        subject.bot, report = _reporting_bot()
         command = types.SimpleNamespace(name="ben")
         view = cog.DeleteConfirmationView(subject, command=command, opener_id=200)
         failure = RuntimeError("message edit failed")
@@ -1155,13 +1171,15 @@ async def test_delete_timeout_reports_a_failed_message_edit(self):
 
         await view.on_timeout()
 
-        subject.nhmisc.report_operational_error.assert_awaited_once_with(
+        report.assert_awaited_once_with(
             guild_id=100,
             source="CustomCommands",
             action="expire custom command delete prompt",
             error=failure,
             channel_id=200,
+            thread_id=None,
             message_id=300,
+            correlation_key=None,
         )
 
 
diff --git a/tests/test_custom_commands_runtime.py b/tests/test_custom_commands_runtime.py
index 6e47967..f58e78f 100644
--- a/tests/test_custom_commands_runtime.py
+++ b/tests/test_custom_commands_runtime.py
@@ -14,7 +14,11 @@
 
 
 def load_runtime_modules():
-    package_name = "custom_commands_runtime_subject"
+    root_name = "custom_commands_runtime_subject"
+    root = types.ModuleType(root_name)
+    root.__path__ = [str(PACKAGE_PATH.parent)]
+    sys.modules[root_name] = root
+    package_name = f"{root_name}.custom_commands"
     package = types.ModuleType(package_name)
     package.__path__ = [str(PACKAGE_PATH)]
     sys.modules[package_name] = package
@@ -144,7 +148,6 @@ class CustomCommandRuntimeTests(unittest.TestCase):
     def test_cooldown_feedback_uses_concise_singular_and_plural_copy(self):
         async def run():
             engine = runtime.CustomCommandRuntime(
-                object(),
                 object(),
                 object(),
                 logger=mock.Mock(),
@@ -261,7 +264,6 @@ def test_cooldown_scopes_are_evaluated_before_any_deadline_changes(self):
             author=SimpleNamespace(id=300),
         )
         engine = runtime.CustomCommandRuntime(
-            object(),
             object(),
             object(),
             logger=mock.Mock(),
@@ -337,11 +339,9 @@ async def test_runtime_invocation_preserves_public_mention_content(self):
             get_context=mock.AsyncMock(return_value=ctx),
             invoke=mock.AsyncMock(),
         )
-        reporter = SimpleNamespace(report=mock.AsyncMock())
         engine = runtime.CustomCommandRuntime(
             bot,
             store,
-            reporter,
             random_index=lambda _total: 0,
             logger=mock.Mock(),
         )
@@ -358,7 +358,6 @@ async def test_runtime_invocation_preserves_public_mention_content(self):
 
         bot.invoke.assert_awaited_once_with(ctx)
         ctx.send.assert_awaited_once_with("Hello <@123>")
-        reporter.report.assert_not_awaited()
 
     async def test_repeated_command_is_silent_until_five_seconds_have_elapsed(self):
         first_ctx, first_message = self.invocation_context(author_id=300)
@@ -370,11 +369,9 @@ async def test_repeated_command_is_silent_until_five_seconds_have_elapsed(self):
             ),
             invoke=mock.AsyncMock(),
         )
-        reporter = SimpleNamespace(report=mock.AsyncMock())
         engine = runtime.CustomCommandRuntime(
             bot,
             SimpleNamespace(get=mock.AsyncMock(return_value=command)),
-            reporter,
             random_index=lambda _total: 0,
             logger=mock.Mock(),
         )
@@ -391,7 +388,6 @@ async def test_repeated_command_is_silent_until_five_seconds_have_elapsed(self):
         self.assertEqual(bot.invoke.await_count, 2)
         first_ctx.send.assert_awaited_once_with("response 0")
         second_ctx.send.assert_awaited_once_with("response 0")
-        reporter.report.assert_not_awaited()
 
     async def test_rejected_member_cooldown_does_not_reserve_the_channel(self):
         first_ctx, first_message = self.invocation_context(author_id=300)
@@ -407,11 +403,9 @@ async def test_rejected_member_cooldown_does_not_reserve_the_channel(self):
             ),
             invoke=mock.AsyncMock(),
         )
-        reporter = SimpleNamespace(report=mock.AsyncMock())
         engine = runtime.CustomCommandRuntime(
             bot,
             SimpleNamespace(get=mock.AsyncMock(return_value=command)),
-            reporter,
             random_index=lambda _total: 0,
             logger=mock.Mock(),
         )
@@ -429,7 +423,6 @@ async def test_rejected_member_cooldown_does_not_reserve_the_channel(self):
         first_ctx.send.assert_awaited_once_with("response 0")
         blocked_ctx.send.assert_awaited_once_with("Try again in 54 seconds")
         other_ctx.send.assert_awaited_once_with("response 0")
-        reporter.report.assert_not_awaited()
 
     async def test_invocation_cooldown_is_scoped_to_command_and_channel(self):
         first_ctx, first_message = self.invocation_context()
@@ -449,7 +442,6 @@ async def test_invocation_cooldown_is_scoped_to_command_and_channel(self):
             ),
             invoke=mock.AsyncMock(),
         )
-        reporter = SimpleNamespace(report=mock.AsyncMock())
         engine = runtime.CustomCommandRuntime(
             bot,
             SimpleNamespace(
@@ -461,7 +453,6 @@ async def test_invocation_cooldown_is_scoped_to_command_and_channel(self):
                     )
                 )
             ),
-            reporter,
             random_index=lambda _total: 0,
             logger=mock.Mock(),
         )
@@ -475,7 +466,6 @@ async def test_invocation_cooldown_is_scoped_to_command_and_channel(self):
         first_ctx.send.assert_awaited_once_with("response 0")
         other_channel_ctx.send.assert_awaited_once_with("response 0")
         other_command_ctx.send.assert_awaited_once_with("response 0")
-        reporter.report.assert_not_awaited()
 
     async def test_uppercase_invocation_does_not_match_lowercase_custom_command(self):
         store = SimpleNamespace(get=mock.AsyncMock())
@@ -484,7 +474,6 @@ async def test_uppercase_invocation_does_not_match_lowercase_custom_command(self
         engine = runtime.CustomCommandRuntime(
             bot,
             store,
-            SimpleNamespace(report=mock.AsyncMock()),
             logger=mock.Mock(),
         )
         message = SimpleNamespace(
@@ -502,10 +491,13 @@ async def test_catalog_read_failure_is_reported_privately(self):
         ctx, message = self.invocation_context()
         store = SimpleNamespace(get=mock.AsyncMock(side_effect=OSError("sqlite failed")))
         reporter = SimpleNamespace(report=mock.AsyncMock())
+        bot = SimpleNamespace(
+            get_context=mock.AsyncMock(return_value=ctx),
+            get_cog=mock.Mock(return_value=reporter),
+        )
         engine = runtime.CustomCommandRuntime(
-            SimpleNamespace(get_context=mock.AsyncMock(return_value=ctx)),
+            bot,
             store,
-            reporter,
             logger=mock.Mock(),
         )
 
@@ -532,11 +524,11 @@ async def test_render_failure_is_reported_privately(self):
         bot = SimpleNamespace(
             get_context=mock.AsyncMock(return_value=ctx),
             invoke=mock.AsyncMock(),
+            get_cog=mock.Mock(return_value=reporter),
         )
         engine = runtime.CustomCommandRuntime(
             bot,
             SimpleNamespace(get=mock.AsyncMock(return_value=command)),
-            reporter,
             random_index=lambda _total: 0,
             logger=mock.Mock(),
         )
diff --git a/tests/test_custom_commands_workflows.py b/tests/test_custom_commands_workflows.py
index ff3071a..3b74ce3 100644
--- a/tests/test_custom_commands_workflows.py
+++ b/tests/test_custom_commands_workflows.py
@@ -12,7 +12,11 @@
 
 
 def load_workflow_modules():
-    package_name = "custom_commands_workflow_subject"
+    root_name = "custom_commands_workflow_subject"
+    root = types.ModuleType(root_name)
+    root.__path__ = [str(PACKAGE_PATH.parent)]
+    sys.modules[root_name] = root
+    package_name = f"{root_name}.custom_commands"
     package = types.ModuleType(package_name)
     package.__path__ = [str(PACKAGE_PATH)]
     sys.modules[package_name] = package
@@ -742,10 +746,10 @@ async def test_save_uses_one_catalog_operation_and_closes_thread(self):
         self.assertTrue(session.finished)
 
     async def test_dashboard_send_failure_archives_thread_without_registering_session(self):
-        reporter = SimpleNamespace(report=mock.AsyncMock())
         manager = workflows.WorkflowManager(
             SimpleNamespace(),
-            SimpleNamespace(operational_errors=reporter),
+            SimpleNamespace(),
+            SimpleNamespace(),
             logger=mock.Mock(),
         )
         thread = SimpleNamespace(
diff --git a/tests/test_daily_stats.py b/tests/test_daily_stats.py
index 2c94423..059e161 100644
--- a/tests/test_daily_stats.py
+++ b/tests/test_daily_stats.py
@@ -166,6 +166,7 @@ def guild_config(guild):
                     failing_guild.id,
                     "daily_stats_publish",
                     mock.ANY,
+                    error=mock.ANY,
                 )
                 snapshot = store.get_daily_stats(
                     working_guild.id,
@@ -237,6 +238,7 @@ async def test_missing_configured_channel_records_operational_failure(self):
                     guild.id,
                     "daily_stats_publish",
                     mock.ANY,
+                    error=mock.ANY,
                 )
 
 
diff --git a/tests/test_detection_admission.py b/tests/test_detection_admission.py
index d08b30c..e43d179 100644
--- a/tests/test_detection_admission.py
+++ b/tests/test_detection_admission.py
@@ -5,6 +5,7 @@
 import asyncio
 import logging
 from datetime import datetime, timedelta, timezone
+from importlib import import_module
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from types import SimpleNamespace
@@ -72,6 +73,45 @@ async def test_registry_observation_failure_does_not_stop_detection(self):
                 cog._collect_detection_signals.assert_awaited_once()
                 cog._record_operational_failure.assert_awaited_once()
 
+    async def test_registry_failure_reports_original_exception_and_traceback(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_honeypot_modules(Path(directory)) as honeypot:
+                cog = honeypot.Honeypot(_Bot())
+                message = self._message(honeypot, attachment_count=0)
+                self._configure_public_boundary(cog, {"enabled": True})
+                original_error = RuntimeError("registry unavailable")
+                cog._observe_message = mock.AsyncMock(side_effect=original_error)
+                cog._collect_detection_signals = mock.AsyncMock(return_value=())
+                reports = []
+
+                async def capture_report(*_args, **kwargs):
+                    reports.append(
+                        (
+                            kwargs["error"],
+                            kwargs["error"].__traceback__,
+                            kwargs["action"],
+                        )
+                    )
+
+                honeypot_cog = import_module("NHCogs.honeypot.honeypot")
+                with mock.patch.object(
+                    honeypot_cog,
+                    "report_operational_error",
+                    side_effect=capture_report,
+                ):
+                    await cog.on_message(message)
+
+                self.assertEqual(len(reports), 1)
+                reported_error, reported_traceback, action = reports[0]
+                self.assertIs(reported_error, original_error)
+                self.assertIsNotNone(reported_traceback)
+                self.assertIs(reported_traceback, original_error.__traceback__)
+                self.assertEqual(
+                    action,
+                    "message_registry_observation (attempt 1, will retry)",
+                )
+                cog._collect_detection_signals.assert_awaited_once()
+
     async def test_malformed_enabled_setting_does_not_enter_detection_pipeline(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
diff --git a/tests/test_detection_capture.py b/tests/test_detection_capture.py
index d388806..c2d8908 100644
--- a/tests/test_detection_capture.py
+++ b/tests/test_detection_capture.py
@@ -98,7 +98,6 @@ async def slow_read(*, use_cached):
                 cog._record_operational_failure = mock.AsyncMock(
                     wraps=cog._record_operational_failure
                 )
-                cog._send_operational_alert = mock.AsyncMock()
 
                 with mock.patch.object(
                     honeypot.detection_runtime,
@@ -121,22 +120,14 @@ async def slow_read(*, use_cached):
                 ]
                 self.assertEqual(len(failure_calls), 1)
                 self.assertEqual(failure_calls[0].args[2], 3)
-                operational_failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures, message.guild.id
-                )
-                self.assertEqual(len(operational_failures), 1)
-                self.assertEqual(operational_failures[0].source, "evidence_capture")
-                self.assertIn("Failed to capture 2 attachment(s)", operational_failures[0].summary)
                 evidence_failure = next(
                     call
                     for call in cog._record_operational_failure.await_args_list
                     if call.args[1] == "evidence_capture"
                 )
+                self.assertIn("Failed to capture 2 attachment(s)", evidence_failure.args[2])
                 self.assertEqual(evidence_failure.kwargs.get("attempts"), 3)
                 self.assertIs(evidence_failure.kwargs.get("terminal"), True)
-                alert = cog._send_operational_alert.await_args.args[1]
-                self.assertIn("terminal", alert)
-                self.assertNotIn("will retry", alert)
 
     async def test_two_cogs_do_not_apply_an_aggregate_case_byte_limit(self):
         with TemporaryDirectory() as directory:
@@ -944,6 +935,7 @@ async def test_scan_setup_failure_does_not_prevent_delete_or_publication(self):
                 )
                 cog._imagescan_load_samples = mock.AsyncMock(side_effect=RuntimeError("model unavailable"))
                 cog._publish_detection_case = mock.AsyncMock()
+                cog._record_operational_failure = mock.AsyncMock()
 
                 await cog.on_message(message)
 
@@ -953,12 +945,12 @@ async def test_scan_setup_failure_does_not_prevent_delete_or_publication(self):
                 self.assertEqual(snapshot.messages[0].delete_status.value, "deleted")
                 self.assertIn("model unavailable", snapshot.attachments[0].error)
                 self.assertEqual(cog._publish_detection_case.await_count, 2)
-                operational_failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures, message.guild.id
+                setup_failure = next(
+                    call
+                    for call in cog._record_operational_failure.await_args_list
+                    if call.args[1] == "image_scan_setup"
                 )
-                self.assertEqual(len(operational_failures), 1)
-                self.assertEqual(operational_failures[0].source, "image_scan_setup")
-                self.assertIn("model unavailable", operational_failures[0].summary)
+                self.assertIn("model unavailable", setup_failure.args[2])
 
     async def test_forward_route_hashes_and_persists_every_image_attachment(self):
         with TemporaryDirectory() as directory:
diff --git a/tests/test_detection_cases.py b/tests/test_detection_cases.py
index f2826f7..51cdd49 100644
--- a/tests/test_detection_cases.py
+++ b/tests/test_detection_cases.py
@@ -1657,21 +1657,6 @@ def test_unknown_persisted_operation_type_warns_and_remains_available(self):
         self.assertEqual(operation.operation_type, "future_operation")
         self.assertIn("future_operation", "\n".join(captured.output))
 
-    def test_known_operational_failure_source_returns_operation_type(self):
-        occurred_at = datetime(2026, 7, 13, 12, tzinfo=timezone.utc)
-
-        self.store.record_operational_failure(
-            guild_id=10,
-            source=OperationType.ROLE_APPLY,
-            summary="temporary",
-            occurred_at=occurred_at,
-        )
-        reopened = DetectionCaseStore(self.database_path)
-        reopened.initialize()
-        failure = reopened.list_operational_failures(10)[0]
-
-        self.assertIs(failure.source, OperationType.ROLE_APPLY)
-
     def test_publication_claim_renewal_prevents_stale_reclaim(self):
         now = datetime(2026, 7, 13, 12, tzinfo=timezone.utc)
         case_id = self.store.append_message(self.message(40, now), ()).case.case_id
@@ -1889,45 +1874,6 @@ def test_complete_fail_and_abandon_operations_preserve_attempt_history(self):
         self.assertEqual(tuple(operation.idempotency_key for operation in retried), ("retry",))
         self.assertEqual(retried[0].attempts, 2)
 
-    def test_operational_failures_remain_visible_until_acknowledged(self):
-        created_at = datetime(2026, 7, 13, 12, tzinfo=timezone.utc)
-        case_id = self.store.append_message(self.message(40, created_at), ()).case.case_id
-
-        first = self.store.record_operational_failure(
-            guild_id=10,
-            source="review_publish",
-            summary="Could not create the case thread",
-            occurred_at=created_at,
-            case_id=case_id,
-            operation_id="op-1",
-        )
-        repeated = self.store.record_operational_failure(
-            guild_id=10,
-            source="review_publish",
-            summary="Could not create the case thread",
-            occurred_at=created_at + timedelta(seconds=10),
-            case_id=case_id,
-            operation_id="op-1",
-        )
-
-        self.assertEqual(first.failure_id, repeated.failure_id)
-        self.assertEqual(repeated.occurrences, 2)
-        self.assertEqual(len(self.store.list_operational_failures(10)), 1)
-        self.assertTrue(self.store.resolve_operational_failure("op-1", created_at))
-        self.assertEqual(self.store.list_operational_failures(10), ())
-        self.assertEqual(self.store.clear_operational_failures(10, created_at), 1)
-
-        recurring = self.store.record_operational_failure(
-            guild_id=10,
-            source="review_publish",
-            summary="Thread creation failed again",
-            occurred_at=created_at + timedelta(minutes=1),
-            case_id=case_id,
-            operation_id="op-1",
-        )
-        self.assertEqual(recurring.occurrences, 1)
-        self.assertEqual(len(self.store.list_operational_failures(10)), 1)
-
     def test_stale_operation_worker_cannot_complete_reclaimed_work(self):
         now = datetime(2026, 7, 13, tzinfo=timezone.utc)
         case_id = self.store.append_message(self.message(40, now), ()).case.case_id
diff --git a/tests/test_detection_diagnostics.py b/tests/test_detection_diagnostics.py
index 3d72679..86065a0 100644
--- a/tests/test_detection_diagnostics.py
+++ b/tests/test_detection_diagnostics.py
@@ -128,31 +128,6 @@ async def test_imagescan_dump_exports_dated_samples_and_archive_paths(self):
                 self.assertIsNone(rows[1]["file"])
                 self.assertFalse(rows[1]["active"])
 
-    async def test_honeypot_errors_uses_persisted_operation_value(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                occurred_at = datetime(2026, 7, 13, 12, tzinfo=timezone.utc)
-                cog = honeypot.Honeypot(_Bot())
-                cog._case_store.initialize()
-                cog._case_store.record_operational_failure(
-                    guild_id=10,
-                    source=honeypot.OperationType.ROLE_APPLY,
-                    summary="temporary",
-                    occurred_at=occurred_at,
-                )
-                ctx = SimpleNamespace(
-                    guild=SimpleNamespace(id=10),
-                    send=mock.AsyncMock(),
-                )
-
-                await cog.honeypot_errors(ctx)
-
-                ctx.send.assert_awaited_once_with(
-                    "**Honeypot operational errors:**\n"
-                    f"- <t:{int(occurred_at.timestamp())}:R> "
-                    "`role_apply` (active, x1): temporary"
-                )
-
     @staticmethod
     def _append_case(
         honeypot,
@@ -706,37 +681,6 @@ async def test_doctor_hides_healthy_operational_details(self):
                 self.assertNotIn("Failed containment cases: 0", report)
                 self.assertNotIn("Outstanding durable operations", report)
 
-    async def test_doctor_reports_active_operational_failures(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                cog = honeypot.Honeypot(_Bot())
-                cog._case_store.initialize()
-                cog._case_store.record_operational_failure(
-                    guild_id=10,
-                    source="review_publish",
-                    summary="Could not create the case thread",
-                    occurred_at=datetime.now(timezone.utc),
-                )
-                cog.config = SimpleNamespace(
-                    guild=lambda guild: SimpleNamespace(
-                        all=mock.AsyncMock(
-                            return_value={
-                                "enabled": False,
-                                "action": "none",
-                                "fallback_action": "none",
-                                "whitelist_mode": "bypass",
-                            }
-                        )
-                    )
-                )
-                ctx = self._doctor_context()
-
-                await cog.honeypot_doctor(ctx)
-
-                report = "\n".join(call.args[0] for call in ctx.send.await_args_list)
-                self.assertIn("Active operational failures: 1", report)
-                self.assertIn("honeypot errors", report)
-
     async def test_doctor_checks_evidence_directory_off_event_loop_thread(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
diff --git a/tests/test_detection_lifecycle.py b/tests/test_detection_lifecycle.py
index e03c2c7..8c998c0 100644
--- a/tests/test_detection_lifecycle.py
+++ b/tests/test_detection_lifecycle.py
@@ -6,7 +6,7 @@
 import logging
 import sys
 import unittest
-from dataclasses import FrozenInstanceError, fields
+from dataclasses import FrozenInstanceError
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from threading import Event, get_ident
@@ -15,7 +15,6 @@
 
 from tests.harness import (
     _MISSING,
-    EXPECTED_GUILD_DEFAULTS,
     _async_noop,
     _Bot,
     _isolated_honeypot_modules,
@@ -179,8 +178,6 @@ def test_fallback_keeps_diagnostic_commands_on_cog_and_exposes_implementations(s
         implementation_names = (
             "config_dump",
             "honeypot_doctor",
-            "honeypot_errors",
-            "honeypot_errors_clear",
             "honeypot_mod_stats",
             "honeypot_reset_stats",
             "honeypot_stats",
@@ -232,20 +229,6 @@ async def test_configuration_option_enums_preserve_public_values(self):
                         )
                         self.assertEqual(getattr(honeypot, tuple_name), expected)
 
-    async def test_empty_guild_settings_use_registered_defaults(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                settings_type = getattr(honeypot, "GuildSettings", None)
-                self.assertIsNotNone(settings_type)
-
-                guild_settings = settings_type.from_mapping({})
-
-                observed = {
-                    field.name: getattr(guild_settings, field.name)
-                    for field in fields(guild_settings)
-                }
-                self.assertEqual(observed, EXPECTED_GUILD_DEFAULTS)
-
     async def test_guild_settings_ignore_unknown_keys_and_keep_known_values(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
@@ -321,7 +304,6 @@ async def test_guild_settings_preserve_every_boolean_toggle(self):
 
     async def test_guild_settings_coerce_optional_discord_ids(self):
         raw = {
-            "errors_channel": 11,
             "mute_role": "invalid",
             "review_channel": 44,
             "joinwatch_channel": 55,
@@ -333,7 +315,6 @@ async def test_guild_settings_coerce_optional_discord_ids(self):
                 with self.assertLogs("red.Honeypot", level=logging.WARNING) as captured:
                     guild_settings = honeypot.GuildSettings.from_mapping(raw)
 
-                self.assertEqual(guild_settings.errors_channel, 11)
                 self.assertIsNone(guild_settings.mute_role)
                 self.assertEqual(guild_settings.review_channel, 44)
                 self.assertEqual(guild_settings.joinwatch_channel, 55)
@@ -358,7 +339,7 @@ async def test_guild_settings_copy_and_validate_list_and_set_values(self):
                 self.assertEqual(set(guild_settings.scam_keywords), {"alpha", "beta"})
                 self.assertEqual(
                     guild_settings.attachment_patterns,
-                    EXPECTED_GUILD_DEFAULTS["attachment_patterns"],
+                    honeypot.settings.DEFAULTS["attachment_patterns"],
                 )
                 self.assertIn("attachment_patterns", "\n".join(captured.output))
 
@@ -465,29 +446,6 @@ async def test_guild_settings_are_frozen_snapshots(self):
                 with self.assertRaises(FrozenInstanceError):
                     guild_settings.enabled = True
 
-    async def test_guild_settings_defaults_exactly_match_registered_config(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                cog = honeypot.Honeypot(_Bot())
-
-                self.assertEqual(dict(honeypot.settings.DEFAULTS), EXPECTED_GUILD_DEFAULTS)
-                self.assertEqual(cog.config.defaults, EXPECTED_GUILD_DEFAULTS)
-
-    async def test_guild_settings_never_raise_for_non_mapping_config(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                with self.assertLogs("red.Honeypot", level=logging.WARNING):
-                    try:
-                        guild_settings = honeypot.GuildSettings.from_mapping(None)
-                    except Exception as exc:
-                        self.fail(f"from_mapping raised for config input: {exc!r}")
-
-                observed = {
-                    field.name: getattr(guild_settings, field.name)
-                    for field in fields(guild_settings)
-                }
-                self.assertEqual(observed, EXPECTED_GUILD_DEFAULTS)
-
     async def test_isolation_removes_new_nested_honeypot_module(self):
         module_name = "NHCogs.honeypot.operations.source_delete"
         sys.modules.pop(module_name, None)
diff --git a/tests/test_detection_publication.py b/tests/test_detection_publication.py
index 27e971a..67bb644 100644
--- a/tests/test_detection_publication.py
+++ b/tests/test_detection_publication.py
@@ -3,7 +3,6 @@
 """
 
 import asyncio
-import sqlite3
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from tempfile import TemporaryDirectory
@@ -142,7 +141,7 @@ async def test_publication_failure_happens_after_delete_and_leaves_retryable_ope
                 self.assertIn("review unavailable", operation.last_error)
                 message.delete.assert_awaited_once()
 
-    async def test_preview_thread_failure_is_visible_until_later_publication_succeeds(self):
+    async def test_preview_thread_failure_and_recovery_share_operation_identity(self):
         with TemporaryDirectory() as directory:
             data_path = Path(directory)
             with _isolated_honeypot_modules(data_path) as honeypot:
@@ -179,50 +178,29 @@ async def scan_images(*args, **kwargs):
                         True,
                     ]
                 )
+                cog._record_operational_failure = mock.AsyncMock()
+                honeypot.detection.mark_operational_error_recovered = mock.AsyncMock()
 
                 processing = asyncio.create_task(cog.on_message(message))
                 await asyncio.wait_for(scan_started.wait(), timeout=1)
 
-                failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures,
-                    message.guild.id,
+                failure = next(
+                    call
+                    for call in cog._record_operational_failure.await_args_list
+                    if call.args[1] == "review_publish"
                 )
+                operation_id = failure.kwargs["operation_id"]
+                self.assertIn("case thread", failure.args[2])
 
                 finish_scan.set()
                 await processing
-                self.assertEqual(
-                    [failure.source for failure in failures],
-                    ["review_publish"],
-                )
-                self.assertIn("case thread", failures[0].summary)
-                active_after_recovery = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures,
-                    message.guild.id,
+                honeypot.detection.mark_operational_error_recovered.assert_awaited_once_with(
+                    cog.bot,
+                    guild_id=message.guild.id,
+                    source="Honeypot",
+                    action="review_publish",
+                    correlation_key=operation_id,
                 )
-                failure_history = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures,
-                    message.guild.id,
-                    include_resolved=True,
-                )
-                self.assertEqual(active_after_recovery, ())
-                self.assertIsNotNone(failure_history[0].resolved_at)
-
-    async def test_operational_logger_failure_does_not_escape(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                cog = honeypot.Honeypot(_Bot())
-                cog._case_store.record_operational_failure = mock.Mock(
-                    side_effect=sqlite3.OperationalError("disk unavailable")
-                )
-                cog._send_operational_alert = mock.AsyncMock()
-
-                await cog._record_operational_failure(
-                    10,
-                    "review_publish",
-                    "Could not create the case thread",
-                )
-
-                cog._send_operational_alert.assert_not_awaited()
 
     async def test_missing_publication_destination_is_durable_after_delete(self):
         with TemporaryDirectory() as directory:
diff --git a/tests/test_detection_purge.py b/tests/test_detection_purge.py
index 50855f5..3e80419 100644
--- a/tests/test_detection_purge.py
+++ b/tests/test_detection_purge.py
@@ -123,6 +123,8 @@ async def test_forbidden_forward_delete_is_persisted_and_published_after_all_ima
                 )
                 cog._scan_all_case_message_images = mock.AsyncMock()
                 cog._publish_detection_case = mock.AsyncMock()
+                cog._record_operational_failure = mock.AsyncMock()
+                honeypot.detection.mark_operational_error_recovered = mock.AsyncMock()
 
                 await cog.on_message(message)
 
@@ -152,10 +154,15 @@ async def test_forbidden_forward_delete_is_persisted_and_published_after_all_ima
                     source_delete.retry_at - source_delete.updated_at,
                     timedelta(seconds=10),
                 )
-                failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures, message.guild.id
+                failure = next(
+                    call
+                    for call in cog._record_operational_failure.await_args_list
+                    if call.args[1] is honeypot.OperationType.SOURCE_DELETE
+                )
+                self.assertEqual(
+                    failure.kwargs["operation_id"],
+                    source_delete.operation_id,
                 )
-                self.assertEqual([item.source for item in failures], ["source_delete"])
                 scan_args = cog._scan_all_case_message_images.await_args.args
                 self.assertEqual(scan_args[0], message)
                 self.assertEqual((scan_args[2], scan_args[3]), (snapshot.case.case_id, 1))
@@ -185,12 +192,24 @@ async def test_forbidden_forward_delete_is_persisted_and_published_after_all_ima
                 await cog._run_detection_reconciliation(now=source_delete.retry_at)
 
                 retried_message.delete.assert_awaited_once()
-                failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures,
-                    message.guild.id,
-                    include_resolved=True,
+                matching_recoveries = [
+                    call
+                    for call in honeypot.detection.mark_operational_error_recovered.await_args_list
+                    if call.kwargs.get("correlation_key")
+                    == source_delete.operation_id
+                ]
+                self.assertEqual(
+                    matching_recoveries,
+                    [
+                        mock.call(
+                            cog.bot,
+                            guild_id=message.guild.id,
+                            source="Honeypot",
+                            action="source_delete",
+                            correlation_key=source_delete.operation_id,
+                        )
+                    ],
                 )
-                self.assertIsNotNone(failures[0].resolved_at)
 
     async def test_spam_only_delete_does_not_increment_forward_purge_stats(self):
         with TemporaryDirectory() as directory:
diff --git a/tests/test_github_app_client.py b/tests/test_github_app_client.py
new file mode 100644
index 0000000..9a4d39d
--- /dev/null
+++ b/tests/test_github_app_client.py
@@ -0,0 +1,373 @@
+from __future__ import annotations
+
+import asyncio
+import unittest
+from collections import deque
+from datetime import datetime, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from typing import Any
+
+import jwt
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class FakeResponse:
+    def __init__(
+        self,
+        status: int,
+        payload: dict[str, object] | list[object],
+        *,
+        headers: dict[str, str] | None = None,
+    ) -> None:
+        self.status = status
+        self.headers = headers or {}
+        self._payload = payload
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *_args) -> None:
+        return None
+
+    async def json(self, *, content_type=None):
+        return self._payload
+
+
+class FakeSession:
+    def __init__(self, *responses: FakeResponse | BaseException) -> None:
+        self.responses = deque(responses)
+        self.requests: list[tuple[str, str, dict[str, Any]]] = []
+
+    def request(self, method: str, url: str, **kwargs):
+        self.requests.append((method, url, kwargs))
+        response = self.responses.popleft()
+        if isinstance(response, BaseException):
+            raise response
+        return response
+
+
+class DeferredResponse(FakeResponse):
+    def __init__(self, status: int, payload: dict[str, object]) -> None:
+        super().__init__(status, payload)
+        self.entered = asyncio.Event()
+        self.release = asyncio.Event()
+
+    async def json(self, *, content_type=None):
+        self.entered.set()
+        await self.release.wait()
+        return await super().json(content_type=content_type)
+
+
+class GitHubAppClientTests(unittest.IsolatedAsyncioTestCase):
+    private_key: rsa.RSAPrivateKey
+    private_pem: bytes
+    public_key: rsa.RSAPublicKey
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        cls.private_pem = cls.private_key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.TraditionalOpenSSL,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+        cls.public_key = cls.private_key.public_key()
+
+    def setUp(self) -> None:
+        self.data_dir = TemporaryDirectory()
+        self.modules = isolated_githubtickets_modules(Path(self.data_dir.name))
+        self.loaded = self.modules.__enter__()
+
+    def tearDown(self) -> None:
+        self.modules.__exit__(None, None, None)
+        self.data_dir.cleanup()
+
+    def credentials(self):
+        return self.loaded.github_app.GitHubAppCredentials(
+            organization="NewHorizons",
+            client_id="Iv1.client",
+            app_id=123,
+            installation_id=456,
+            private_key=self.private_pem,
+            webhook_secret=b"webhook-secret",
+        )
+
+    @staticmethod
+    def pull_request_payload() -> dict[str, object]:
+        return {
+            "id": 9001,
+            "number": 42,
+            "title": "Make the machine faster",
+            "html_url": "https://github.com/GTNewHorizons/Example/pull/42",
+            "state": "open",
+            "draft": False,
+            "merged": False,
+            "user": {"id": 7001, "login": "author"},
+            "base": {
+                "repo": {
+                    "id": 5001,
+                    "full_name": "GTNewHorizons/Example",
+                }
+            },
+            "updated_at": "2026-08-28T23:45:00Z",
+            "labels": [{"name": "discord-ticket"}],
+            "assignees": [{"login": "reviewer"}],
+        }
+
+    async def test_first_pr_read_authenticates_and_returns_snapshot(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                201,
+                {
+                    "token": "installation-token",
+                    "expires_at": "2026-08-29T01:00:00Z",
+                },
+            ),
+            FakeResponse(200, self.pull_request_payload()),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        credentials = self.credentials()
+        client = github_app.GitHubAppClient(credentials, session, clock=lambda: now)
+
+        pull_request = await client.get_pull_request("GTNewHorizons", "Example", 42)
+
+        self.assertEqual(pull_request.pull_request_id, 9001)
+        self.assertEqual(pull_request.number, 42)
+        self.assertEqual(pull_request.title, "Make the machine faster")
+        self.assertEqual(pull_request.repository_id, 5001)
+        self.assertEqual(
+            pull_request.repository_full_name,
+            "GTNewHorizons/Example",
+        )
+        self.assertEqual(pull_request.author_id, 7001)
+        self.assertEqual(pull_request.author_login, "author")
+        self.assertEqual(
+            pull_request.updated_at,
+            datetime(2026, 8, 28, 23, 45, tzinfo=timezone.utc),
+        )
+        self.assertEqual(pull_request.labels, ("discord-ticket",))
+        self.assertEqual(pull_request.assignees, ("reviewer",))
+
+        token_request, pull_request_request = session.requests
+        self.assertEqual(
+            pull_request_request[0:2],
+            ("GET", "https://api.github.com/repos/GTNewHorizons/Example/pulls/42"),
+        )
+        self.assertEqual(token_request[0:2], ("POST", "https://api.github.com/app/installations/456/access_tokens"))
+        encoded_jwt = token_request[2]["headers"]["Authorization"].removeprefix("Bearer ")
+        claims = jwt.decode(
+            encoded_jwt,
+            self.public_key,
+            algorithms=["RS256"],
+            options={"verify_exp": False, "verify_iat": False},
+        )
+        self.assertEqual(claims, {"iat": int(now.timestamp()) - 60, "exp": int(now.timestamp()) + 540, "iss": "Iv1.client"})
+        self.assertEqual(
+            pull_request_request[2]["headers"],
+            {
+                "Accept": "application/vnd.github+json",
+                "Authorization": "Bearer installation-token",
+                "X-GitHub-Api-Version": "2022-11-28",
+                "User-Agent": "NHCogs-GitHubTickets",
+            },
+        )
+        for request in session.requests:
+            timeout = request[2]["timeout"]
+            self.assertEqual(timeout.total, 30)
+            self.assertEqual(timeout.connect, 10)
+        self.assertNotIn("webhook-secret", repr(credentials))
+        self.assertNotIn(self.private_pem.decode(), repr(credentials))
+
+    async def test_unauthorized_request_refreshes_token_once(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                201,
+                {"token": "expired-token", "expires_at": "2026-08-29T01:00:00Z"},
+            ),
+            FakeResponse(401, {"message": "Bad credentials"}),
+            FakeResponse(
+                201,
+                {"token": "fresh-token", "expires_at": "2026-08-29T01:00:00Z"},
+            ),
+            FakeResponse(200, self.pull_request_payload()),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        pull_request = await client.get_pull_request("GTNewHorizons", "Example", 42)
+
+        self.assertEqual(pull_request.number, 42)
+        token_requests = [request for request in session.requests if "/access_tokens" in request[1]]
+        self.assertEqual(len(token_requests), 2)
+        self.assertEqual(session.requests[-1][2]["headers"]["Authorization"], "Bearer fresh-token")
+
+    async def test_add_assignee_rejects_silent_github_ignore(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                201,
+                {"token": "installation-token", "expires_at": "2026-08-29T01:00:00Z"},
+            ),
+            FakeResponse(200, {"assignees": [{"login": "someone-else"}]}),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        with self.assertRaises(github_app.GitHubAssigneeUnavailable) as raised:
+            await client.add_assignee("GTNewHorizons", "Example", 42, "reviewer")
+
+        self.assertEqual(raised.exception.login, "reviewer")
+        request = session.requests[-1]
+        self.assertEqual(request[0:2], ("POST", "https://api.github.com/repos/GTNewHorizons/Example/issues/42/assignees"))
+        self.assertEqual(request[2]["json"], {"assignees": ["reviewer"]})
+
+    async def test_remove_assignee_uses_pull_request_issue_endpoint(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                201,
+                {"token": "installation-token", "expires_at": "2026-08-29T01:00:00Z"},
+            ),
+            FakeResponse(200, {"assignees": []}),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        await client.remove_assignee("GTNewHorizons", "Example", 42, "reviewer")
+
+        request = session.requests[-1]
+        self.assertEqual(request[0:2], ("DELETE", "https://api.github.com/repos/GTNewHorizons/Example/issues/42/assignees"))
+        self.assertEqual(request[2]["json"], {"assignees": ["reviewer"]})
+
+    async def test_app_delivery_operations_use_app_jwt(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                200,
+                [
+                    {
+                        "id": 765,
+                        "guid": "delivery-guid",
+                        "delivered_at": "2026-08-29T00:10:00Z",
+                        "redelivery": False,
+                        "status_code": 503,
+                        "event": "pull_request",
+                        "action": "closed",
+                    }
+                ],
+            ),
+            FakeResponse(202, {}),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        deliveries = await client.list_deliveries(page=2)
+        await client.redeliver(765)
+
+        self.assertEqual(
+            deliveries,
+            (
+                github_app.GitHubDeliverySummary(
+                    delivery_id=765,
+                    guid="delivery-guid",
+                    delivered_at=datetime(2026, 8, 29, 0, 10, tzinfo=timezone.utc),
+                    redelivery=False,
+                    status_code=503,
+                    event="pull_request",
+                    action="closed",
+                ),
+            ),
+        )
+        self.assertEqual(
+            [request[0:2] for request in session.requests],
+            [
+                ("GET", "https://api.github.com/app/hook/deliveries?per_page=100&page=2"),
+                ("POST", "https://api.github.com/app/hook/deliveries/765/attempts"),
+            ],
+        )
+        for request in session.requests:
+            encoded_jwt = request[2]["headers"]["Authorization"].removeprefix("Bearer ")
+            claims = jwt.decode(
+                encoded_jwt,
+                self.public_key,
+                algorithms=["RS256"],
+                options={"verify_exp": False, "verify_iat": False},
+            )
+            self.assertEqual(claims["iss"], "Iv1.client")
+
+    async def test_rate_limit_returns_safe_structured_failure(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(
+            FakeResponse(
+                201,
+                {"token": "installation-token", "expires_at": "2026-08-29T01:00:00Z"},
+            ),
+            FakeResponse(
+                403,
+                {"message": "sensitive upstream response body"},
+                headers={"retry-after": "120"},
+            ),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        with self.assertRaises(github_app.GitHubRequestError) as raised:
+            await client.get_pull_request("GTNewHorizons", "Example", 42)
+
+        error = raised.exception
+        self.assertEqual(error.status, 403)
+        self.assertTrue(error.retryable)
+        self.assertTrue(error.rate_limited)
+        self.assertEqual(error.retry_at, datetime(2026, 8, 29, 0, 2, tzinfo=timezone.utc))
+        self.assertNotIn("sensitive upstream", str(error))
+        self.assertLessEqual(len(str(error)), 120)
+
+    async def test_network_failure_is_safe_and_retryable(self) -> None:
+        github_app = self.loaded.github_app
+        session = FakeSession(OSError("socket failed with sensitive local detail"))
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        with self.assertRaises(github_app.GitHubRequestError) as raised:
+            await client.get_pull_request("GTNewHorizons", "Example", 42)
+
+        error = raised.exception
+        self.assertIsNone(error.status)
+        self.assertTrue(error.retryable)
+        self.assertFalse(error.rate_limited)
+        self.assertNotIn("sensitive local detail", str(error))
+
+    async def test_concurrent_requests_coalesce_token_refresh(self) -> None:
+        github_app = self.loaded.github_app
+        token_response = DeferredResponse(
+            201,
+            {"token": "installation-token", "expires_at": "2026-08-29T01:00:00Z"},
+        )
+        session = FakeSession(
+            token_response,
+            FakeResponse(200, self.pull_request_payload()),
+            FakeResponse(200, self.pull_request_payload()),
+        )
+        now = datetime(2026, 8, 29, tzinfo=timezone.utc)
+        client = github_app.GitHubAppClient(self.credentials(), session, clock=lambda: now)
+
+        first = asyncio.create_task(client.get_pull_request("GTNewHorizons", "Example", 42))
+        await token_response.entered.wait()
+        second = asyncio.create_task(client.get_pull_request("GTNewHorizons", "Example", 42))
+        await asyncio.sleep(0)
+
+        token_requests = [request for request in session.requests if "/access_tokens" in request[1]]
+        self.assertEqual(len(token_requests), 1)
+        token_response.release.set()
+        results = await asyncio.gather(first, second)
+        self.assertEqual([result.number for result in results], [42, 42])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_github_credentials.py b/tests/test_github_credentials.py
new file mode 100644
index 0000000..aa388f9
--- /dev/null
+++ b/tests/test_github_credentials.py
@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+import importlib
+import sys
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class _Bot:
+    def __init__(self, tokens: dict[str, str]) -> None:
+        self.tokens = tokens
+        self.requested_services: list[str] = []
+
+    async def get_shared_api_tokens(self, service: str) -> dict[str, str]:
+        self.requested_services.append(service)
+        return self.tokens
+
+
+class GitHubCredentialsTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self) -> None:
+        self.directory = TemporaryDirectory()
+        self.modules_context = isolated_githubtickets_modules(Path(self.directory.name))
+        self.modules_context.__enter__()
+        self.module_name = "NHCogs.githubtickets.credentials"
+        self.previous_module = sys.modules.pop(self.module_name, None)
+        self.credentials = importlib.import_module(self.module_name)
+
+    async def asyncTearDown(self) -> None:
+        sys.modules.pop(self.module_name, None)
+        if self.previous_module is not None:
+            sys.modules[self.module_name] = self.previous_module
+        self.modules_context.__exit__(None, None, None)
+        self.directory.cleanup()
+
+    async def test_fixed_secret_files_form_one_immutable_value(self) -> None:
+        data_path = Path(self.directory.name)
+        secret_path = data_path / "secrets"
+        secret_path.mkdir()
+        (secret_path / "github-app.pem").write_bytes(b"private-key")
+        (secret_path / "webhook-secret.txt").write_bytes(b"webhook-secret\n")
+        bot = _Bot(
+            {
+                "organization": "NewHorizons",
+                "client_id": "Iv1.example",
+                "app_id": "123",
+                "installation_id": "456",
+            }
+        )
+
+        loaded = await self.credentials.load_github_app_credentials(bot, data_path)
+
+        self.assertEqual(bot.requested_services, ["githubtickets"])
+        self.assertEqual(loaded.organization, "NewHorizons")
+        self.assertEqual(loaded.client_id, "Iv1.example")
+        self.assertEqual(loaded.app_id, 123)
+        self.assertEqual(loaded.installation_id, 456)
+        self.assertEqual(loaded.private_key, b"private-key")
+        self.assertEqual(loaded.webhook_secret, b"webhook-secret")
+        self.assertNotIn("private-key", repr(loaded))
+        self.assertNotIn("webhook-secret", repr(loaded))
+
+    async def test_missing_fixed_secret_files_are_rejected(self) -> None:
+        data_path = Path(self.directory.name)
+        bot = _Bot(
+            {
+                "organization": "NewHorizons",
+                "client_id": "Iv1.example",
+                "app_id": "123",
+                "installation_id": "456",
+            }
+        )
+
+        with self.assertRaises(self.credentials.InvalidGitHubAppCredentials):
+            await self.credentials.load_github_app_credentials(bot, data_path)
+
+    async def test_missing_is_dormant_and_partial_metadata_is_rejected(self) -> None:
+        data_path = Path(self.directory.name)
+        self.assertIsNone(
+            await self.credentials.load_github_app_credentials(_Bot({}), data_path)
+        )
+
+        with self.assertRaises(self.credentials.InvalidGitHubAppCredentials):
+            await self.credentials.load_github_app_credentials(
+                _Bot({"organization": "NewHorizons"}),
+                data_path,
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_github_event_handler.py b/tests/test_github_event_handler.py
new file mode 100644
index 0000000..7c3df0a
--- /dev/null
+++ b/tests/test_github_event_handler.py
@@ -0,0 +1,1038 @@
+from __future__ import annotations
+
+import importlib
+import json
+import sys
+import unittest
+from dataclasses import replace
+from datetime import datetime, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from types import SimpleNamespace
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class _Reporter:
+    def __init__(self) -> None:
+        self.reports: list[dict[str, object]] = []
+
+    async def report(self, **kwargs) -> None:
+        self.reports.append(kwargs)
+
+
+class _Member:
+    def __init__(
+        self,
+        user_id: int,
+        *,
+        role_ids: tuple[int, ...] = (),
+        manage_messages: bool = False,
+    ) -> None:
+        self.id = user_id
+        self.roles = tuple(SimpleNamespace(id=role_id) for role_id in role_ids)
+        self.guild_permissions = SimpleNamespace(manage_messages=manage_messages)
+
+
+class _Guild:
+    def __init__(self, members: tuple[_Member, ...]) -> None:
+        self.members = {member.id: member for member in members}
+
+    def get_member(self, user_id: int) -> _Member | None:
+        return self.members.get(user_id)
+
+
+def _member_is_eligible(member: _Member) -> bool:
+    return member.guild_permissions.manage_messages or any(
+        role.id == 99 for role in member.roles
+    )
+
+
+class _Bot:
+    def __init__(self, guild: _Guild, reporter: _Reporter) -> None:
+        self.guild = guild
+        self.reporter = reporter
+
+    def get_guild(self, guild_id: int) -> _Guild | None:
+        return self.guild if guild_id == 10 else None
+
+    def get_cog(self, name: str) -> _Reporter | None:
+        return self.reporter if name == "OperationalErrors" else None
+
+
+class _Store:
+    def __init__(self) -> None:
+        self.observed: list[object] = []
+        self.observation_state = None
+        self.profiles: dict[str, tuple[object, ...]] = {}
+
+    async def observe_pull_request(self, pull_request, *, authoritative: bool = False):
+        self.observed.append(pull_request)
+        return SimpleNamespace(
+            state=(
+                self.observation_state
+                if not authoritative
+                else self._applied_observation_state
+            ),
+            pull_request=pull_request,
+        )
+
+    async def list_profiles_by_github_username(
+        self,
+        guild_id: int,
+        github_username: str,
+    ) -> tuple[object, ...]:
+        if guild_id != 10:
+            return ()
+        return self.profiles.get(github_username.casefold(), ())
+
+
+class _Coordinator:
+    def __init__(self) -> None:
+        self.calls: list[tuple[object, ...]] = []
+        self.claim_success = True
+        self.unassign_success = True
+        self.finished_ticket = None
+
+    async def create_ticket_from_github(
+        self,
+        guild_id: int,
+        pull_request,
+        *,
+        author_id: int | None,
+    ) -> object:
+        self.calls.append(("create", guild_id, pull_request, author_id))
+        return SimpleNamespace(success=True)
+
+    async def claim_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        user_id: int,
+        github_login: str,
+        github_write_required: bool,
+    ) -> object:
+        self.calls.append(
+            (
+                "claim",
+                repository_id,
+                pr_number,
+                user_id,
+                github_login,
+                github_write_required,
+            )
+        )
+        return SimpleNamespace(success=self.claim_success)
+
+    async def unassign_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        user_id: int,
+    ) -> object:
+        self.calls.append(("unassign", repository_id, pr_number, user_id))
+        return SimpleNamespace(success=self.unassign_success)
+
+    async def finish_ticket_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> object:
+        self.calls.append(("finish", repository_id, pr_number))
+        return SimpleNamespace(
+            success=True,
+            finished_ticket=self.finished_ticket,
+        )
+
+    async def prompt_draft_decision_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+    ) -> object:
+        self.calls.append(("draft", repository_id, pr_number))
+        return SimpleNamespace(success=True)
+
+    async def update_title_from_github(
+        self,
+        repository_id: int,
+        pr_number: int,
+        *,
+        title: str,
+    ) -> object:
+        self.calls.append(("title", repository_id, pr_number, title))
+        return SimpleNamespace(success=True)
+
+
+class GitHubEventHandlerTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self) -> None:
+        self.directory = TemporaryDirectory()
+        self.modules_context = isolated_githubtickets_modules(Path(self.directory.name))
+        self.modules = self.modules_context.__enter__()
+        self.module_name = "NHCogs.githubtickets.event_handler"
+        self.previous_handler_module = sys.modules.pop(self.module_name, None)
+        self.event_handler = importlib.import_module(self.module_name)
+        self.reporter = _Reporter()
+        self.guild = _Guild(())
+        self.bot = _Bot(self.guild, self.reporter)
+        self.store = _Store()
+        self.store.observation_state = self.modules.models.PullRequestObservationState.APPLIED
+        self.store._applied_observation_state = (
+            self.modules.models.PullRequestObservationState.APPLIED
+        )
+        self.coordinator = _Coordinator()
+        self.handler = self.event_handler.GitHubEventHandler(
+            self.store,
+            self.coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+        )
+
+    async def asyncTearDown(self) -> None:
+        sys.modules.pop(self.module_name, None)
+        if self.previous_handler_module is not None:
+            sys.modules[self.module_name] = self.previous_handler_module
+        self.modules_context.__exit__(None, None, None)
+        self.directory.cleanup()
+
+    @staticmethod
+    def payload(
+        *,
+        action: str,
+        draft: bool = False,
+        state: str = "open",
+        labels: tuple[str, ...] = ("discord-ticket",),
+        assignees: tuple[str, ...] = (),
+        author_login: str = "author",
+        merged: bool = False,
+        updated_at: str = "2026-08-29T10:20:30Z",
+    ) -> dict[str, object]:
+        payload: dict[str, object] = {
+            "action": action,
+            "repository": {"id": 100, "full_name": "NewHorizons/NHCogs"},
+            "pull_request": {
+                "id": 700,
+                "number": 7,
+                "title": "GitHub ticket",
+                "html_url": "https://github.com/NewHorizons/NHCogs/pull/7",
+                "state": state,
+                "draft": draft,
+                "merged": merged,
+                "updated_at": updated_at,
+                "user": {"id": 900, "login": author_login},
+                "labels": [{"name": label} for label in labels],
+                "assignees": [{"login": login} for login in assignees],
+            },
+        }
+        if action in {"labeled", "unlabeled"}:
+            payload["label"] = {"name": "discord-ticket"}
+        return payload
+
+    def delivery(
+        self,
+        *,
+        event: str,
+        action: str,
+        payload: dict[str, object] | None = None,
+        raw_body: bytes | None = None,
+    ):
+        body = raw_body
+        if body is None:
+            body = json.dumps(payload or {}).encode()
+        return self.modules.models.GitHubDelivery(
+            delivery_guid=f"{event}-{action}",
+            github_delivery_id=123,
+            event=event,
+            action=action,
+            installation_id=456,
+            repository_id=100,
+            pr_number=7,
+            received_at=datetime(2026, 8, 29, 10, 21, tzinfo=timezone.utc),
+            state=self.modules.models.GitHubDeliveryState.PROCESSING,
+            attempts=1,
+            next_attempt_at=None,
+            processing_started_at=datetime(
+                2026,
+                8,
+                29,
+                10,
+                21,
+                tzinfo=timezone.utc,
+            ),
+            completed_at=None,
+            error_summary=None,
+            raw_body=body,
+        )
+
+    def map_profile(self, login: str, *user_ids: int) -> None:
+        self.store.profiles[login.casefold()] = tuple(
+            SimpleNamespace(user_id=user_id) for user_id in user_ids
+        )
+
+    async def test_unknown_event_is_ignored_without_side_effects(self) -> None:
+        disposition = await self.handler(
+            self.delivery(
+                event="issues",
+                action="opened",
+                raw_body=b'{"malformed":',
+            )
+        )
+
+        self.assertIs(disposition, self.modules.runtime.DeliveryDisposition.IGNORED)
+        self.assertEqual(self.store.observed, [])
+        self.assertEqual(self.coordinator.calls, [])
+
+    async def test_app_lifecycle_event_requests_runtime_owned_stop(self) -> None:
+        disposition = await self.handler(
+            self.delivery(
+                event="installation",
+                action="suspend",
+                payload={"action": "suspend"},
+            )
+        )
+
+        self.assertIs(disposition, self.modules.runtime.DeliveryDisposition.STOPPED)
+        self.assertEqual(self.store.observed, [])
+        self.assertEqual(self.coordinator.calls, [])
+
+    async def test_whitespace_title_does_not_block_closed_lifecycle(self) -> None:
+        store = self.modules.store.GitHubTicketsStore(
+            Path(self.directory.name) / "whitespace-title.sqlite"
+        )
+        await store.initialize()
+        coordinator = _Coordinator()
+        handler = self.event_handler.GitHubEventHandler(
+            store,
+            coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+        )
+        payload = self.payload(action="closed", state="closed")
+        payload["pull_request"]["title"] = "   "
+
+        disposition = await handler(
+            self.delivery(
+                event="pull_request",
+                action="closed",
+                payload=payload,
+            )
+        )
+
+        observed = await store.get_pull_request(100, 7)
+        self.assertIs(disposition, self.modules.runtime.DeliveryDisposition.PROCESSED)
+        self.assertIsNotNone(observed)
+        self.assertEqual(observed.title, "")
+        self.assertEqual(coordinator.calls, [("finish", 100, 7)])
+
+    async def test_whitespace_title_label_is_a_settled_no_op(self) -> None:
+        store = self.modules.store.GitHubTicketsStore(
+            Path(self.directory.name) / "whitespace-label.sqlite"
+        )
+        await store.initialize()
+        coordinator = _Coordinator()
+        handler = self.event_handler.GitHubEventHandler(
+            store,
+            coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+        )
+        payload = self.payload(action="labeled")
+        payload["pull_request"]["title"] = "   "
+
+        disposition = await handler(
+            self.delivery(
+                event="pull_request",
+                action="labeled",
+                payload=payload,
+            )
+        )
+
+        observed = await store.get_pull_request(100, 7)
+        self.assertIs(disposition, self.modules.runtime.DeliveryDisposition.PROCESSED)
+        self.assertIsNotNone(observed)
+        self.assertEqual(observed.title, "")
+        self.assertEqual(coordinator.calls, [])
+
+    async def test_stale_assignment_uses_newer_stored_assignees_without_refresh(
+        self,
+    ) -> None:
+        self.guild.members[2] = _Member(2, role_ids=(99,))
+        cases = (
+            (
+                "assigned",
+                ("participant",),
+                ("claim", 100, 7, 2, "participant", False),
+            ),
+            ("unassigned", (), ("unassign", 100, 7, 2)),
+        )
+        for index, (action, stored_assignees, expected_call) in enumerate(cases):
+            with self.subTest(action=action):
+                store = self.modules.store.GitHubTicketsStore(
+                    Path(self.directory.name) / f"stale-assignment-{index}.sqlite"
+                )
+                await store.initialize()
+                await store.save_profile(
+                    guild_id=10,
+                    user_id=2,
+                    github_username="participant",
+                    category_ids=(),
+                    automatic_pings=False,
+                    updated_at=datetime(2026, 8, 29, 10, 0, tzinfo=timezone.utc),
+                )
+                stored_delivery = self.delivery(
+                    event="pull_request",
+                    action="synchronize",
+                    payload=self.payload(
+                        action="synchronize",
+                        assignees=stored_assignees,
+                        updated_at="2026-08-29T10:20:31Z",
+                    ),
+                )
+                stored_event = self.modules.events.parse_delivery(stored_delivery)
+                await store.observe_pull_request(
+                    stored_event.pull_request,
+                    authoritative=True,
+                )
+                refresh_calls: list[object] = []
+
+                async def refresh_pull_request(pull_request, calls=refresh_calls):
+                    calls.append(pull_request)
+                    return pull_request
+
+                coordinator = _Coordinator()
+                handler = self.event_handler.GitHubEventHandler(
+                    store,
+                    coordinator,
+                    bot=self.bot,
+                    guild_id=10,
+                    member_is_eligible=_member_is_eligible,
+                    refresh_pull_request=refresh_pull_request,
+                )
+                stale_payload = self.payload(
+                    action=action,
+                    assignees=stored_assignees,
+                )
+                stale_payload["assignee"] = {"login": "participant"}
+
+                disposition = await handler(
+                    self.delivery(
+                        event="pull_request",
+                        action=action,
+                        payload=stale_payload,
+                    )
+                )
+
+                self.assertIs(
+                    disposition,
+                    self.modules.runtime.DeliveryDisposition.PROCESSED,
+                )
+                self.assertEqual(refresh_calls, [])
+                self.assertEqual(coordinator.calls, [expected_call])
+
+    async def test_stale_label_and_review_use_newer_stored_state(self) -> None:
+        store = self.modules.store.GitHubTicketsStore(
+            Path(self.directory.name) / "stale-label-review.sqlite"
+        )
+        await store.initialize()
+        await store.save_profile(
+            guild_id=10,
+            user_id=2,
+            github_username="reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=datetime(2026, 8, 29, 10, 0, tzinfo=timezone.utc),
+        )
+        self.guild.members[2] = _Member(2, role_ids=(99,))
+        stored_delivery = self.delivery(
+            event="pull_request",
+            action="synchronize",
+            payload=self.payload(
+                action="synchronize",
+                labels=("discord-ticket",),
+                updated_at="2026-08-29T10:20:31Z",
+            ),
+        )
+        stored_event = self.modules.events.parse_delivery(stored_delivery)
+        await store.observe_pull_request(stored_event.pull_request, authoritative=True)
+        refresh_calls: list[object] = []
+
+        async def refresh_pull_request(pull_request):
+            refresh_calls.append(pull_request)
+            return pull_request
+
+        coordinator = _Coordinator()
+        handler = self.event_handler.GitHubEventHandler(
+            store,
+            coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+            refresh_pull_request=refresh_pull_request,
+        )
+        await handler(
+            self.delivery(
+                event="pull_request",
+                action="labeled",
+                payload=self.payload(action="labeled"),
+            )
+        )
+        review_payload = self.payload(action="submitted")
+        review_payload["review"] = {
+            "state": "approved",
+            "user": {"login": "reviewer"},
+        }
+
+        await handler(
+            self.delivery(
+                event="pull_request_review",
+                action="submitted",
+                payload=review_payload,
+            )
+        )
+
+        self.assertEqual(refresh_calls, [])
+        self.assertEqual([call[0] for call in coordinator.calls], ["create", "claim"])
+        self.assertEqual(
+            coordinator.calls[1],
+            ("claim", 100, 7, 2, "reviewer", True),
+        )
+
+    async def test_stale_closed_and_reopened_follow_newer_open_state(self) -> None:
+        store = self.modules.store.GitHubTicketsStore(
+            Path(self.directory.name) / "stale-open-state.sqlite"
+        )
+        await store.initialize()
+        coordinator = _Coordinator()
+        refresh_calls: list[object] = []
+
+        async def refresh_pull_request(pull_request):
+            refresh_calls.append(pull_request)
+            return pull_request
+
+        handler = self.event_handler.GitHubEventHandler(
+            store,
+            coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+            refresh_pull_request=refresh_pull_request,
+        )
+        newer_open = self.modules.events.parse_delivery(
+            self.delivery(
+                event="pull_request",
+                action="synchronize",
+                payload=self.payload(
+                    action="synchronize",
+                    state="open",
+                    updated_at="2026-08-29T10:20:31Z",
+                ),
+            )
+        )
+        await store.observe_pull_request(newer_open.pull_request, authoritative=True)
+
+        await handler(
+            self.delivery(
+                event="pull_request",
+                action="closed",
+                payload=self.payload(action="closed", state="closed"),
+            )
+        )
+
+        newer_closed = self.modules.events.parse_delivery(
+            self.delivery(
+                event="pull_request",
+                action="synchronize",
+                payload=self.payload(
+                    action="synchronize",
+                    state="closed",
+                    updated_at="2026-08-29T10:20:32Z",
+                ),
+            )
+        )
+        await store.observe_pull_request(newer_closed.pull_request, authoritative=True)
+        await handler(
+            self.delivery(
+                event="pull_request",
+                action="reopened",
+                payload=self.payload(action="reopened", state="open"),
+            )
+        )
+
+        self.assertEqual(refresh_calls, [])
+        self.assertEqual(coordinator.calls, [("finish", 100, 7)])
+
+    async def test_equal_timestamp_conflict_refreshes_once_before_transition(self) -> None:
+        delivery = self.delivery(
+            event="pull_request",
+            action="edited",
+            payload={
+                **self.payload(action="edited"),
+                "changes": {"title": {"from": "Old title"}},
+            },
+        )
+        parsed = self.modules.events.parse_delivery(delivery)
+        authoritative = replace(
+            parsed.pull_request,
+            title="Authoritative title",
+        )
+        refresh_calls: list[object] = []
+
+        async def refresh_pull_request(pull_request):
+            refresh_calls.append(pull_request)
+            return authoritative
+
+        self.store.observation_state = self.modules.models.PullRequestObservationState.CONFLICT
+        handler = self.event_handler.GitHubEventHandler(
+            self.store,
+            self.coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+            refresh_pull_request=refresh_pull_request,
+        )
+
+        await handler(delivery)
+
+        self.assertEqual(refresh_calls, [parsed.pull_request])
+        self.assertEqual(len(self.store.observed), 2)
+        self.assertEqual(
+            self.coordinator.calls,
+            [("title", 100, 7, "Authoritative title")],
+        )
+
+    async def test_same_second_reordered_assignment_uses_authoritative_assignees(
+        self,
+    ) -> None:
+        self.map_profile("participant", 2)
+        self.guild.members[2] = _Member(2, role_ids=(99,))
+        cases = (
+            (
+                "assigned",
+                ("participant",),
+                "unassigned",
+                (),
+                [("unassign", 100, 7, 2)],
+            ),
+            (
+                "unassigned",
+                (),
+                "assigned",
+                ("participant",),
+                [("claim", 100, 7, 2, "participant", False)],
+            ),
+        )
+        for index, (
+            stale_action,
+            stale_assignees,
+            authoritative_action,
+            authoritative_assignees,
+            expected_calls,
+        ) in enumerate(cases):
+            with self.subTest(stale_action=stale_action):
+                store = self.modules.store.GitHubTicketsStore(
+                    Path(self.directory.name) / f"same-second-{index}.sqlite"
+                )
+                await store.initialize()
+                await store.save_profile(
+                    guild_id=10,
+                    user_id=2,
+                    github_username="participant",
+                    category_ids=(),
+                    automatic_pings=False,
+                    updated_at=datetime(2026, 8, 29, 10, 0, tzinfo=timezone.utc),
+                )
+                authoritative_payload = self.payload(
+                    action=authoritative_action,
+                    assignees=authoritative_assignees,
+                )
+                authoritative_payload["assignee"] = {"login": "participant"}
+                authoritative_delivery = self.delivery(
+                    event="pull_request",
+                    action=authoritative_action,
+                    payload=authoritative_payload,
+                )
+                authoritative_event = self.modules.events.parse_delivery(
+                    authoritative_delivery
+                )
+                await store.observe_pull_request(
+                    authoritative_event.pull_request,
+                    authoritative=True,
+                )
+
+                stale_payload = self.payload(
+                    action=stale_action,
+                    assignees=stale_assignees,
+                )
+                stale_payload["assignee"] = {"login": "participant"}
+                stale_delivery = self.delivery(
+                    event="pull_request",
+                    action=stale_action,
+                    payload=stale_payload,
+                )
+                coordinator = _Coordinator()
+                refresh_calls = []
+
+                async def refresh_pull_request(
+                    pull_request,
+                    calls=refresh_calls,
+                    authoritative=authoritative_event.pull_request,
+                ):
+                    calls.append(pull_request)
+                    return authoritative
+
+                handler = self.event_handler.GitHubEventHandler(
+                    store,
+                    coordinator,
+                    bot=self.bot,
+                    guild_id=10,
+                    member_is_eligible=_member_is_eligible,
+                    refresh_pull_request=refresh_pull_request,
+                )
+
+                await handler(stale_delivery)
+
+                self.assertEqual(len(refresh_calls), 1)
+                self.assertEqual(coordinator.calls, expected_calls)
+
+    async def test_discord_ticket_label_creates_only_for_ready_pull_request(self) -> None:
+        self.map_profile("author", 300)
+        self.guild.members[300] = _Member(300, role_ids=(99,))
+
+        ready = await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="labeled",
+                payload=self.payload(action="labeled"),
+            )
+        )
+        draft = await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="labeled",
+                payload=self.payload(action="labeled", draft=True),
+            )
+        )
+
+        self.assertIs(ready, self.modules.runtime.DeliveryDisposition.PROCESSED)
+        self.assertIs(draft, self.modules.runtime.DeliveryDisposition.PROCESSED)
+        self.assertEqual(len(self.store.observed), 2)
+        self.assertEqual(len(self.coordinator.calls), 1)
+        kind, guild_id, pull_request, author_id = self.coordinator.calls[0]
+        self.assertEqual(kind, "create")
+        self.assertEqual(guild_id, 10)
+        self.assertEqual(pull_request.pr_number, 7)
+        self.assertEqual(author_id, 300)
+
+    async def test_ineligible_profile_is_not_used_as_github_ticket_author(self) -> None:
+        self.map_profile("author", 300)
+        self.guild.members[300] = _Member(300)
+
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="labeled",
+                payload=self.payload(action="labeled"),
+            )
+        )
+
+        self.assertEqual(len(self.coordinator.calls), 1)
+        self.assertEqual(self.coordinator.calls[0][0], "create")
+        self.assertIsNone(self.coordinator.calls[0][3])
+
+    async def test_ready_and_closed_actions_use_explicit_lifecycle_methods(self) -> None:
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="ready_for_review",
+                payload=self.payload(action="ready_for_review"),
+            )
+        )
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="ready_for_review",
+                payload=self.payload(
+                    action="ready_for_review",
+                    labels=(),
+                ),
+            )
+        )
+        for merged in (False, True):
+            with self.subTest(merged=merged):
+                await self.handler(
+                    self.delivery(
+                        event="pull_request",
+                        action="closed",
+                        payload=self.payload(
+                            action="closed",
+                            state="closed",
+                            merged=merged,
+                        ),
+                    )
+                )
+
+        self.assertEqual(len(self.store.observed), 4)
+        self.assertEqual(
+            [call[0] for call in self.coordinator.calls],
+            ["create", "finish", "finish"],
+        )
+        self.assertEqual(self.coordinator.calls[0][3], None)
+        self.assertEqual(
+            self.coordinator.calls[1:],
+            [("finish", 100, 7), ("finish", 100, 7)],
+        )
+
+    async def test_converted_draft_prompts_and_closed_finish_logging_is_best_effort(
+        self,
+    ) -> None:
+        finished_ticket = object()
+        self.coordinator.finished_ticket = finished_ticket
+
+        async def failed_log(ticket) -> None:
+            self.assertIs(ticket, finished_ticket)
+            raise RuntimeError("log unavailable")
+
+        handler = self.event_handler.GitHubEventHandler(
+            self.store,
+            self.coordinator,
+            bot=self.bot,
+            guild_id=10,
+            member_is_eligible=_member_is_eligible,
+            ticket_finished=failed_log,
+        )
+
+        draft_result = await handler(
+            self.delivery(
+                event="pull_request",
+                action="converted_to_draft",
+                payload=self.payload(
+                    action="converted_to_draft",
+                    draft=True,
+                ),
+            )
+        )
+        closed_result = await handler(
+            self.delivery(
+                event="pull_request",
+                action="closed",
+                payload=self.payload(
+                    action="closed",
+                    state="closed",
+                ),
+            )
+        )
+
+        self.assertEqual(
+            [call[0] for call in self.coordinator.calls],
+            ["draft", "finish"],
+        )
+        self.assertIs(draft_result, self.modules.runtime.DeliveryDisposition.PROCESSED)
+        self.assertIs(closed_result, self.modules.runtime.DeliveryDisposition.PROCESSED)
+
+    async def test_explicit_title_edit_updates_the_bound_ticket_once(self) -> None:
+        payload = self.payload(action="edited")
+        payload["changes"] = {"title": {"from": "Old title"}}
+
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="edited",
+                payload=payload,
+            )
+        )
+
+        self.assertEqual(
+            self.coordinator.calls,
+            [("title", 100, 7, "GitHub ticket")],
+        )
+
+    async def test_assigned_claims_first_eligible_non_author_without_outbound_echo(
+        self,
+    ) -> None:
+        self.map_profile("outsider", 1)
+        self.map_profile("participant", 2)
+        self.map_profile("staff", 3)
+        self.map_profile("author", 4)
+        self.guild.members.update(
+            {
+                1: _Member(1),
+                2: _Member(2, role_ids=(99,)),
+                3: _Member(3, manage_messages=True),
+                4: _Member(4, role_ids=(99,)),
+            }
+        )
+        cases = (
+            (("outsider", "participant", "staff"), 2, "participant"),
+            (("outsider", "staff"), 3, "staff"),
+            (("author", "participant"), 2, "participant"),
+        )
+        for assignees, expected_user_id, expected_login in cases:
+            with self.subTest(assignees=assignees):
+                payload = self.payload(
+                    action="assigned",
+                    assignees=assignees,
+                )
+                payload["assignee"] = {"login": assignees[-1]}
+                await self.handler(
+                    self.delivery(
+                        event="pull_request",
+                        action="assigned",
+                        payload=payload,
+                    )
+                )
+                self.assertEqual(
+                    self.coordinator.calls[-1],
+                    ("claim", 100, 7, expected_user_id, expected_login, False),
+                )
+
+        self.assertEqual(len(self.coordinator.calls), 3)
+
+    async def test_unsettled_assignment_is_deferred_instead_of_acknowledged(self) -> None:
+        self.map_profile("participant", 2)
+        self.guild.members[2] = _Member(2, role_ids=(99,))
+        self.coordinator.claim_success = False
+
+        with self.assertRaises(self.event_handler.GitHubEventTransitionDeferred):
+            await self.handler(
+                self.delivery(
+                    event="pull_request",
+                    action="assigned",
+                    payload=self.payload(
+                        action="assigned",
+                        assignees=("participant",),
+                    ),
+                )
+            )
+
+    async def test_unassigned_releases_matching_claimant_then_considers_remaining_assignees(
+        self,
+    ) -> None:
+        self.map_profile("removed", 5)
+        self.map_profile("participant", 2)
+        self.guild.members.update(
+            {
+                2: _Member(2, role_ids=(99,)),
+                5: _Member(5),
+            }
+        )
+        payload = self.payload(
+            action="unassigned",
+            assignees=("participant",),
+        )
+        payload["assignee"] = {"login": "removed"}
+
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="unassigned",
+                payload=payload,
+            )
+        )
+
+        self.assertEqual(
+            self.coordinator.calls,
+            [
+                ("unassign", 100, 7, 5),
+                ("claim", 100, 7, 2, "participant", False),
+            ],
+        )
+
+    async def test_actionable_reviews_claim_and_only_request_missing_github_assignment(
+        self,
+    ) -> None:
+        self.map_profile("reviewer", 2)
+        self.map_profile("staff", 3)
+        self.map_profile("author", 4)
+        self.guild.members.update(
+            {
+                2: _Member(2, role_ids=(99,)),
+                3: _Member(3, manage_messages=True),
+                4: _Member(4, role_ids=(99,)),
+            }
+        )
+        cases = (
+            (
+                "approved",
+                "reviewer",
+                (),
+                ("claim", 100, 7, 2, "reviewer", True),
+            ),
+            (
+                "changes_requested",
+                "staff",
+                ("staff",),
+                ("claim", 100, 7, 3, "staff", False),
+            ),
+            ("commented", "reviewer", (), None),
+            ("approved", "author", (), None),
+            ("approved", None, (), None),
+            ("approved", "unmapped", (), None),
+        )
+        for state, reviewer, assignees, expected in cases:
+            with self.subTest(state=state, reviewer=reviewer):
+                payload = self.payload(
+                    action="submitted",
+                    assignees=assignees,
+                )
+                payload["review"] = {
+                    "state": state,
+                    "user": {"login": reviewer} if reviewer is not None else None,
+                }
+                before = len(self.coordinator.calls)
+                await self.handler(
+                    self.delivery(
+                        event="pull_request_review",
+                        action="submitted",
+                        payload=payload,
+                    )
+                )
+                if expected is None:
+                    self.assertEqual(len(self.coordinator.calls), before)
+                else:
+                    self.assertEqual(self.coordinator.calls[-1], expected)
+
+        self.assertEqual(len(self.coordinator.calls), 2)
+        self.assertEqual(self.reporter.reports, [])
+
+    async def test_ambiguous_cached_mapping_reports_and_makes_no_ownership_change(
+        self,
+    ) -> None:
+        self.map_profile("ambiguous", 10, 11)
+        self.map_profile("participant", 2)
+        self.guild.members.update(
+            {
+                2: _Member(2, role_ids=(99,)),
+                10: _Member(10, role_ids=(99,)),
+                11: _Member(11, manage_messages=True),
+            }
+        )
+        payload = self.payload(
+            action="assigned",
+            assignees=("ambiguous", "participant"),
+        )
+        payload["assignee"] = {"login": "participant"}
+
+        await self.handler(
+            self.delivery(
+                event="pull_request",
+                action="assigned",
+                payload=payload,
+            )
+        )
+
+        self.assertEqual(self.coordinator.calls, [])
+        self.assertEqual(len(self.reporter.reports), 1)
+        self.assertEqual(self.reporter.reports[0]["source"], "GitHubTickets")
+        self.assertEqual(
+            self.reporter.reports[0]["action"],
+            "resolve GitHub identity",
+        )
+        self.assertIn("ambiguous", str(self.reporter.reports[0]["error"]))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_github_events.py b/tests/test_github_events.py
new file mode 100644
index 0000000..f9c0006
--- /dev/null
+++ b/tests/test_github_events.py
@@ -0,0 +1,378 @@
+from __future__ import annotations
+
+import json
+import unittest
+from copy import deepcopy
+from datetime import datetime, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class GitHubEventParserTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.directory = TemporaryDirectory()
+        self.modules_context = isolated_githubtickets_modules(Path(self.directory.name))
+        self.modules = self.modules_context.__enter__()
+
+    def tearDown(self) -> None:
+        self.modules_context.__exit__(None, None, None)
+        self.directory.cleanup()
+
+    @staticmethod
+    def pull_request_payload() -> dict[str, object]:
+        return {
+            "action": "opened",
+            "repository": {
+                "id": 100,
+                "full_name": "NewHorizons/NHCogs",
+            },
+            "pull_request": {
+                "id": 700,
+                "number": 7,
+                "title": "Add GitHub App integration",
+                "html_url": "https://github.com/NewHorizons/NHCogs/pull/7",
+                "state": "open",
+                "draft": False,
+                "merged": False,
+                "updated_at": "2026-08-29T10:20:30Z",
+                "user": {"id": 900, "login": "octocat"},
+                "labels": [
+                    {"name": "discord-ticket"},
+                    {"name": "type: bug"},
+                ],
+                "assignees": [{"login": "reviewer"}],
+            },
+        }
+
+    def delivery(
+        self,
+        *,
+        event: str,
+        action: str | None,
+        payload: dict[str, object] | None = None,
+        raw_body: bytes | None = None,
+    ):
+        body = raw_body
+        if body is None:
+            body = json.dumps(payload or {}).encode()
+        return self.modules.models.GitHubDelivery(
+            delivery_guid="delivery-guid",
+            github_delivery_id=123,
+            event=event,
+            action=action,
+            installation_id=456,
+            repository_id=100,
+            pr_number=7,
+            received_at=datetime(2026, 8, 29, 10, 21, tzinfo=timezone.utc),
+            state=self.modules.models.GitHubDeliveryState.PROCESSING,
+            attempts=1,
+            next_attempt_at=None,
+            processing_started_at=datetime(
+                2026,
+                8,
+                29,
+                10,
+                21,
+                tzinfo=timezone.utc,
+            ),
+            completed_at=None,
+            error_summary=None,
+            raw_body=body,
+        )
+
+    def test_supported_pull_request_actions_return_typed_events(self) -> None:
+        cases = (
+            ("labeled", {"label": {"name": "priority: high"}}, "priority: high", None, False),
+            ("ready_for_review", {}, None, None, False),
+            ("opened", {}, None, None, False),
+            ("reopened", {}, None, None, False),
+            ("unlabeled", {"label": {"name": "stale"}}, "stale", None, False),
+            ("edited", {"changes": {"title": {"from": "Old title"}}}, None, None, True),
+            ("synchronize", {}, None, None, False),
+            ("converted_to_draft", {}, None, None, False),
+            ("closed", {}, None, None, False),
+            ("assigned", {"assignee": {"login": "reviewer"}}, None, "reviewer", False),
+            (
+                "unassigned",
+                {"assignee": {"login": "former-reviewer"}},
+                None,
+                "former-reviewer",
+                False,
+            ),
+        )
+        for action, extra, expected_label, expected_assignee, title_changed in cases:
+            with self.subTest(action=action):
+                payload = deepcopy(self.pull_request_payload())
+                payload["action"] = action
+                payload.update(extra)
+                pull_request = payload["pull_request"]
+                assert isinstance(pull_request, dict)
+                if action == "closed":
+                    pull_request["state"] = "closed"
+                    pull_request["merged"] = True
+                elif action == "converted_to_draft":
+                    pull_request["draft"] = True
+
+                parsed = self.modules.events.parse_delivery(
+                    self.delivery(
+                        event="pull_request",
+                        action=action,
+                        payload=payload,
+                    )
+                )
+
+                self.assertIsInstance(parsed, self.modules.events.PullRequestEvent)
+                self.assertEqual(parsed.action, action)
+                self.assertEqual(parsed.label, expected_label)
+                self.assertEqual(parsed.assignee_login, expected_assignee)
+                self.assertEqual(parsed.title_changed, title_changed)
+                snapshot = parsed.pull_request
+                self.assertEqual(snapshot.repository_id, 100)
+                self.assertEqual(snapshot.pr_number, 7)
+                self.assertEqual(snapshot.github_pr_id, 700)
+                self.assertEqual(snapshot.github_author_id, 900)
+                self.assertEqual(snapshot.repository_full_name, "NewHorizons/NHCogs")
+                self.assertEqual(
+                    snapshot.url,
+                    "https://github.com/NewHorizons/NHCogs/pull/7",
+                )
+                self.assertEqual(snapshot.title, "Add GitHub App integration")
+                self.assertEqual(snapshot.github_author_login, "octocat")
+                self.assertEqual(snapshot.draft, action == "converted_to_draft")
+                self.assertEqual(snapshot.open, action != "closed")
+                self.assertEqual(snapshot.labels, ("discord-ticket", "type: bug"))
+                self.assertEqual(
+                    getattr(snapshot, "assignees", None),
+                    ("reviewer",),
+                )
+                self.assertEqual(parsed.assignee_logins, ("reviewer",))
+                self.assertEqual(
+                    snapshot.github_updated_at,
+                    datetime(2026, 8, 29, 10, 20, 30, tzinfo=timezone.utc),
+                )
+                self.assertEqual(snapshot.last_processed_action, action)
+
+    def test_submitted_reviews_return_normalized_typed_events(self) -> None:
+        cases = (
+            (" APPROVED ", "approved"),
+            ("CHANGES_REQUESTED", "changes_requested"),
+            ("commented", "commented"),
+        )
+        for raw_state, expected_state in cases:
+            with self.subTest(state=raw_state):
+                payload = self.pull_request_payload()
+                payload["action"] = "submitted"
+                payload["review"] = {
+                    "state": raw_state,
+                    "user": {"login": "ReviewerOne"},
+                }
+
+                parsed = self.modules.events.parse_delivery(
+                    self.delivery(
+                        event="pull_request_review",
+                        action="submitted",
+                        payload=payload,
+                    )
+                )
+
+                self.assertIsInstance(
+                    parsed,
+                    self.modules.events.PullRequestReviewEvent,
+                )
+                self.assertEqual(parsed.state, expected_state)
+                self.assertEqual(parsed.reviewer_login, "ReviewerOne")
+                self.assertEqual(parsed.assignee_logins, ("reviewer",))
+                self.assertEqual(parsed.pull_request.pr_number, 7)
+                self.assertEqual(
+                    parsed.pull_request.last_processed_action,
+                    "submitted",
+                )
+
+    def test_optional_webhook_fields_do_not_break_known_actions(self) -> None:
+        cases = (
+            ("labeled", "label", None, None, False),
+            ("assigned", "assignee", None, None, False),
+            ("edited", "changes", None, None, False),
+        )
+        for action, omitted, expected_label, expected_assignee, title_changed in cases:
+            with self.subTest(action=action, omitted=omitted):
+                payload = self.pull_request_payload()
+                payload["action"] = action
+                payload.pop(omitted, None)
+                pull_request = payload["pull_request"]
+                assert isinstance(pull_request, dict)
+                pull_request.pop("draft")
+                pull_request.pop("merged")
+
+                parsed = self.modules.events.parse_delivery(
+                    self.delivery(
+                        event="pull_request",
+                        action=action,
+                        payload=payload,
+                    )
+                )
+
+                self.assertEqual(parsed.label, expected_label)
+                self.assertEqual(parsed.assignee_login, expected_assignee)
+                self.assertEqual(parsed.title_changed, title_changed)
+                self.assertFalse(parsed.pull_request.draft)
+
+        payload = self.pull_request_payload()
+        payload["action"] = "edited"
+        payload["changes"] = {"body": {"from": "old body"}}
+        parsed = self.modules.events.parse_delivery(
+            self.delivery(
+                event="pull_request",
+                action="edited",
+                payload=payload,
+            )
+        )
+        self.assertFalse(parsed.title_changed)
+
+        payload = self.pull_request_payload()
+        payload["action"] = "opened"
+        pull_request = payload["pull_request"]
+        assert isinstance(pull_request, dict)
+        pull_request.pop("assignees")
+        parsed = self.modules.events.parse_delivery(
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=payload,
+            )
+        )
+        self.assertEqual(parsed.action, "opened")
+
+    def test_submitted_review_without_user_remains_an_ignorable_event(self) -> None:
+        payload = self.pull_request_payload()
+        payload["action"] = "submitted"
+        payload["review"] = {
+            "state": "approved",
+            "user": None,
+        }
+
+        parsed = self.modules.events.parse_delivery(
+            self.delivery(
+                event="pull_request_review",
+                action="submitted",
+                payload=payload,
+            )
+        )
+
+        self.assertIsInstance(parsed, self.modules.events.PullRequestReviewEvent)
+        self.assertIsNone(parsed.reviewer_login)
+
+    def test_app_lifecycle_inputs_return_typed_stop_events(self) -> None:
+        cases = (
+            ("installation", "suspend", {}, "installation_suspended", ()),
+            ("installation", "deleted", {}, "installation_deleted", ()),
+            (
+                "installation",
+                "new_permissions_accepted",
+                {},
+                "permissions_changed",
+                (),
+            ),
+            (
+                "installation_repositories",
+                "removed",
+                {"repositories_removed": [{"id": 100}, {"id": 200}]},
+                "repositories_removed",
+                (100, 200),
+            ),
+        )
+        for event, action, extra, expected_reason, expected_repository_ids in cases:
+            with self.subTest(event=event, action=action):
+                payload = {"action": action, **extra}
+
+                parsed = self.modules.events.parse_delivery(
+                    self.delivery(event=event, action=action, payload=payload)
+                )
+
+                self.assertEqual(type(parsed).__name__, "GitHubAppLifecycleEvent")
+                self.assertEqual(parsed.reason, expected_reason)
+                self.assertEqual(parsed.repository_ids, expected_repository_ids)
+
+    def test_known_malformed_deliveries_raise_one_safe_error(self) -> None:
+        missing_repository = self.pull_request_payload()
+        missing_repository.pop("repository")
+        missing_author_id = self.pull_request_payload()
+        pull_request = missing_author_id["pull_request"]
+        assert isinstance(pull_request, dict)
+        author = pull_request["user"]
+        assert isinstance(author, dict)
+        author.pop("id")
+        invalid_updated_at = self.pull_request_payload()
+        pull_request = invalid_updated_at["pull_request"]
+        assert isinstance(pull_request, dict)
+        pull_request["updated_at"] = "private-secret"
+        invalid_labels = self.pull_request_payload()
+        pull_request = invalid_labels["pull_request"]
+        assert isinstance(pull_request, dict)
+        pull_request["labels"] = "private-secret"
+        action_mismatch = self.pull_request_payload()
+        action_mismatch["action"] = "closed"
+        cases = (
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                raw_body=b'{"private-secret":',
+            ),
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=missing_repository,
+            ),
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=missing_author_id,
+            ),
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=invalid_updated_at,
+            ),
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=invalid_labels,
+            ),
+            self.delivery(
+                event="pull_request",
+                action="opened",
+                payload=action_mismatch,
+            ),
+        )
+        for delivery in cases:
+            with self.subTest(event=delivery.event, body=delivery.raw_body):
+                with self.assertRaises(self.modules.events.InvalidGitHubDelivery) as raised:
+                    self.modules.events.parse_delivery(delivery)
+                self.assertEqual(
+                    str(raised.exception),
+                    "GitHub delivery payload is invalid",
+                )
+                self.assertNotIn("private-secret", str(raised.exception))
+
+    def test_unknown_events_and_actions_are_ignored_before_payload_parsing(self) -> None:
+        cases = (
+            ("issues", "opened"),
+            ("pull_request", "auto_merge_enabled"),
+            ("pull_request_review", "dismissed"),
+        )
+        for event, action in cases:
+            with self.subTest(event=event, action=action):
+                parsed = self.modules.events.parse_delivery(
+                    self.delivery(
+                        event=event,
+                        action=action,
+                        raw_body=b'{"private-secret":',
+                    )
+                )
+                self.assertIsNone(parsed)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_github_integration_runtime.py b/tests/test_github_integration_runtime.py
new file mode 100644
index 0000000..6dd58be
--- /dev/null
+++ b/tests/test_github_integration_runtime.py
@@ -0,0 +1,1402 @@
+from __future__ import annotations
+
+import asyncio
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class _Receiver:
+    def __init__(self) -> None:
+        self.events: list[object] = []
+        self.closed = asyncio.Event()
+
+    async def start(self, host: str, port: int) -> int:
+        self.events.append(("start", host, port))
+        return port
+
+    async def close(self) -> None:
+        self.events.append("close")
+        self.closed.set()
+
+
+class _FailingCloseReceiver(_Receiver):
+    def __init__(self) -> None:
+        super().__init__()
+        self.close_attempts = 0
+
+    async def close(self) -> None:
+        self.close_attempts += 1
+        if self.close_attempts == 1:
+            raise RuntimeError("receiver cleanup failed")
+        await super().close()
+
+
+class _Client:
+    def __init__(self, pages: dict[int, tuple[object, ...]] | None = None) -> None:
+        self.pages = pages or {}
+        self.listed_pages: list[int] = []
+        self.redelivered: list[int] = []
+        self.mutations: list[tuple[str, str, str, int, str]] = []
+        self.token_invalidations = 0
+
+    def invalidate_installation_token(self) -> None:
+        self.token_invalidations += 1
+
+    async def list_deliveries(self, *, page: int = 1) -> tuple[object, ...]:
+        self.listed_pages.append(page)
+        return self.pages.get(page, ())
+
+    async def redeliver(self, delivery_id: int) -> None:
+        self.redelivered.append(delivery_id)
+
+    async def add_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        self.mutations.append(("add", owner, repository, number, login))
+
+    async def remove_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        self.mutations.append(("remove", owner, repository, number, login))
+
+
+class _FailingAddClient(_Client):
+    def __init__(self, error: Exception) -> None:
+        super().__init__()
+        self.error = error
+
+    async def add_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        raise self.error
+
+
+class _FailingRedeliveryClient(_Client):
+    def __init__(self, pages, errors):
+        super().__init__(pages)
+        self.errors = errors
+        self.redelivery_attempts = []
+
+    async def redeliver(self, delivery_id: int) -> None:
+        self.redelivery_attempts.append(delivery_id)
+        error = self.errors.get(delivery_id)
+        if error is not None:
+            raise error
+        await super().redeliver(delivery_id)
+
+
+class _SerializingClient(_Client):
+    def __init__(self) -> None:
+        super().__init__()
+        self.add_started = asyncio.Event()
+        self.release_add = asyncio.Event()
+        self.active_mutations = 0
+        self.max_active_mutations = 0
+
+    async def add_assignee(
+        self,
+        owner: str,
+        repository: str,
+        number: int,
+        login: str,
+    ) -> None:
+        self.active_mutations += 1
+        self.max_active_mutations = max(
+            self.max_active_mutations,
+            self.active_mutations,
+        )
+        self.add_started.set()
+        try:
+            await self.release_add.wait()
+            await super().add_assignee(owner, repository, number, login)
+        finally:
+            self.active_mutations -= 1
+
+    async def redeliver(self, delivery_id: int) -> None:
+        self.active_mutations += 1
+        self.max_active_mutations = max(
+            self.max_active_mutations,
+            self.active_mutations,
+        )
+        try:
+            await asyncio.sleep(0)
+            await super().redeliver(delivery_id)
+        finally:
+            self.active_mutations -= 1
+
+
+class _BlockingRecoveryClient(_Client):
+    def __init__(self) -> None:
+        super().__init__()
+        self.first_list_started = asyncio.Event()
+        self.release_first_list = asyncio.Event()
+
+    async def list_deliveries(self, *, page: int = 1) -> tuple[object, ...]:
+        self.listed_pages.append(page)
+        if len(self.listed_pages) == 1:
+            self.first_list_started.set()
+            await self.release_first_list.wait()
+            return ()
+        return self.pages.get(page, ())
+
+
+class _Reporter:
+    def __init__(self) -> None:
+        self.reports: list[dict[str, object]] = []
+
+    async def report(self, **kwargs) -> None:
+        self.reports.append(kwargs)
+
+
+class _Bot:
+    def __init__(self, reporter: _Reporter | None = None) -> None:
+        self.reporter = reporter
+
+    def get_cog(self, name: str) -> _Reporter | None:
+        return self.reporter
+
+
+async def _wait_until(predicate, *, timeout: float = 1.0) -> None:
+    async def wait() -> None:
+        while not await predicate():  # noqa: ASYNC110
+            await asyncio.sleep(0)
+
+    await asyncio.wait_for(wait(), timeout=timeout)
+
+
+class GitHubIntegrationRuntimeTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self) -> None:
+        self.directory = TemporaryDirectory()
+        self.modules_context = isolated_githubtickets_modules(Path(self.directory.name))
+        self.modules = self.modules_context.__enter__()
+        self.store = self.modules.store.GitHubTicketsStore(
+            Path(self.directory.name) / "githubtickets.sqlite"
+        )
+        await self.store.initialize()
+        self.now = datetime(2026, 8, 29, 10, 0, tzinfo=timezone.utc)
+        self.runtime = None
+
+    async def asyncTearDown(self) -> None:
+        if self.runtime is not None:
+            await self.runtime.close()
+        self.modules_context.__exit__(None, None, None)
+        self.directory.cleanup()
+
+    async def _accept_delivery(self, guid: str) -> None:
+        self.assertTrue(
+            await self.store.accept_delivery(
+                delivery_guid=guid,
+                github_delivery_id=None,
+                event="pull_request",
+                action="labeled",
+                installation_id=123,
+                repository_id=100,
+                pr_number=7,
+                received_at=self.now,
+                raw_body=b'{"pull_request":{"number":7}}',
+            )
+        )
+
+    async def _create_add_outbox_intent(self) -> int:
+        pull_request = self.modules.models.GitHubPullRequest(
+            repository_id=100,
+            pr_number=7,
+            github_pr_id=700,
+            github_author_id=900,
+            repository_full_name=" NewHorizons/NHCogs ",
+            url="https://github.com/NewHorizons/NHCogs/pull/7",
+            title="Add GitHub App integration",
+            github_author_login="author",
+            draft=False,
+            open=True,
+            labels=("discord-ticket",),
+            github_updated_at=self.now,
+        )
+        ticket = await self.store.create_ticket_for_pull_request(
+            self.modules.models.NewTicket(
+                guild_id=10,
+                channel_id=20,
+                author_id=30,
+                pr_title=pull_request.title,
+                pr_url=pull_request.url,
+                category_display="",
+                routing_mode=self.modules.models.RoutingMode.NONE,
+                direct_target_id=None,
+                category_ids=(),
+                created_at=self.now,
+                origin=self.modules.models.TicketOrigin.GITHUB,
+            ),
+            pull_request,
+        )
+        await self.store.activate_ticket(
+            ticket.ticket_id,
+            message_id=40,
+            thread_id=50,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        self.assertTrue(
+            await self.store.claim_with_github_assignment(
+                ticket.ticket_id,
+                assignee_id=60,
+                github_login=" Reviewer ",
+                github_write_required=True,
+                protection_until=self.now,
+                updated_at=self.now,
+            )
+        )
+        return ticket.ticket_id
+
+    async def _create_add_and_remove_outbox_intents(self) -> None:
+        ticket_id = await self._create_add_outbox_intent()
+        self.assertEqual(
+            await self.store.unassign_with_github_outbox(
+                ticket_id,
+                protection_until=self.now,
+                next_action=None,
+                next_action_at=None,
+                updated_at=self.now + timedelta(seconds=1),
+            ),
+            60,
+        )
+
+    async def test_delivery_handler_disposition_completes_processed_and_ignored_work(
+        self,
+    ) -> None:
+        await self._accept_delivery("processed-delivery")
+        await self._accept_delivery("ignored-delivery")
+        handled: list[str] = []
+
+        async def handle(delivery):
+            handled.append(delivery.delivery_guid)
+            if delivery.delivery_guid == "ignored-delivery":
+                return self.modules.runtime.DeliveryDisposition.IGNORED
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=_Client(),
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0,
+        )
+        self.assertEqual(await self.runtime.start("127.0.0.1", 8080), 8080)
+
+        async def both_handled() -> bool:
+            processed = await self.store.get_delivery("processed-delivery")
+            ignored = await self.store.get_delivery("ignored-delivery")
+            return (
+                len(handled) == 2
+                and processed.state is self.modules.models.GitHubDeliveryState.PROCESSED
+                and ignored.state is self.modules.models.GitHubDeliveryState.IGNORED
+            )
+
+        await _wait_until(both_handled)
+        processed = await self.store.get_delivery("processed-delivery")
+        ignored = await self.store.get_delivery("ignored-delivery")
+        self.assertEqual(
+            processed.state,
+            self.modules.models.GitHubDeliveryState.PROCESSED,
+        )
+        self.assertEqual(
+            ignored.state,
+            self.modules.models.GitHubDeliveryState.IGNORED,
+        )
+        self.assertIsNone(processed.raw_body)
+        self.assertIsNone(ignored.raw_body)
+
+    async def test_lifecycle_delivery_stops_runtime_without_self_await(self) -> None:
+        await self.store.accept_delivery(
+            delivery_guid="installation-suspended",
+            github_delivery_id=None,
+            event="installation",
+            action="suspend",
+            installation_id=123,
+            repository_id=None,
+            pr_number=None,
+            received_at=self.now,
+            raw_body=b'{"action":"suspend"}',
+        )
+        reporter = _Reporter()
+        client = _Client()
+        receiver = _Receiver()
+        owner_stopped = []
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.STOPPED
+
+        async def lifecycle_stopped(runtime):
+            owner_stopped.append(runtime)
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=receiver,
+            delivery_handler=handle,
+            lifecycle_stopped=lifecycle_stopped,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            recovery_interval=timedelta(milliseconds=1),
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def delivery_completed() -> bool:
+            stored = await self.store.get_delivery("installation-suspended")
+            return (
+                stored.state is self.modules.models.GitHubDeliveryState.PROCESSED
+                and receiver.closed.is_set()
+                and client.token_invalidations == 1
+                and len(reporter.reports) == 1
+                and owner_stopped == [self.runtime]
+            )
+
+        await _wait_until(delivery_completed)
+        self.assertTrue(receiver.closed.is_set())
+        self.assertEqual(client.token_invalidations, 1)
+        self.assertEqual(owner_stopped, [self.runtime])
+        self.assertEqual(len(reporter.reports), 1)
+        self.assertEqual(
+            reporter.reports[0]["action"],
+            "stop GitHub integration after installation suspend",
+        )
+        github_calls = (tuple(client.listed_pages), tuple(client.redelivered))
+        await asyncio.sleep(0.01)
+        self.assertEqual(
+            (tuple(client.listed_pages), tuple(client.redelivered)),
+            github_calls,
+        )
+        await asyncio.wait_for(self.runtime.close(), timeout=1)
+        self.runtime = None
+
+    async def test_lifecycle_stop_survives_receiver_cleanup_failure(self) -> None:
+        await self.store.accept_delivery(
+            delivery_guid="installation-deleted",
+            github_delivery_id=None,
+            event="installation",
+            action="deleted",
+            installation_id=123,
+            repository_id=None,
+            pr_number=None,
+            received_at=self.now,
+            raw_body=b'{"action":"deleted"}',
+        )
+        reporter = _Reporter()
+        client = _Client()
+        receiver = _FailingCloseReceiver()
+        owner_stopped = asyncio.Event()
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.STOPPED
+
+        async def lifecycle_stopped(runtime):
+            owner_stopped.set()
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=receiver,
+            delivery_handler=handle,
+            lifecycle_stopped=lifecycle_stopped,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            recovery_interval=timedelta(milliseconds=1),
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        await asyncio.wait_for(owner_stopped.wait(), timeout=1)
+
+        self.assertEqual(client.token_invalidations, 1)
+        self.assertEqual(receiver.close_attempts, 1)
+        self.assertEqual(
+            [report["action"] for report in reporter.reports],
+            [
+                "close GitHub webhook receiver after lifecycle event",
+                "stop GitHub integration after installation deleted",
+            ],
+        )
+
+    async def test_delivery_failure_is_reported_and_deferred_without_blocking_later_work(
+        self,
+    ) -> None:
+        await self._accept_delivery("a-failing-delivery")
+        await self._accept_delivery("b-successful-delivery")
+        reporter = _Reporter()
+
+        async def handle(delivery):
+            if delivery.delivery_guid == "a-failing-delivery":
+                raise RuntimeError("handler failed")
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=_Client(),
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0,
+            retry_base=timedelta(seconds=30),
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def later_work_completed() -> bool:
+            delivery = await self.store.get_delivery("b-successful-delivery")
+            return (
+                delivery is not None
+                and delivery.state is self.modules.models.GitHubDeliveryState.PROCESSED
+            )
+
+        await _wait_until(later_work_completed)
+        failed = await self.store.get_delivery("a-failing-delivery")
+        self.assertEqual(failed.state, self.modules.models.GitHubDeliveryState.RETRY)
+        self.assertEqual(failed.attempts, 1)
+        self.assertGreaterEqual(
+            failed.next_attempt_at,
+            self.now + timedelta(seconds=15),
+        )
+        self.assertLessEqual(
+            failed.next_attempt_at,
+            self.now + timedelta(seconds=45),
+        )
+        self.assertEqual(len(reporter.reports), 1)
+        self.assertEqual(reporter.reports[0]["source"], "GitHubTickets")
+        self.assertIsInstance(reporter.reports[0]["error"], RuntimeError)
+
+    async def test_stale_processing_delivery_is_reclaimed_after_restart(self) -> None:
+        await self._accept_delivery("stale-delivery")
+        claimed = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(claimed.attempts, 1)
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=_Client(),
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now + timedelta(minutes=10),
+            poll_interval=0.001,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def reclaimed() -> bool:
+            stored = await self.store.get_delivery("stale-delivery")
+            return stored.state is self.modules.models.GitHubDeliveryState.PROCESSED
+
+        await _wait_until(reclaimed)
+        stored = await self.store.get_delivery("stale-delivery")
+        self.assertEqual(stored.attempts, 2)
+
+    async def test_delivery_failure_terminally_fails_at_attempt_limit(self) -> None:
+        await self._accept_delivery("attempt-limited-delivery")
+        claimed = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertTrue(
+            await self.store.defer_delivery(
+                claimed.delivery_guid,
+                next_attempt_at=self.now,
+                error_summary="prepare attempt limit",
+            )
+        )
+        reporter = _Reporter()
+
+        async def handle(delivery):
+            raise RuntimeError("still failing")
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=_Client(),
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            max_delivery_attempts=2,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def terminally_failed() -> bool:
+            stored = await self.store.get_delivery("attempt-limited-delivery")
+            return stored.state is self.modules.models.GitHubDeliveryState.FAILED
+
+        await _wait_until(terminally_failed)
+        stored = await self.store.get_delivery("attempt-limited-delivery")
+        self.assertEqual(stored.attempts, 2)
+        self.assertEqual(len(reporter.reports), 1)
+
+    async def test_delivery_github_failure_uses_structured_retry_policy(self) -> None:
+        cases = (
+            (
+                "validation",
+                self.modules.github_app.GitHubRequestError(
+                    "read pull request",
+                    422,
+                ),
+                self.modules.models.GitHubDeliveryState.FAILED,
+                None,
+            ),
+            (
+                "rate-limit",
+                self.modules.github_app.GitHubRequestError(
+                    "read pull request",
+                    429,
+                    retryable=True,
+                    rate_limited=True,
+                    retry_at=self.now + timedelta(hours=1),
+                ),
+                self.modules.models.GitHubDeliveryState.RETRY,
+                self.now + timedelta(hours=1),
+            ),
+        )
+        for index, (name, error, expected_state, expected_retry_at) in enumerate(cases):
+            with self.subTest(name=name):
+                guid = f"github-failure-{index}"
+                await self._accept_delivery(guid)
+
+                async def handle(delivery, *, raised=error):
+                    raise raised
+
+                runtime = self.modules.runtime.GitHubIntegrationRuntime(
+                    self.store,
+                    client=_Client(),
+                    receiver=_Receiver(),
+                    delivery_handler=handle,
+                    bot=_Bot(_Reporter()),
+                    guild_id=10,
+                    clock=lambda: self.now,
+                    poll_interval=0.001,
+                    max_delivery_attempts=5,
+                )
+                await runtime.start("127.0.0.1", 8080)
+
+                async def settled(delivery_guid=guid) -> bool:
+                    stored = await self.store.get_delivery(delivery_guid)
+                    return stored.state in {
+                        self.modules.models.GitHubDeliveryState.FAILED,
+                        self.modules.models.GitHubDeliveryState.RETRY,
+                    }
+
+                try:
+                    await _wait_until(settled)
+                    stored = await self.store.get_delivery(guid)
+                    self.assertIs(stored.state, expected_state)
+                    self.assertEqual(stored.next_attempt_at, expected_retry_at)
+                finally:
+                    await runtime.close()
+
+    async def test_recovery_redelivers_failed_summaries_and_local_failures(self) -> None:
+        local_states = {
+            "local-failed": "failed",
+            "local-retry": "retry",
+            "summary-failed": "processed",
+            "known-pending": "pending",
+        }
+        for guid, state in local_states.items():
+            await self._accept_delivery(guid)
+            if state == "pending":
+                continue
+            claimed = await self.store.claim_next_delivery(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+            self.assertEqual(claimed.delivery_guid, guid)
+            if state == "failed":
+                await self.store.fail_delivery(
+                    guid,
+                    completed_at=self.now,
+                    error_summary="failed",
+                )
+            elif state == "retry":
+                await self.store.defer_delivery(
+                    guid,
+                    next_attempt_at=self.now + timedelta(minutes=5),
+                    error_summary="retry",
+                )
+            else:
+                await self.store.complete_delivery(
+                    guid,
+                    completed_at=self.now,
+                    ignored=False,
+                )
+        summary = self.modules.github_app.GitHubDeliverySummary
+        delivered_at = self.now - timedelta(minutes=1)
+        client = _Client(
+            {
+                1: (
+                    summary(1, "local-failed", delivered_at, False, 200, "ping", None),
+                    summary(2, "local-retry", delivered_at, False, 200, "ping", None),
+                    summary(3, "summary-failed", delivered_at, False, 500, "ping", None),
+                    summary(4, "known-pending", delivered_at, False, 200, "ping", None),
+                    summary(5, "missing", delivered_at, False, 200, "ping", None),
+                )
+            }
+        )
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+        )
+
+        await self.runtime.run_recovery()
+
+        self.assertEqual(client.redelivered, [1, 5])
+        awaiting = await self.store.get_delivery("local-failed")
+        self.assertIsNotNone(awaiting)
+        assert awaiting is not None
+        self.assertEqual(
+            awaiting.state,
+            self.modules.models.GitHubDeliveryState.AWAITING_REDELIVERY,
+        )
+        self.assertIsNotNone(awaiting.raw_body)
+        local_retry = await self.store.get_delivery("local-retry")
+        self.assertIsNotNone(local_retry)
+        assert local_retry is not None
+        self.assertEqual(
+            local_retry.state,
+            self.modules.models.GitHubDeliveryState.RETRY,
+        )
+
+    async def test_recovery_rate_limit_stops_further_github_mutations(self) -> None:
+        summary = self.modules.github_app.GitHubDeliverySummary
+        delivered_at = self.now - timedelta(minutes=1)
+        retry_at = self.now + timedelta(hours=1)
+        client = _FailingRedeliveryClient(
+            {
+                1: (
+                    summary(1, "missing-one", delivered_at, False, 500, "ping", None),
+                    summary(2, "missing-two", delivered_at, False, 500, "ping", None),
+                )
+            },
+            {
+                1: self.modules.github_app.GitHubRequestError(
+                    "redeliver delivery",
+                    429,
+                    retryable=True,
+                    rate_limited=True,
+                    retry_at=retry_at,
+                )
+            },
+        )
+        reporter = _Reporter()
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+        )
+
+        await self.runtime.run_recovery()
+        await self.runtime.run_recovery()
+
+        self.assertEqual(client.redelivery_attempts, [1])
+        self.assertEqual(client.listed_pages, [1])
+        self.assertEqual(len(reporter.reports), 1)
+
+    async def test_terminal_redelivery_failure_stops_batch_and_advances_checkpoint(
+        self,
+    ) -> None:
+        await self._accept_delivery("terminal-local")
+        claimed = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertTrue(
+            await self.store.fail_delivery(
+                claimed.delivery_guid,
+                completed_at=self.now,
+                error_summary="local terminal failure",
+            )
+        )
+        summary = self.modules.github_app.GitHubDeliverySummary
+        client = _FailingRedeliveryClient(
+            {
+                1: (
+                    summary(1, "terminal-local", self.now, False, 500, "ping", None),
+                    summary(2, "missing-later", self.now, False, 500, "ping", None),
+                )
+            },
+            {
+                1: self.modules.github_app.GitHubRequestError(
+                    "redeliver delivery",
+                    422,
+                )
+            },
+        )
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(_Reporter()),
+            guild_id=10,
+            clock=lambda: self.now,
+        )
+
+        await self.runtime.run_recovery()
+
+        self.assertEqual(client.redelivery_attempts, [1])
+        failed = await self.store.get_delivery("terminal-local")
+        self.assertEqual(failed.state, self.modules.models.GitHubDeliveryState.FAILED)
+        self.assertIsNotNone(failed.raw_body)
+        self.assertEqual(
+            await self.store.get_delivery_recovery_checkpoint(),
+            (1, 1),
+        )
+
+    async def test_transient_redelivery_failure_stops_batch_and_backs_off(self) -> None:
+        await self._accept_delivery("transient-local")
+        claimed = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertTrue(
+            await self.store.fail_delivery(
+                claimed.delivery_guid,
+                completed_at=self.now,
+                error_summary="local transient failure",
+            )
+        )
+        summary = self.modules.github_app.GitHubDeliverySummary
+        client = _FailingRedeliveryClient(
+            {
+                1: (
+                    summary(1, "transient-local", self.now, False, 500, "ping", None),
+                    summary(2, "missing-later", self.now, False, 500, "ping", None),
+                )
+            },
+            {
+                1: self.modules.github_app.GitHubRequestError(
+                    "redeliver delivery",
+                    503,
+                    retryable=True,
+                )
+            },
+        )
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(_Reporter()),
+            guild_id=10,
+            clock=lambda: self.now,
+            retry_base=timedelta(seconds=30),
+        )
+
+        await self.runtime.run_recovery()
+        await self.runtime.run_recovery()
+
+        self.assertEqual(client.redelivery_attempts, [1])
+        failed = await self.store.get_delivery("transient-local")
+        self.assertEqual(failed.state, self.modules.models.GitHubDeliveryState.FAILED)
+        self.assertIsNotNone(failed.raw_body)
+        self.assertGreaterEqual(
+            failed.next_attempt_at,
+            self.now + timedelta(seconds=15),
+        )
+        self.assertLessEqual(
+            failed.next_attempt_at,
+            self.now + timedelta(seconds=45),
+        )
+        self.assertEqual(
+            await self.store.get_delivery_recovery_checkpoint(),
+            (1, None),
+        )
+
+    async def test_recovery_checkpoint_continues_older_pages_after_restart(self) -> None:
+        summary = self.modules.github_app.GitHubDeliverySummary
+        delivered_at = self.now - timedelta(minutes=1)
+        page_one = tuple(
+            summary(
+                index,
+                f"already-redelivered-{index}",
+                delivered_at,
+                True,
+                200,
+                "ping",
+                None,
+            )
+            for index in range(1, 101)
+        )
+        page_two = (
+            summary(101, "older-missing", delivered_at, False, 200, "ping", None),
+        )
+        first_client = _Client({1: page_one, 2: page_two})
+        first_runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=first_client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            max_recovery_pages=1,
+        )
+        await first_runtime.run_recovery()
+        await first_runtime.close()
+
+        second_client = _Client({1: page_one, 2: page_two})
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=second_client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            max_recovery_pages=1,
+        )
+
+        await self.runtime.run_recovery()
+
+        self.assertEqual(first_client.listed_pages, [1])
+        self.assertEqual(second_client.listed_pages, [2])
+        self.assertEqual(second_client.redelivered, [101])
+
+    async def test_recovery_paginates_and_redelivers_only_recent_missing_deliveries(
+        self,
+    ) -> None:
+        for guid in ("failed-local", "successful-local"):
+            await self._accept_delivery(guid)
+        summary = self.modules.github_app.GitHubDeliverySummary
+        delivered_at = self.now - timedelta(minutes=1)
+        page_one = [
+            summary(1, "missing-success", delivered_at, False, 200, "ping", None),
+            summary(2, "failed-local", delivered_at, False, 500, "ping", None),
+            summary(3, "successful-local", delivered_at, False, 200, "ping", None),
+            summary(4, "redelivery-missing", delivered_at, True, 500, "ping", None),
+            summary(
+                5,
+                "expired-missing",
+                self.now - timedelta(days=8),
+                False,
+                500,
+                "ping",
+                None,
+            ),
+        ]
+        page_one.extend(
+            summary(
+                10 + index,
+                f"redelivery-{index}",
+                delivered_at,
+                True,
+                200,
+                "ping",
+                None,
+            )
+            for index in range(95)
+        )
+        page_two = (summary(200, "later-failure", delivered_at, False, 502, "ping", None),)
+        client = _Client({1: tuple(page_one), 2: page_two})
+        handled: list[str] = []
+
+        async def handle(delivery):
+            handled.append(delivery.delivery_guid)
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0,
+        )
+
+        await self.runtime.run_recovery()
+
+        self.assertEqual(client.listed_pages, [1, 2])
+        self.assertEqual(client.redelivered, [1, 4, 200])
+        self.assertEqual(handled, [])
+
+    async def test_recovery_applies_delivery_retention(self) -> None:
+        await self._accept_delivery("retained-failure")
+        await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertTrue(
+            await self.store.fail_delivery(
+                "retained-failure",
+                completed_at=self.now,
+                error_summary="failed",
+            )
+        )
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=_Client(),
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now + timedelta(days=4),
+            poll_interval=0.001,
+        )
+        await self.runtime.run_recovery()
+
+        retained = await self.store.get_delivery("retained-failure")
+        self.assertIsNotNone(retained)
+        self.assertIsNone(retained.raw_body)
+
+    async def test_periodic_recovery_runs_and_close_stops_receiver_first(self) -> None:
+        await self._accept_delivery("close-order-delivery")
+        receiver = _Receiver()
+        client = _Client()
+        handler_started = asyncio.Event()
+        cancelled_after_receiver_close: list[bool] = []
+
+        async def handle(delivery):
+            handler_started.set()
+            try:
+                await asyncio.Event().wait()
+            except asyncio.CancelledError:
+                cancelled_after_receiver_close.append(receiver.closed.is_set())
+                raise
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=receiver,
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            recovery_interval=timedelta(milliseconds=1),
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+        await asyncio.wait_for(handler_started.wait(), timeout=1)
+
+        async def recovered_twice() -> bool:
+            return len(client.listed_pages) >= 2
+
+        await _wait_until(recovered_twice)
+        await self.runtime.close()
+        self.runtime = None
+        stored = await self.store.get_delivery("close-order-delivery")
+        self.assertEqual(receiver.events[0], ("start", "127.0.0.1", 8080))
+        self.assertEqual(receiver.events[-1], "close")
+        self.assertEqual(cancelled_after_receiver_close, [True])
+        self.assertEqual(stored.state, self.modules.models.GitHubDeliveryState.PROCESSING)
+
+    async def test_recovery_request_wakes_recovery_before_the_interval(self) -> None:
+        client = _Client()
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            recovery_interval=timedelta(hours=1),
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def recovered_once() -> bool:
+            return len(client.listed_pages) >= 1
+
+        await _wait_until(recovered_once)
+        self.runtime.request_recovery()
+
+        async def recovered_twice() -> bool:
+            return len(client.listed_pages) >= 2
+
+        await _wait_until(recovered_twice)
+
+    async def test_missing_credentials_leave_runtime_dormant_and_half_configuration_is_rejected(
+        self,
+    ) -> None:
+        await self._accept_delivery("dormant-delivery")
+        handled: list[str] = []
+
+        async def handle(delivery):
+            handled.append(delivery.delivery_guid)
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=None,
+            receiver=None,
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0,
+        )
+        self.assertIsNone(await self.runtime.start("127.0.0.1", 8080))
+        await asyncio.sleep(0)
+        stored = await self.store.get_delivery("dormant-delivery")
+        self.assertEqual(stored.state, self.modules.models.GitHubDeliveryState.PENDING)
+        self.assertEqual(handled, [])
+        with self.assertRaisesRegex(ValueError, "configured together"):
+            self.modules.runtime.GitHubIntegrationRuntime(
+                self.store,
+                client=_Client(),
+                receiver=None,
+                delivery_handler=handle,
+                bot=_Bot(),
+                guild_id=10,
+                clock=lambda: self.now,
+            )
+
+    async def test_outbox_executes_add_and_remove_assignee_intents_in_order(
+        self,
+    ) -> None:
+        await self._create_add_and_remove_outbox_intents()
+        client = _Client()
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now + timedelta(minutes=1),
+            poll_interval=0.001,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def both_mutations_completed() -> bool:
+            return len(client.mutations) == 2
+
+        await _wait_until(both_mutations_completed)
+        self.assertEqual(
+            client.mutations,
+            [
+                ("add", "NewHorizons", "NHCogs", 7, "reviewer"),
+                ("remove", "NewHorizons", "NHCogs", 7, "reviewer"),
+            ],
+        )
+
+    async def test_outbox_and_recovery_share_one_github_mutation_lock(self) -> None:
+        await self._create_add_outbox_intent()
+        client = _SerializingClient()
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+        await asyncio.wait_for(client.add_started.wait(), timeout=1)
+        summary = self.modules.github_app.GitHubDeliverySummary(
+            99,
+            "missing-during-add",
+            self.now,
+            False,
+            200,
+            "ping",
+            None,
+        )
+        client.pages[1] = (summary,)
+        recovery = asyncio.create_task(self.runtime.run_recovery())
+        await asyncio.sleep(0)
+        self.assertEqual(client.redelivered, [])
+        self.assertEqual(client.max_active_mutations, 1)
+
+        client.release_add.set()
+        await asyncio.wait_for(recovery, timeout=1)
+
+        async def redelivered_once() -> bool:
+            return client.redelivered == [99]
+
+        await _wait_until(redelivered_once)
+        self.assertEqual(client.redelivered, [99])
+        self.assertEqual(client.max_active_mutations, 1)
+
+    async def test_overlapping_recovery_requests_coalesce_into_a_follow_up_pass(
+        self,
+    ) -> None:
+        client = _BlockingRecoveryClient()
+        summary = self.modules.github_app.GitHubDeliverySummary(
+            99,
+            "arrived-during-recovery",
+            self.now,
+            False,
+            200,
+            "ping",
+            None,
+        )
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=lambda delivery: None,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now,
+        )
+        first = asyncio.create_task(self.runtime.run_recovery())
+        await asyncio.wait_for(client.first_list_started.wait(), timeout=1)
+        client.pages[1] = (summary,)
+
+        await self.runtime.run_recovery()
+        client.release_first_list.set()
+        await asyncio.wait_for(first, timeout=1)
+
+        self.assertEqual(client.listed_pages, [1, 1])
+        self.assertEqual(client.redelivered, [99])
+
+    async def test_outbox_intent_survives_guild_cleanup_and_executes_without_lookup(
+        self,
+    ) -> None:
+        await self._create_add_outbox_intent()
+        claimed = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertIsNotNone(claimed)
+        assert claimed is not None
+        self.assertTrue(await self.store.delete_guild_state(10))
+        self.assertIsNone(await self.store.get_pull_request(100, 7))
+        preserved = await self.store.get_outbox_item(claimed.outbox_id)
+        self.assertEqual(preserved.repository_full_name, "NewHorizons/NHCogs")
+        client = _Client()
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(),
+            guild_id=10,
+            clock=lambda: self.now + timedelta(minutes=10),
+            poll_interval=0.001,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def mutation_completed() -> bool:
+            stored = await self.store.get_outbox_item(claimed.outbox_id)
+            return (
+                len(client.mutations) == 1
+                and stored.state is self.modules.models.GitHubOutboxState.SUCCEEDED
+            )
+
+        await _wait_until(mutation_completed)
+        self.assertEqual(
+            client.mutations,
+            [("add", "NewHorizons", "NHCogs", 7, "reviewer")],
+        )
+
+    async def test_unavailable_assignee_is_reported_and_terminally_fails_outbox(
+        self,
+    ) -> None:
+        await self._create_add_outbox_intent()
+        item = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertIsNotNone(item)
+        assert item is not None
+        reporter = _Reporter()
+        client = _FailingAddClient(self.modules.github_app.GitHubAssigneeUnavailable("reviewer"))
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now + timedelta(minutes=10),
+            poll_interval=0.001,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def terminally_failed() -> bool:
+            stored = await self.store.get_outbox_item(item.outbox_id)
+            return stored.state is self.modules.models.GitHubOutboxState.FAILED
+
+        await _wait_until(terminally_failed)
+        stored = await self.store.get_outbox_item(item.outbox_id)
+        self.assertEqual(stored.attempts, 2)
+        self.assertEqual(len(reporter.reports), 1)
+        self.assertIsInstance(
+            reporter.reports[0]["error"],
+            self.modules.github_app.GitHubAssigneeUnavailable,
+        )
+
+    async def test_retryable_github_failure_honors_retry_at_and_keeps_local_transition(
+        self,
+    ) -> None:
+        ticket_id = await self._create_add_outbox_intent()
+        item = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertIsNotNone(item)
+        assert item is not None
+        self.assertTrue(
+            await self.store.defer_outbox(
+                item.outbox_id,
+                next_attempt_at=self.now,
+                error_summary="prepare retry test",
+            )
+        )
+        retry_at = self.now + timedelta(hours=1)
+        reporter = _Reporter()
+        client = _FailingAddClient(
+            self.modules.github_app.GitHubRequestError(
+                "add assignee",
+                429,
+                retryable=True,
+                rate_limited=True,
+                retry_at=retry_at,
+            )
+        )
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(reporter),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            max_outbox_attempts=3,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def deferred() -> bool:
+            stored = await self.store.get_outbox_item(item.outbox_id)
+            return (
+                stored.state is self.modules.models.GitHubOutboxState.RETRY and stored.attempts == 2
+            )
+
+        await _wait_until(deferred)
+        stored = await self.store.get_outbox_item(item.outbox_id)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(stored.next_attempt_at, retry_at)
+        self.assertEqual(ticket.state, self.modules.models.TicketState.CLAIMED)
+        self.assertEqual(ticket.assignee_id, 60)
+        self.assertEqual(len(reporter.reports), 1)
+
+    async def test_retryable_github_failure_terminally_fails_at_attempt_limit(
+        self,
+    ) -> None:
+        await self._create_add_outbox_intent()
+        item = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertIsNotNone(item)
+        assert item is not None
+        self.assertTrue(
+            await self.store.defer_outbox(
+                item.outbox_id,
+                next_attempt_at=self.now,
+                error_summary="prepare attempt limit",
+            )
+        )
+        client = _FailingAddClient(
+            self.modules.github_app.GitHubRequestError(
+                "add assignee",
+                503,
+                retryable=True,
+            )
+        )
+
+        async def handle(delivery):
+            return self.modules.runtime.DeliveryDisposition.PROCESSED
+
+        self.runtime = self.modules.runtime.GitHubIntegrationRuntime(
+            self.store,
+            client=client,
+            receiver=_Receiver(),
+            delivery_handler=handle,
+            bot=_Bot(_Reporter()),
+            guild_id=10,
+            clock=lambda: self.now,
+            poll_interval=0.001,
+            max_outbox_attempts=2,
+        )
+        await self.runtime.start("127.0.0.1", 8080)
+
+        async def terminally_failed() -> bool:
+            stored = await self.store.get_outbox_item(item.outbox_id)
+            return stored.state is self.modules.models.GitHubOutboxState.FAILED
+
+        await _wait_until(terminally_failed)
+        stored = await self.store.get_outbox_item(item.outbox_id)
+        self.assertEqual(stored.attempts, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_github_tickets_commands.py b/tests/test_github_tickets_commands.py
index deadfab..e2b7f70 100644
--- a/tests/test_github_tickets_commands.py
+++ b/tests/test_github_tickets_commands.py
@@ -8,6 +8,8 @@
 from tests.githubtickets_loader import isolated_githubtickets_modules
 
 COMMAND_SIGNATURES = {
+    "githubtickets github receiver set": "<host> <port>",
+    "githubtickets github recovery interval": "<duration>",
     "githubtickets channel set": "<channel>",
     "githubtickets logchannel set": "<channel>",
     "githubtickets role add": "<role>",
@@ -129,6 +131,15 @@ async def test_registers_only_the_accepted_prefix_command_tree(self):
                 "githubtickets timing direct",
                 "githubtickets profile",
                 "githubtickets profile clear",
+                "githubtickets github",
+                "githubtickets github enable",
+                "githubtickets github disable",
+                "githubtickets github receiver",
+                "githubtickets github receiver set",
+                "githubtickets github receiver clear",
+                "githubtickets github recovery",
+                "githubtickets github recovery interval",
+                "githubtickets github recovery run",
             },
         )
         self.assertEqual(
@@ -232,6 +243,11 @@ async def test_public_bare_group_hides_configuration_without_reading_it(self):
                     "_send_configuration_overview",
                     new=mock.AsyncMock(),
                 ) as configuration_sender,
+                mock.patch.object(
+                    cog,
+                    "_send_github_configuration_overview",
+                    new=mock.AsyncMock(),
+                ),
                 mock.patch.object(
                     modules.githubtickets.discord,
                     "Embed",
@@ -269,6 +285,11 @@ async def test_every_bare_subgroup_shows_its_commands(self):
                     "_send_configuration_overview",
                     new=mock.AsyncMock(),
                 ) as configuration_sender,
+                mock.patch.object(
+                    cog,
+                    "_send_github_configuration_overview",
+                    new=mock.AsyncMock(),
+                ) as github_configuration_sender,
                 mock.patch.object(
                     modules.githubtickets.discord,
                     "Embed",
@@ -297,7 +318,16 @@ async def test_every_bare_subgroup_shows_its_commands(self):
                         if group.qualified_name == "githubtickets logchannel":
                             self.assertEqual(embed.title, "Log channel")
 
-        self.assertEqual(configuration_sender.await_count, len(groups))
+        github_groups = {
+            "githubtickets github",
+            "githubtickets github receiver",
+            "githubtickets github recovery",
+        }
+        self.assertEqual(
+            configuration_sender.await_count,
+            len(groups) - len(github_groups),
+        )
+        self.assertEqual(github_configuration_sender.await_count, len(github_groups))
 
     async def test_resource_commands_store_values_and_use_accepted_confirmations(self):
         with isolated_githubtickets_modules(self.data_path) as modules:
@@ -418,6 +448,132 @@ async def test_configuration_errors_use_only_the_accepted_copy(self):
             ],
         )
 
+    async def test_github_configuration_commands_control_the_runtime(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            cog = modules.githubtickets.GitHubTickets(SimpleNamespace())
+            ctx = FakeContext()
+            restart = mock.AsyncMock(return_value=True)
+            cog._restart_github_integration = restart
+
+            await cog.githubtickets_github_enable(ctx)
+            restart.assert_not_awaited()
+
+            await cog.githubtickets_github_receiver_set(ctx, " 127.0.0.1 ", 8080)
+            restart.assert_not_awaited()
+
+            with mock.patch.object(
+                modules.githubtickets,
+                "load_github_app_credentials",
+                new=mock.AsyncMock(return_value=None),
+            ):
+                await cog.githubtickets_github_enable(ctx)
+            restart.assert_not_awaited()
+
+            with mock.patch.object(
+                modules.githubtickets,
+                "load_github_app_credentials",
+                new=mock.AsyncMock(return_value=object()),
+            ):
+                await cog.githubtickets_github_enable(ctx)
+            restart.assert_awaited_once()
+
+            await cog.githubtickets_github_recovery_interval(ctx, "0s")
+            self.assertEqual(restart.await_count, 1)
+
+            await cog.githubtickets_github_recovery_interval(ctx, "30m")
+            self.assertEqual(restart.await_count, 2)
+
+            runtime = SimpleNamespace(request_recovery=mock.Mock())
+            cog._github_runtime = runtime
+            await cog.githubtickets_github_recovery_run(ctx)
+            runtime.request_recovery.assert_called_once_with()
+            self.assertEqual(restart.await_count, 2)
+
+            await cog.githubtickets_github_disable(ctx)
+            self.assertEqual(restart.await_count, 3)
+
+            config = await cog.config.all()
+
+        self.assertEqual(config["guild_id"], 42)
+        self.assertFalse(config["enabled"])
+        self.assertEqual(config["bind_host"], "127.0.0.1")
+        self.assertEqual(config["bind_port"], 8080)
+        self.assertEqual(config["recovery_seconds"], 30 * 60)
+
+    async def test_clearing_the_receiver_disables_and_stops_the_integration(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            cog = modules.githubtickets.GitHubTickets(SimpleNamespace())
+            ctx = FakeContext()
+            await cog.config.set_raw("enabled", value=True)
+            await cog.config.set_raw("bind_host", value="127.0.0.1")
+            await cog.config.set_raw("bind_port", value=8080)
+            restart = mock.AsyncMock(return_value=False)
+            cog._restart_github_integration = restart
+
+            await cog.githubtickets_github_receiver_clear(ctx)
+
+            config = await cog.config.all()
+
+        restart.assert_awaited_once_with()
+        self.assertFalse(config["enabled"])
+        self.assertIsNone(config["bind_host"])
+        self.assertIsNone(config["bind_port"])
+
+    async def test_invalid_github_credentials_are_not_reported_as_missing(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            cog = modules.githubtickets.GitHubTickets(SimpleNamespace())
+            ctx = FakeContext()
+            await cog.config.set_raw("bind_host", value="127.0.0.1")
+            await cog.config.set_raw("bind_port", value=8080)
+            error = modules.credentials.InvalidGitHubAppCredentials("invalid")
+
+            with (
+                mock.patch.object(
+                    modules.githubtickets,
+                    "load_github_app_credentials",
+                    new=mock.AsyncMock(side_effect=error),
+                ),
+                mock.patch.object(
+                    modules.githubtickets,
+                    "report_operational_error",
+                    new=mock.AsyncMock(),
+                ) as reporter,
+            ):
+                await cog.githubtickets_github_enable(ctx)
+                await cog._send_github_configuration_overview(ctx)
+
+        self.assertEqual(
+            [call.args[0] for call in ctx.send.await_args_list],
+            ["GitHub credentials are invalid", mock.ANY],
+        )
+        self.assertIn("Credentials: Invalid", ctx.send.await_args_list[-1].args[0])
+        reporter.assert_awaited_once()
+
+    async def test_enabled_integration_reports_missing_runtime_credentials(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            cog = modules.githubtickets.GitHubTickets(SimpleNamespace())
+            await cog.config.set_raw("guild_id", value=42)
+            await cog.config.set_raw("enabled", value=True)
+            await cog.config.set_raw("bind_host", value="127.0.0.1")
+            await cog.config.set_raw("bind_port", value=8080)
+
+            with (
+                mock.patch.object(
+                    modules.githubtickets,
+                    "load_github_app_credentials",
+                    new=mock.AsyncMock(return_value=None),
+                ),
+                mock.patch.object(
+                    modules.githubtickets,
+                    "report_operational_error",
+                    new=mock.AsyncMock(),
+                ) as reporter,
+            ):
+                started = await cog._restart_github_integration()
+
+        self.assertFalse(started)
+        reporter.assert_awaited_once()
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_github_tickets_coordinator.py b/tests/test_github_tickets_coordinator.py
index 230f9b5..685976f 100644
--- a/tests/test_github_tickets_coordinator.py
+++ b/tests/test_github_tickets_coordinator.py
@@ -60,6 +60,7 @@ def __init__(self) -> None:
         self.recovered_ping_at: datetime | None = None
         self.send_started: asyncio.Event | None = None
         self.allow_send: asyncio.Event | None = None
+        self.prompt_hook = None
 
     async def send_ticket(self, ticket, *, reviewer_github=None):
         self.calls.append(("send_ticket", ticket.ticket_id, reviewer_github))
@@ -82,9 +83,7 @@ async def find_ticket_thread(self, ticket):
         return self.recovered_thread_id
 
     async def find_ping(self, thread_id, target_user_id, automatic, reserved_at):
-        self.calls.append(
-            ("find_ping", thread_id, target_user_id, automatic, reserved_at)
-        )
+        self.calls.append(("find_ping", thread_id, target_user_id, automatic, reserved_at))
         if error := self.errors.get("find_ping"):
             raise error
         return self.recovered_ping_at
@@ -97,10 +96,18 @@ async def create_thread(self, ticket, message_id):
         self.next_thread_id += 1
         return thread_id
 
+    async def prompt_categories(self, ticket, thread_id):
+        self.calls.append(("prompt_categories", ticket.ticket_id, thread_id, ticket.author_id))
+        if self.prompt_hook is not None:
+            await self.prompt_hook(ticket)
+        if error := self.errors.get("prompt_categories"):
+            raise error
+
+    async def prompt_draft_decision(self, ticket):
+        self.calls.append(("prompt_draft_decision", ticket.ticket_id, ticket.thread_id))
+
     async def edit_ticket(self, ticket, *, reviewer_github=None):
-        self.calls.append(
-            ("edit_ticket", ticket.ticket_id, ticket.state, reviewer_github)
-        )
+        self.calls.append(("edit_ticket", ticket.ticket_id, ticket.state, reviewer_github))
         if "edit_ticket" in self.not_found_operations:
             raise projection_module.ProjectionNotFound
         if error := self.errors.get("edit_ticket"):
@@ -196,6 +203,38 @@ def request(self, routing_mode=None, direct_target_id=None):
             category_ids=(self.category.category_id,),
         )
 
+    def pull_request(self, *, repository_id=100, pr_number=7, author_id=900):
+        return models.GitHubPullRequest(
+            repository_id=repository_id,
+            pr_number=pr_number,
+            github_pr_id=700 + pr_number,
+            repository_full_name="GTNewHorizons/Example",
+            url=f"https://github.com/GTNewHorizons/Example/pull/{pr_number}",
+            title="Automate ticket creation",
+            github_author_id=author_id,
+            github_author_login="octocat",
+            draft=False,
+            open=True,
+            labels=("discord-ticket",),
+            github_updated_at=self.now,
+            last_processed_action="labeled",
+        )
+
+    async def create_github_active(self, *, author_id=None, pull_request=None):
+        pull_request = pull_request or self.pull_request()
+        result = await self.coordinator.create_ticket_from_github(
+            10,
+            pull_request,
+            author_id=author_id,
+        )
+        self.assertTrue(result.success)
+        return (
+            await self.store.get_pull_request(
+                pull_request.repository_id,
+                pull_request.pr_number,
+            )
+        ).current_ticket_id
+
     async def create_active(self, *, routing_mode=None, direct_target_id=None):
         result = await self.coordinator.create_ticket(
             self.request(routing_mode, direct_target_id),
@@ -205,9 +244,7 @@ async def create_active(self, *, routing_mode=None, direct_target_id=None):
         return (await self.store.list_active_tickets())[-1]
 
     def candidate(self, user_id=500, *, presence=None):
-        routing_module = importlib.import_module(
-            f"{GITHUBTICKETS_PACKAGE_NAME}.routing"
-        )
+        routing_module = importlib.import_module(f"{GITHUBTICKETS_PACKAGE_NAME}.routing")
         return routing_module.CandidateFacts(
             user_id=user_id,
             is_cached_member=True,
@@ -248,6 +285,688 @@ async def test_create_enforces_participant_permission_and_publishes_once(self):
         )
         self.assertEqual(self.wake_count, 1)
 
+    async def test_github_creation_prompts_for_categories_without_author_mention(self):
+        prompt_states = []
+
+        async def capture_prompt_state(ticket):
+            current = await self.store.get_ticket(ticket.ticket_id)
+            prompt_states.append(current.state)
+
+        self.projection.prompt_hook = capture_prompt_state
+        result = await self.coordinator.create_ticket_from_github(
+            10,
+            self.pull_request(),
+            author_id=None,
+        )
+
+        self.assertTrue(result.success)
+        ticket = (await self.store.list_active_tickets())[0]
+        self.assertIsNone(ticket.author_id)
+        self.assertEqual(ticket.origin, models.TicketOrigin.GITHUB)
+        self.assertEqual(ticket.pr_title, "Automate ticket creation")
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.NONE)
+        self.assertEqual(ticket.category_ids, ())
+        self.assertIsNone(ticket.next_action)
+        binding = await self.store.get_pull_request(100, 7)
+        self.assertEqual(binding.current_ticket_id, ticket.ticket_id)
+        self.assertEqual(prompt_states, [models.TicketState.OPEN])
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("send_ticket", ticket.ticket_id, None),
+                ("create_thread", ticket.ticket_id, 300),
+                ("prompt_categories", ticket.ticket_id, 400, None),
+            ],
+        )
+
+    async def test_github_creation_prompts_mapped_author_for_categories_once(self):
+        result = await self.coordinator.create_ticket_from_github(
+            10,
+            self.pull_request(),
+            author_id=100,
+        )
+
+        self.assertTrue(result.success)
+        ticket = (await self.store.list_active_tickets())[0]
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.NONE)
+        self.assertEqual(ticket.category_ids, ())
+        self.assertIsNone(ticket.next_action)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("send_ticket", ticket.ticket_id, None),
+                ("create_thread", ticket.ticket_id, 300),
+                ("prompt_categories", ticket.ticket_id, 400, 100),
+            ],
+        )
+
+    async def test_github_category_prompt_failure_keeps_ticket_and_retries_prompt(self):
+        pull_request = self.pull_request()
+        self.projection.errors["prompt_categories"] = RuntimeError(
+            "controlled prompt failure"
+        )
+
+        created = await self.coordinator.create_ticket_from_github(
+            10,
+            pull_request,
+            author_id=None,
+        )
+
+        self.assertTrue(created.success)
+        ticket = await self.store.get_ticket(1)
+        self.assertEqual(ticket.state, models.TicketState.OPEN)
+        self.assertEqual(
+            ticket.category_prompt_retry_at,
+            self.now + timedelta(seconds=5),
+        )
+        self.assertEqual(
+            await self.store.nearest_deadline(),
+            self.now + timedelta(seconds=5),
+        )
+        self.assertEqual(
+            await self.store.due_ticket_ids(self.now + timedelta(seconds=4)),
+            (),
+        )
+        self.assertEqual(
+            await self.store.due_ticket_ids(self.now + timedelta(seconds=5)),
+            (1,),
+        )
+        self.assertEqual((await self.store.get_pull_request(100, 7)).current_ticket_id, 1)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("send_ticket", 1, None),
+                ("create_thread", 1, 300),
+                ("prompt_categories", 1, 400, None),
+            ],
+        )
+        self.assertEqual(self.wake_count, 1)
+
+        self.projection.errors.pop("prompt_categories")
+        self.projection.calls.clear()
+        self.now += timedelta(seconds=5)
+        retried = await self.coordinator.process_due(1)
+
+        self.assertTrue(retried.success)
+        ticket = await self.store.get_ticket(1)
+        self.assertIsNone(ticket.category_prompt_retry_at)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("prompt_categories", 1, 400, None),
+            ],
+        )
+
+    async def test_failed_category_prompt_does_not_block_due_projection_sync(self):
+        self.projection.errors["prompt_categories"] = RuntimeError(
+            "controlled prompt failure"
+        )
+        ticket_id = await self.create_github_active()
+        self.projection.errors["edit_ticket"] = RuntimeError("controlled edit failure")
+
+        claimed = await self.coordinator.claim(ticket_id, self.actor(200))
+
+        self.assertFalse(claimed.success)
+        self.projection.errors.pop("edit_ticket")
+        self.projection.calls.clear()
+        self.now += timedelta(seconds=5)
+
+        recovered = await self.coordinator.process_due(ticket_id)
+
+        self.assertTrue(recovered.success)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("prompt_categories", ticket_id, 400, None),
+                ("edit_ticket", ticket_id, models.TicketState.CLAIMED, None),
+            ],
+        )
+
+    async def test_github_activation_failure_deletes_prompt_thread_and_ticket(self):
+        async def lose_activation(*_args, **_kwargs):
+            return False
+
+        self.store.activate_ticket = lose_activation
+
+        result = await self.coordinator.create_ticket_from_github(
+            10,
+            self.pull_request(),
+            author_id=None,
+        )
+
+        self.assertFalse(result.success)
+        self.assertIsNone(await self.store.get_ticket(1))
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("send_ticket", 1, None),
+                ("create_thread", 1, 300),
+                ("delete_thread", 400),
+                ("delete_message", 20, 300),
+            ],
+        )
+
+    async def test_github_categories_start_strict_automatic_routing_once(self):
+        ticket_id = await self.create_github_active(author_id=100)
+        self.projection.calls.clear()
+        self.wake_count = 0
+
+        rejected = await self.coordinator.add_ticket_categories(
+            ticket_id,
+            (self.category.category_id,),
+            self.actor(200, participant=False),
+        )
+        accepted = await self.coordinator.add_ticket_categories(
+            ticket_id,
+            (self.category.category_id,),
+            self.actor(200),
+        )
+        repeated = await self.coordinator.add_ticket_categories(
+            ticket_id,
+            (self.category.category_id,),
+            self.actor(300, participant=False, staff=True),
+        )
+
+        self.assertFalse(rejected.success)
+        self.assertEqual(rejected.response, "You cannot use this action")
+        self.assertTrue(accepted.success)
+        self.assertTrue(repeated.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.AUTOMATIC)
+        self.assertEqual(ticket.category_ids, (self.category.category_id,))
+        self.assertEqual(ticket.category_display, "rendering")
+        self.assertEqual(ticket.next_action, models.NextAction.AUTOMATIC_PING)
+        self.assertEqual(ticket.next_action_at, self.now + timedelta(seconds=120))
+        self.assertEqual(
+            self.projection.calls,
+            [("edit_ticket", ticket_id, models.TicketState.OPEN, None)],
+        )
+        self.assertEqual(self.wake_count, 1)
+
+    async def test_github_categories_preserve_existing_claim(self):
+        ticket_id = await self.create_github_active(author_id=100)
+        claimed = await self.coordinator.claim(ticket_id, self.actor(500))
+        self.projection.calls.clear()
+        self.wake_count = 0
+
+        categorized = await self.coordinator.add_ticket_categories(
+            ticket_id,
+            (self.category.category_id,),
+            self.actor(200),
+        )
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(categorized.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.state, models.TicketState.CLAIMED)
+        self.assertEqual(ticket.assignee_id, 500)
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.AUTOMATIC)
+        self.assertEqual(ticket.category_ids, (self.category.category_id,))
+        self.assertIsNone(ticket.next_action)
+        self.assertIsNone(ticket.next_action_at)
+        self.assertEqual(
+            self.projection.calls,
+            [("edit_ticket", ticket_id, models.TicketState.CLAIMED, None)],
+        )
+        self.assertEqual(self.wake_count, 0)
+
+    async def test_manual_github_creation_preserves_author_categories_and_routing(self):
+        request = self.request(models.RoutingMode.DIRECT_AUTOMATIC, direct_target_id=500)
+        pull_request = self.pull_request()
+
+        result = await self.coordinator.create_ticket_for_pull_request(
+            request,
+            self.actor(),
+            pull_request,
+        )
+
+        self.assertTrue(result.success)
+        ticket = (await self.store.list_active_tickets())[0]
+        self.assertEqual(ticket.author_id, 100)
+        self.assertEqual(ticket.origin, models.TicketOrigin.DISCORD)
+        self.assertEqual(ticket.category_ids, (self.category.category_id,))
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.DIRECT_AUTOMATIC)
+        self.assertEqual(ticket.direct_target_id, 500)
+        self.assertEqual(ticket.pr_title, pull_request.title)
+        self.assertEqual(ticket.pr_url, pull_request.url)
+        binding = await self.store.get_pull_request(100, 7)
+        self.assertEqual(binding.current_ticket_id, ticket.ticket_id)
+        self.assertEqual(
+            self.projection.calls,
+            [("send_ticket", ticket.ticket_id, None), ("create_thread", ticket.ticket_id, 300)],
+        )
+
+    async def test_github_claim_and_unassign_do_not_echo_assignee_writes(self):
+        ticket_id = await self.create_github_active()
+
+        claimed = await self.coordinator.claim_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+            github_login="Reviewer",
+            github_write_required=False,
+        )
+        unassigned = await self.coordinator.unassign_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+        )
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.state, models.TicketState.OPEN)
+        self.assertIsNone(ticket.assignee_id)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+    async def test_discord_unassign_removes_github_origin_claim_after_profile_deletion(
+        self,
+    ):
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=222,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        ticket_id = await self.create_github_active()
+        claimed = await self.coordinator.claim_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+            github_login="Reviewer",
+            github_write_required=False,
+        )
+        await self.store.delete_profile(10, 222)
+
+        unassigned = await self.coordinator.unassign(
+            ticket_id,
+            self.actor(999, participant=False, staff=True),
+        )
+        remove_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        self.assertIsNotNone(remove_intent)
+        self.assertEqual(
+            remove_intent.operation,
+            models.GitHubOutboxOperation.REMOVE_ASSIGNEE,
+        )
+        self.assertEqual(remove_intent.github_login, "reviewer")
+
+    async def test_review_claim_can_enqueue_github_assignment(self):
+        ticket_id = await self.create_github_active()
+
+        result = await self.coordinator.claim_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+            github_login="Reviewer",
+            github_write_required=True,
+        )
+
+        self.assertTrue(result.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.assignee_id, 222)
+        intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(
+            intent.operation,
+            models.GitHubOutboxOperation.ADD_ASSIGNEE,
+        )
+        self.assertEqual(intent.github_login, "reviewer")
+
+    async def test_github_finish_uses_normal_projection_cleanup(self):
+        ticket_id = await self.create_github_active()
+        ticket = await self.store.get_ticket(ticket_id)
+        self.projection.calls.clear()
+
+        result = await self.coordinator.finish_ticket_from_github(100, 7)
+
+        self.assertTrue(result.success)
+        self.assertEqual(result.finished_ticket.ticket_id, ticket_id)
+        self.assertIsNone(await self.store.get_ticket(ticket_id))
+        self.assertIsNone((await self.store.get_pull_request(100, 7)).current_ticket_id)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("delete_thread", ticket.thread_id),
+                ("delete_message", ticket.channel_id, ticket.message_id),
+            ],
+        )
+
+    async def test_draft_prompt_and_decisions_use_author_or_staff_authorization(self):
+        pull_request = self.pull_request()
+        ticket_id = await self.create_github_active(author_id=100, pull_request=pull_request)
+        await self.store.observe_pull_request(
+            replace(
+                pull_request,
+                draft=True,
+                github_updated_at=self.now + timedelta(seconds=1),
+                last_processed_action="converted_to_draft",
+            )
+        )
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=200,
+            github_username="octocat",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        self.projection.calls.clear()
+
+        prompted = await self.coordinator.prompt_draft_decision_from_github(100, 7)
+        rejected = await self.coordinator.keep_draft_ticket(
+            ticket_id,
+            self.actor(201),
+        )
+        mapped_author_kept = await self.coordinator.keep_draft_ticket(
+            ticket_id,
+            self.actor(200, participant=False),
+        )
+        kept = await self.coordinator.keep_draft_ticket(
+            ticket_id,
+            self.actor(100, participant=False),
+        )
+        removed = await self.coordinator.remove_draft_ticket(
+            ticket_id,
+            self.actor(300, participant=False, staff=True),
+        )
+
+        self.assertTrue(prompted.success)
+        self.assertEqual(
+            self.projection.calls[0],
+            ("prompt_draft_decision", ticket_id, 400),
+        )
+        self.assertFalse(rejected.success)
+        self.assertEqual(rejected.response, "You cannot use this action")
+        self.assertTrue(mapped_author_kept.success)
+        self.assertTrue(kept.success)
+        self.assertTrue(removed.success)
+        self.assertEqual(removed.finished_ticket.ticket_id, ticket_id)
+        self.assertIsNone(await self.store.get_ticket(ticket_id))
+
+    async def test_discord_unassign_reuses_add_login_after_profile_deletion(self):
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=222,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        ticket_id = await self.create_github_active()
+
+        claimed = await self.coordinator.claim(ticket_id, self.actor(222))
+        add_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        await self.store.complete_outbox(add_intent.outbox_id, completed_at=self.now)
+        categorized = await self.coordinator.add_ticket_categories(
+            ticket_id,
+            (self.category.category_id,),
+            self.actor(200),
+        )
+        await self.store.delete_profile(10, 222)
+        unassigned = await self.coordinator.unassign(
+            ticket_id,
+            self.actor(999, participant=False, staff=True),
+        )
+        remove_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+
+        self.assertTrue(claimed.success)
+        self.assertEqual(add_intent.operation, models.GitHubOutboxOperation.ADD_ASSIGNEE)
+        self.assertEqual(add_intent.github_login, "reviewer")
+        self.assertTrue(categorized.success)
+        self.assertTrue(unassigned.success)
+        self.assertEqual(
+            remove_intent.operation,
+            models.GitHubOutboxOperation.REMOVE_ASSIGNEE,
+        )
+        self.assertEqual(remove_intent.github_login, "reviewer")
+        await self.store.fail_outbox(
+            remove_intent.outbox_id,
+            failed_at=self.now,
+            error_summary="controlled GitHub failure",
+        )
+        current = await self.store.get_ticket(ticket_id)
+        self.assertEqual(current.state, models.TicketState.OPEN)
+        self.assertIsNone(current.assignee_id)
+
+    async def test_discord_unassign_reuses_add_login_after_mapping_becomes_ambiguous(
+        self,
+    ):
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=222,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        ticket_id = await self.create_github_active()
+        claimed = await self.coordinator.claim(ticket_id, self.actor(222))
+        add_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        await self.store.complete_outbox(add_intent.outbox_id, completed_at=self.now)
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=333,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+
+        unassigned = await self.coordinator.unassign(
+            ticket_id,
+            self.actor(999, participant=False, staff=True),
+        )
+        remove_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        self.assertIsNotNone(remove_intent)
+        self.assertEqual(
+            remove_intent.operation,
+            models.GitHubOutboxOperation.REMOVE_ASSIGNEE,
+        )
+        self.assertEqual(remove_intent.github_login, "reviewer")
+
+    async def test_bound_claim_and_unassign_without_unique_mapping_stay_local(self):
+        ticket_id = await self.create_github_active()
+
+        claimed = await self.coordinator.claim(ticket_id, self.actor(222))
+        unassigned = await self.coordinator.unassign(ticket_id, self.actor(222))
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+    async def test_unbound_mapped_claim_and_unassign_stay_local(self):
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=222,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        ticket = await self.create_active(routing_mode=models.RoutingMode.NONE)
+
+        claimed = await self.coordinator.claim(ticket.ticket_id, self.actor(222))
+        unassigned = await self.coordinator.unassign(ticket.ticket_id, self.actor(222))
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+    async def test_ambiguous_github_mapping_keeps_bound_transitions_local(self):
+        for user_id in (222, 333):
+            await self.store.save_profile(
+                guild_id=10,
+                user_id=user_id,
+                github_username="Reviewer",
+                category_ids=(),
+                automatic_pings=False,
+                updated_at=self.now,
+            )
+        ticket_id = await self.create_github_active()
+
+        claimed = await self.coordinator.claim(ticket_id, self.actor(222))
+        unassigned = await self.coordinator.unassign(ticket_id, self.actor(222))
+
+        self.assertTrue(claimed.success)
+        self.assertTrue(unassigned.success)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+    async def test_bound_decline_never_enqueues_github_write(self):
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=222,
+            github_username="Reviewer",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+        ticket_id = await self.create_github_active()
+
+        declined = await self.coordinator.decline(ticket_id, self.actor(222))
+
+        self.assertTrue(declined.success)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+    async def test_draft_controls_reject_ready_pull_request(self):
+        ticket_id = await self.create_github_active(author_id=100)
+
+        kept = await self.coordinator.keep_draft_ticket(ticket_id, self.actor(100))
+        removed = await self.coordinator.remove_draft_ticket(ticket_id, self.actor(100))
+
+        self.assertFalse(kept.success)
+        self.assertEqual(kept.response, "This ticket is no longer active")
+        self.assertFalse(removed.success)
+        self.assertEqual(removed.response, "This ticket is no longer active")
+        self.assertIsNotNone(await self.store.get_ticket(ticket_id))
+
+    async def test_github_title_edit_updates_bound_ticket_and_projection_once(self):
+        ticket_id = await self.create_github_active()
+        self.projection.calls.clear()
+
+        result = await self.coordinator.update_title_from_github(
+            100,
+            7,
+            title="Renamed pull request",
+        )
+
+        self.assertTrue(result.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.pr_title, "Renamed pull request")
+        self.assertEqual(
+            self.projection.calls,
+            [("edit_ticket", ticket_id, models.TicketState.OPEN, None)],
+        )
+
+    async def test_github_whitespace_title_edit_is_a_settled_no_op(self):
+        ticket_id = await self.create_github_active()
+        original = await self.store.get_ticket(ticket_id)
+        self.projection.calls.clear()
+
+        result = await self.coordinator.update_title_from_github(
+            100,
+            7,
+            title="   ",
+        )
+
+        self.assertTrue(result.success)
+        ticket = await self.store.get_ticket(ticket_id)
+        self.assertEqual(ticket.pr_title, original.pr_title)
+        self.assertEqual(self.projection.calls, [])
+
+    async def test_github_replays_succeed_when_desired_state_is_already_settled(self):
+        pull_request = self.pull_request()
+        await self.create_github_active(pull_request=pull_request)
+
+        duplicate_create = await self.coordinator.create_ticket_from_github(
+            10,
+            pull_request,
+            author_id=None,
+        )
+        first_claim = await self.coordinator.claim_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+            github_login="Reviewer",
+            github_write_required=False,
+        )
+        duplicate_claim = await self.coordinator.claim_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+            github_login="Reviewer",
+            github_write_required=False,
+        )
+        first_finish = await self.coordinator.finish_ticket_from_github(100, 7)
+        duplicate_finish = await self.coordinator.finish_ticket_from_github(100, 7)
+        absent_unassign = await self.coordinator.unassign_ticket_from_github(
+            100,
+            7,
+            user_id=222,
+        )
+        absent_title = await self.coordinator.update_title_from_github(
+            100,
+            7,
+            title="Already closed",
+        )
+
+        self.assertTrue(duplicate_create.success)
+        self.assertTrue(first_claim.success)
+        self.assertTrue(duplicate_claim.success)
+        self.assertTrue(first_finish.success)
+        self.assertTrue(duplicate_finish.success)
+        self.assertTrue(absent_unassign.success)
+        self.assertTrue(absent_title.success)
+
     async def test_create_rejects_direct_self_review_without_writing_ticket(self):
         result = await self.coordinator.create_ticket(
             self.request(models.RoutingMode.DIRECT_WAIT, direct_target_id=100),
@@ -530,7 +1249,10 @@ async def test_direct_due_ping_timeout_then_wait_uses_acknowledged_budget(self):
         self.assertIsNone(passive.current_target_id)
         self.assertIsNone(passive.next_action)
         self.assertEqual(
-            [(item.user_id, item.reason) for item in await self.store.list_exclusions(ticket.ticket_id)],
+            [
+                (item.user_id, item.reason)
+                for item in await self.store.list_exclusions(ticket.ticket_id)
+            ],
             [(200, models.ExclusionReason.TIMED_OUT)],
         )
         self.assertEqual(
@@ -546,9 +1268,7 @@ async def test_direct_due_ping_timeout_then_wait_uses_acknowledged_budget(self):
 
     async def test_automatic_due_uses_presence_deadline_and_failed_send_costs_no_ping(self):
         ticket = await self.create_active()
-        self.candidates = (
-            self.candidate(500, presence=models.PresenceTier.IDLE),
-        )
+        self.candidates = (self.candidate(500, presence=models.PresenceTier.IDLE),)
         self.now = ticket.next_action_at
         expected_response_deadline = self.now + timedelta(
             seconds=self.settings.idle_response_seconds
@@ -724,6 +1444,42 @@ async def test_creating_recovery_reconciles_main_message_before_sending(self):
             ],
         )
 
+    async def test_creating_github_recovery_sends_category_prompt(self):
+        pull_request = self.pull_request()
+        ticket = await self.store.create_ticket_for_pull_request(
+            models.NewTicket(
+                guild_id=10,
+                channel_id=20,
+                author_id=100,
+                pr_title=pull_request.title,
+                pr_url=pull_request.url,
+                category_display="",
+                routing_mode=models.RoutingMode.NONE,
+                direct_target_id=None,
+                category_ids=(),
+                created_at=self.now,
+                origin=models.TicketOrigin.GITHUB,
+            ),
+            pull_request,
+        )
+
+        result = await self.coordinator.recover_projection_cleanup(ticket.ticket_id)
+
+        self.assertTrue(result.success)
+        recovered = await self.store.get_ticket(ticket.ticket_id)
+        self.assertEqual(recovered.state, models.TicketState.OPEN)
+        self.assertIsNone(recovered.category_prompt_retry_at)
+        self.assertEqual(
+            self.projection.calls,
+            [
+                ("find_ticket_message", ticket.public_token),
+                ("send_ticket", ticket.ticket_id, None),
+                ("find_ticket_thread", 300),
+                ("create_thread", ticket.ticket_id, 300),
+                ("prompt_categories", ticket.ticket_id, 400, 100),
+            ],
+        )
+
     async def test_creating_recovery_reconciles_existing_thread_before_creation(self):
         ticket = await self.store.create_ticket(
             models.NewTicket(
@@ -739,9 +1495,7 @@ async def test_creating_recovery_reconciles_existing_thread_before_creation(self
                 created_at=self.now,
             )
         )
-        self.assertTrue(
-            await self.store.record_ticket_message(ticket.ticket_id, 999, self.now)
-        )
+        self.assertTrue(await self.store.record_ticket_message(ticket.ticket_id, 999, self.now))
         self.projection.recovered_thread_id = 888
 
         result = await self.coordinator.recover_projection_cleanup(ticket.ticket_id)
@@ -772,9 +1526,7 @@ async def test_missing_creating_message_is_terminal_during_thread_recovery(self)
             )
         )
         await self.store.record_ticket_message(ticket.ticket_id, 999, self.now)
-        self.projection.errors["find_ticket_thread"] = (
-            projection_module.ProjectionNotFound()
-        )
+        self.projection.errors["find_ticket_thread"] = projection_module.ProjectionNotFound()
 
         result = await self.coordinator.recover_projection_cleanup(ticket.ticket_id)
 
@@ -798,9 +1550,7 @@ async def test_missing_creating_message_cleanup_failure_does_not_refetch(self):
             )
         )
         await self.store.record_ticket_message(ticket.ticket_id, 999, self.now)
-        self.projection.errors["find_ticket_thread"] = (
-            projection_module.ProjectionNotFound()
-        )
+        self.projection.errors["find_ticket_thread"] = projection_module.ProjectionNotFound()
         original_delete_ticket = self.store.delete_ticket
         delete_attempts = 0
 
@@ -827,9 +1577,7 @@ async def fail_delete_once(ticket_id):
 
         self.assertTrue(recovered.success)
         self.assertIsNone(await self.store.get_ticket(ticket.ticket_id))
-        find_calls = [
-            call for call in self.projection.calls if call[0] == "find_ticket_thread"
-        ]
+        find_calls = [call for call in self.projection.calls if call[0] == "find_ticket_thread"]
         self.assertEqual(len(find_calls), 1)
 
     async def test_create_started_before_privacy_redaction_is_cleaned_by_redaction(self):
@@ -999,9 +1747,7 @@ async def observed_reference_ids(user_id):
 
         self.store.claim = delayed_claim
         self.store.user_reference_ticket_ids = observed_reference_ids
-        claim_task = asyncio.create_task(
-            self.coordinator.claim(ticket.ticket_id, self.actor(500))
-        )
+        claim_task = asyncio.create_task(self.coordinator.claim(ticket.ticket_id, self.actor(500)))
         await claim_started.wait()
         redact_task = asyncio.create_task(
             self.coordinator.redact_user(
@@ -1078,9 +1824,7 @@ async def test_exhausted_budget_or_candidate_pool_leaves_ticket_open_passively(s
                 passive = await self.store.get_ticket(ticket.ticket_id)
                 self.assertEqual(passive.state, models.TicketState.OPEN)
                 self.assertIsNone(passive.next_action)
-                self.assertFalse(
-                    any(call[0] == "ping_reviewer" for call in self.projection.calls)
-                )
+                self.assertFalse(any(call[0] == "ping_reviewer" for call in self.projection.calls))
 
     async def test_not_found_from_ping_and_finish_is_successful_absence(self):
         ping_ticket = await self.create_active(
diff --git a/tests/test_github_tickets_dashboard.py b/tests/test_github_tickets_dashboard.py
index e9d0b8b..45f0e0e 100644
--- a/tests/test_github_tickets_dashboard.py
+++ b/tests/test_github_tickets_dashboard.py
@@ -194,6 +194,7 @@ def __init__(self):
         self.modals = []
         self.edits = []
         self.defer_calls = 0
+        self.defer_kwargs = []
 
     async def send_message(self, content=None, **kwargs):
         self.messages.append((content, kwargs))
@@ -207,8 +208,9 @@ async def send_modal(self, modal):
     async def edit_message(self, **kwargs):
         self.edits.append(kwargs)
 
-    async def defer(self):
+    async def defer(self, **kwargs):
         self.defer_calls += 1
+        self.defer_kwargs.append(kwargs)
 
 
 class FakeInteraction:
@@ -280,14 +282,35 @@ async def open_ticket_modal(
         store=None,
         actor=None,
         create_ticket=None,
+        *,
         count_candidates=None,
+        fetch_pull_request=None,
+        expected_organization="NewHorizons",
     ):
         store = store or FakeStore()
         actor = actor or coordinator.TicketActor(10, True, False)
 
-        async def successful_create(_request, _actor):
+        async def successful_create(_request, _actor, _pull_request):
             return coordinator.TicketResult(True)
 
+        async def successful_fetch(_owner, _repository, number):
+            return types.SimpleNamespace(
+                pull_request_id=700,
+                number=number,
+                repository_id=100,
+                repository_full_name="NewHorizons/NHCogs",
+                title="Fetched pull request",
+                url=f"https://github.com/NewHorizons/NHCogs/pull/{number}",
+                state="open",
+                draft=False,
+                merged=False,
+                author_id=900,
+                author_login="author",
+                updated_at=datetime(2026, 8, 20, 12, 0, tzinfo=timezone.utc),
+                labels=(),
+                assignees=(),
+            )
+
         async def no_candidates(_guild_id, _category_ids, _excluded_user_ids):
             return 0
 
@@ -297,10 +320,14 @@ async def no_candidates(_guild_id, _category_ids, _excluded_user_ids):
             store,
             guild_id=100,
             create_ticket=create_ticket or successful_create,
+            fetch_pull_request=fetch_pull_request or successful_fetch,
+            expected_organization=expected_organization,
             actor_factory=lambda _interaction: actor,
             count_automatic_candidates=count_candidates or no_candidates,
         )
-        return interaction.response.modals[0]
+        modal = interaction.response.modals[0]
+        modal.pr_link.value = "https://github.com/NewHorizons/NHCogs/pull/42"
+        return modal
 
     async def test_dashboard_is_exact_ephemeral_profile_interface(self):
         view, _store, _actor = self.make_dashboard()
@@ -514,21 +541,24 @@ async def test_edit_profile_modal_uses_exact_components_and_saves_silently(self)
         self.assertEqual(
             [label.text for label in modal.children],
             [
-                presentation.GITHUB_USERNAME,
+                presentation.GITHUB_PROFILE_LINK,
                 presentation.CATEGORIES,
                 presentation.ALLOW_AUTOMATIC_PINGS,
             ],
         )
         self.assertEqual(
             [label.description for label in modal.children],
-            [presentation.GITHUB_USERNAME_DESCRIPTION, None, None],
+            [presentation.GITHUB_PROFILE_LINK_DESCRIPTION, None, None],
         )
-        self.assertIsInstance(modal.github_username, discord.ui.TextInput)
-        self.assertFalse(modal.github_username.required)
-        self.assertEqual(modal.github_username.default, "old-name")
+        self.assertIsInstance(modal.github_profile_link, discord.ui.TextInput)
+        self.assertFalse(modal.github_profile_link.required)
         self.assertEqual(
-            modal.github_username.max_length,
-            presentation.MAX_GITHUB_USERNAME_LENGTH,
+            modal.github_profile_link.default,
+            "https://github.com/old-name",
+        )
+        self.assertEqual(
+            modal.github_profile_link.max_length,
+            presentation.MAX_GITHUB_PROFILE_LINK_LENGTH,
         )
         self.assertIsInstance(modal.categories, discord.ui.Select)
         self.assertFalse(modal.categories.required)
@@ -544,7 +574,7 @@ async def test_edit_profile_modal_uses_exact_components_and_saves_silently(self)
         self.assertIsInstance(modal.automatic_pings, discord.ui.Checkbox)
         self.assertTrue(modal.automatic_pings.default)
 
-        modal.github_username.value = "  new-name  "
+        modal.github_profile_link.value = "  https://github.com/new-name/  "
         modal.categories.values = ["2"]
         modal.automatic_pings.value = True
         submit_interaction = FakeInteraction()
@@ -556,7 +586,7 @@ async def test_edit_profile_modal_uses_exact_components_and_saves_silently(self)
                 {
                     "guild_id": 100,
                     "user_id": 10,
-                    "github_username": "  new-name  ",
+                    "github_username": "new-name",
                     "category_ids": (2,),
                     "automatic_pings": True,
                     "updated_at": datetime(2026, 8, 26, 12, 0, tzinfo=timezone.utc),
@@ -566,6 +596,31 @@ async def test_edit_profile_modal_uses_exact_components_and_saves_silently(self)
         self.assertEqual(submit_interaction.response.defer_calls, 1)
         self.assertEqual(submit_interaction.response.messages, [])
 
+    async def test_edit_profile_rejects_non_profile_github_links_without_saving(self):
+        view, store, _actor = self.make_dashboard()
+        open_interaction = FakeInteraction()
+        await view.children[0].callback(open_interaction)
+        modal = open_interaction.response.modals[0]
+
+        for invalid_value in (
+            "some-user",
+            "http://github.com/some-user",
+            "https://github.com/some-user/repositories",
+            "https://example.com/some-user",
+        ):
+            with self.subTest(value=invalid_value):
+                modal.github_profile_link.value = invalid_value
+                submit_interaction = FakeInteraction()
+
+                await modal.on_submit(submit_interaction)
+
+                content, kwargs = submit_interaction.response.messages[0]
+                self.assertEqual(content, presentation.INVALID_GITHUB_PROFILE_LINK)
+                self.assertTrue(kwargs["ephemeral"])
+                self.assertFalse(kwargs["allowed_mentions"].users)
+
+        self.assertEqual(store.save_calls, [])
+
     async def test_edit_profile_rejects_automatic_pings_without_categories(self):
         view, store, _actor = self.make_dashboard()
         open_interaction = FakeInteraction()
@@ -804,7 +859,7 @@ async def test_developer_profile_helper_uses_exact_non_pinging_variants(self):
         self.assertTrue(profile_interaction.response.messages[0][1]["ephemeral"])
         self.assertFalse(profile_interaction.response.messages[0][1]["allowed_mentions"].users)
 
-    async def test_new_ticket_modal_has_all_five_exact_components_at_once(self):
+    async def test_new_ticket_modal_has_link_and_existing_routing_components(self):
         store = FakeStore()
         now = datetime(2026, 8, 20, 12, 0, tzinfo=timezone.utc)
         store.categories = [
@@ -816,7 +871,6 @@ async def test_new_ticket_modal_has_all_five_exact_components_at_once(self):
         self.assertEqual(
             [label.text for label in modal.children],
             [
-                presentation.PR_TITLE,
                 presentation.PR_LINK,
                 presentation.CATEGORIES,
                 presentation.PING_BEHAVIOR,
@@ -830,17 +884,12 @@ async def test_new_ticket_modal_has_all_five_exact_components_at_once(self):
         self.assertEqual(
             [label.description for label in modal.children],
             [
-                None,
                 None,
                 None,
                 presentation.SELECT_PING_BEHAVIOR,
                 "Ignored unless a direct ping option is selected",
             ],
         )
-        self.assertIsInstance(modal.pr_title, discord.ui.TextInput)
-        self.assertTrue(modal.pr_title.required)
-        self.assertEqual(modal.pr_title.placeholder, presentation.ENTER_PR_TITLE)
-        self.assertEqual(modal.pr_title.max_length, presentation.MAX_PR_TITLE_LENGTH)
         self.assertIsInstance(modal.pr_link, discord.ui.TextInput)
         self.assertTrue(modal.pr_link.required)
         self.assertEqual(modal.pr_link.placeholder, presentation.ENTER_PR_LINK)
@@ -880,7 +929,7 @@ async def test_native_valid_ticket_input_always_fits_one_discord_message(self):
         modal = await self.open_ticket_modal(store)
         selected = [option.label for option in modal.categories.options[: modal.categories.max_values]]
         content = presentation.ticket_message(
-            title="x" * modal.pr_title.max_length,
+            title="x" * presentation.MAX_PR_TITLE_LENGTH,
             url="x" * modal.pr_link.max_length,
             author_mention="<@18446744073709551615>",
             categories=selected,
@@ -893,7 +942,7 @@ async def test_native_valid_ticket_input_always_fits_one_discord_message(self):
         self.assertGreater(
             len(
                 presentation.ticket_message(
-                    title="x" * modal.pr_title.max_length,
+                    title="x" * presentation.MAX_PR_TITLE_LENGTH,
                     url="x" * modal.pr_link.max_length,
                     author_mention="<@18446744073709551615>",
                     categories=[*selected, "x" * 100],
@@ -904,7 +953,7 @@ async def test_native_valid_ticket_input_always_fits_one_discord_message(self):
             presentation.DISCORD_MESSAGE_LIMIT,
         )
 
-    async def test_new_ticket_maps_all_routing_modes_and_only_trims_title_and_link(self):
+    async def test_new_ticket_fetches_canonical_link_once_and_preserves_routing(self):
         now = datetime(2026, 8, 20, 12, 0, tzinfo=timezone.utc)
         cases = (
             (models.RoutingMode.NONE, (), (), "", None),
@@ -925,14 +974,50 @@ async def test_new_ticket_maps_all_routing_modes_and_only_trims_title_and_link(s
                 store.categories = [models.Category(1, 100, "rendering", now)]
                 actor = coordinator.TicketActor(10, True, False)
                 create_calls = []
+                fetch_calls = []
 
-                async def create_ticket(request, selected_actor, calls=create_calls):
-                    calls.append((request, selected_actor))
+                async def create_ticket(
+                    request,
+                    selected_actor,
+                    pull_request,
+                    calls=create_calls,
+                ):
+                    calls.append((request, selected_actor, pull_request))
                     return coordinator.TicketResult(True)
 
-                modal = await self.open_ticket_modal(store, actor, create_ticket)
-                modal.pr_title.value = "  title  "
-                modal.pr_link.value = "  not validated  "
+                async def fetch_pull_request(
+                    owner,
+                    repository,
+                    number,
+                    calls=fetch_calls,
+                ):
+                    calls.append((owner, repository, number))
+                    return types.SimpleNamespace(
+                        pull_request_id=700,
+                        number=42,
+                        repository_id=100,
+                        repository_full_name="NewHorizons/NHCogs",
+                        title="Fetched pull request",
+                        url="https://github.com/NewHorizons/NHCogs/pull/42",
+                        state="open",
+                        draft=False,
+                        merged=False,
+                        author_id=900,
+                        author_login="author",
+                        updated_at=now,
+                        labels=("bug",),
+                        assignees=("reviewer",),
+                    )
+
+                modal = await self.open_ticket_modal(
+                    store,
+                    actor,
+                    create_ticket,
+                    fetch_pull_request=fetch_pull_request,
+                )
+                modal.pr_link.value = (
+                    "https://github.com/NewHorizons/NHCogs/pull/42"
+                )
                 modal.categories.values = list(category_values)
                 modal.ping_behavior.value = mode.value
                 modal.direct_reviewer.values = list(reviewer_values)
@@ -940,23 +1025,169 @@ async def create_ticket(request, selected_actor, calls=create_calls):
 
                 await modal.on_submit(submit_interaction)
 
-                request, selected_actor = create_calls[0]
+                request, selected_actor, pull_request = create_calls[0]
                 self.assertEqual(selected_actor, actor)
+                self.assertEqual(
+                    fetch_calls,
+                    [("NewHorizons", "NHCogs", 42)],
+                )
                 self.assertEqual(
                     request,
                     coordinator.TicketRequest(
                         guild_id=100,
-                        pr_title="title",
-                        pr_url="not validated",
+                        pr_title="Fetched pull request",
+                        pr_url="https://github.com/NewHorizons/NHCogs/pull/42",
                         category_display=display,
                         routing_mode=mode,
                         direct_target_id=target_id,
                         category_ids=tuple(int(value) for value in category_values),
                     ),
                 )
+                self.assertEqual(
+                    pull_request,
+                    models.GitHubPullRequest(
+                        repository_id=100,
+                        pr_number=42,
+                        github_pr_id=700,
+                        github_author_id=900,
+                        repository_full_name="NewHorizons/NHCogs",
+                        url="https://github.com/NewHorizons/NHCogs/pull/42",
+                        title="Fetched pull request",
+                        github_author_login="author",
+                        draft=False,
+                        open=True,
+                        labels=("bug",),
+                        github_updated_at=now,
+                        assignees=("reviewer",),
+                    ),
+                )
                 self.assertEqual(submit_interaction.response.defer_calls, 1)
+                self.assertEqual(
+                    submit_interaction.response.defer_kwargs,
+                    [{"ephemeral": True}],
+                )
                 self.assertEqual(submit_interaction.response.messages, [])
 
+    async def test_new_ticket_rejects_invalid_links_and_ineligible_pull_requests(self):
+        invalid_links = (
+            "http://github.com/NewHorizons/NHCogs/pull/42",
+            "https://www.github.com/NewHorizons/NHCogs/pull/42",
+            "https://github.com/NewHorizons/NHCogs/issues/42",
+            "https://github.com/NewHorizons/NHCogs/pull/42/",
+            "https://github.com/NewHorizons/NHCogs/pull/42?diff=split",
+        )
+        for link in invalid_links:
+            with self.subTest(link=link):
+                fetch_pull_request = mock.AsyncMock()
+                create_ticket = mock.AsyncMock()
+                modal = await self.open_ticket_modal(
+                    create_ticket=create_ticket,
+                    fetch_pull_request=fetch_pull_request,
+                )
+                modal.pr_link.value = link
+                modal.ping_behavior.value = models.RoutingMode.NONE.value
+                interaction = FakeInteraction()
+
+                await modal.on_submit(interaction)
+
+                self.assertEqual(
+                    interaction.response.messages[0][0],
+                    presentation.COULD_NOT_CREATE_TICKET,
+                )
+                fetch_pull_request.assert_not_awaited()
+                create_ticket.assert_not_awaited()
+
+        now = datetime(2026, 8, 20, 12, 0, tzinfo=timezone.utc)
+        cases = (
+            {
+                "repository_full_name": "OtherOrganization/NHCogs",
+            },
+            {"state": "closed"},
+            {"draft": True},
+        )
+        for overrides in cases:
+            with self.subTest(snapshot=overrides):
+                values = {
+                    "pull_request_id": 700,
+                    "number": 42,
+                    "repository_id": 100,
+                    "repository_full_name": "NewHorizons/NHCogs",
+                    "title": "Fetched pull request",
+                    "url": "https://github.com/NewHorizons/NHCogs/pull/42",
+                    "state": "open",
+                    "draft": False,
+                    "merged": False,
+                    "author_id": 900,
+                    "author_login": "author",
+                    "updated_at": now,
+                    "labels": (),
+                    "assignees": (),
+                }
+                values.update(overrides)
+                fetch_pull_request = mock.AsyncMock(
+                    return_value=types.SimpleNamespace(**values)
+                )
+                create_ticket = mock.AsyncMock()
+                modal = await self.open_ticket_modal(
+                    create_ticket=create_ticket,
+                    fetch_pull_request=fetch_pull_request,
+                )
+                modal.ping_behavior.value = models.RoutingMode.NONE.value
+                interaction = FakeInteraction()
+
+                await modal.on_submit(interaction)
+
+                fetch_pull_request.assert_awaited_once_with(
+                    "NewHorizons",
+                    "NHCogs",
+                    42,
+                )
+                self.assertEqual(
+                    interaction.followup.send.await_args.args[0],
+                    presentation.COULD_NOT_CREATE_TICKET,
+                )
+                self.assertNotIn("OtherOrganization", str(interaction.followup.send.await_args))
+                create_ticket.assert_not_awaited()
+
+        fetch_pull_request = mock.AsyncMock(side_effect=RuntimeError("private failure"))
+        create_ticket = mock.AsyncMock()
+        modal = await self.open_ticket_modal(
+            create_ticket=create_ticket,
+            fetch_pull_request=fetch_pull_request,
+        )
+        modal.ping_behavior.value = models.RoutingMode.NONE.value
+        interaction = FakeInteraction()
+
+        await modal.on_submit(interaction)
+
+        self.assertEqual(
+            interaction.followup.send.await_args.args[0],
+            presentation.COULD_NOT_CREATE_TICKET,
+        )
+        self.assertNotIn("private failure", str(interaction.followup.send.await_args))
+        create_ticket.assert_not_awaited()
+
+    async def test_new_ticket_rejects_foreign_organization_before_fetch(self):
+        fetch_pull_request = mock.AsyncMock()
+        create_ticket = mock.AsyncMock()
+        modal = await self.open_ticket_modal(
+            create_ticket=create_ticket,
+            fetch_pull_request=fetch_pull_request,
+            expected_organization="NewHorizons",
+        )
+        modal.pr_link.value = "https://github.com/OtherOrganization/NHCogs/pull/42"
+        modal.ping_behavior.value = models.RoutingMode.NONE.value
+        interaction = FakeInteraction()
+
+        await modal.on_submit(interaction)
+
+        self.assertEqual(
+            interaction.response.messages[0][0],
+            presentation.COULD_NOT_CREATE_TICKET,
+        )
+        fetch_pull_request.assert_not_awaited()
+        create_ticket.assert_not_awaited()
+
     async def test_multiple_automatic_categories_open_confirmation_before_create(self):
         now = datetime(2026, 8, 20, 12, 0, tzinfo=timezone.utc)
         store = FakeStore()
@@ -968,7 +1199,7 @@ async def test_multiple_automatic_categories_open_confirmation_before_create(sel
         create_calls = []
         count_calls = []
 
-        async def create_ticket(request, selected_actor):
+        async def create_ticket(request, selected_actor, _pull_request):
             create_calls.append((request, selected_actor))
             return coordinator.TicketResult(True)
 
@@ -980,10 +1211,8 @@ async def count_candidates(guild_id, category_ids, excluded_user_ids):
             store,
             actor,
             create_ticket,
-            count_candidates,
+            count_candidates=count_candidates,
         )
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         submit_interaction = FakeInteraction()
@@ -992,7 +1221,8 @@ async def count_candidates(guild_id, category_ids, excluded_user_ids):
 
         self.assertEqual(create_calls, [])
         self.assertEqual(count_calls, [(100, (1, 2), frozenset({10}))])
-        content, kwargs = submit_interaction.response.messages[0]
+        content = submit_interaction.followup.send.await_args.args[0]
+        kwargs = submit_interaction.followup.send.await_args.kwargs
         self.assertEqual(
             content,
             "Confirm categories\n4 people can receive automatic pings for all selected categories",
@@ -1024,7 +1254,7 @@ async def test_confirmation_updates_count_creates_filtered_ticket_and_prefills_b
         actor = coordinator.TicketActor(10, True, False)
         create_calls = []
 
-        async def create_ticket(request, selected_actor):
+        async def create_ticket(request, selected_actor, _pull_request):
             create_calls.append((request, selected_actor))
             return coordinator.TicketResult(True)
 
@@ -1035,16 +1265,14 @@ async def count_candidates(_guild_id, category_ids, _excluded_user_ids):
             store,
             actor,
             create_ticket,
-            count_candidates,
+            count_candidates=count_candidates,
         )
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.DIRECT_AUTOMATIC.value
         modal.direct_reviewer.values = [types.SimpleNamespace(id=99)]
         submit_interaction = FakeInteraction()
         await modal.on_submit(submit_interaction)
-        view = submit_interaction.response.messages[0][1]["view"]
+        view = submit_interaction.followup.send.await_args.kwargs["view"]
 
         view.categories.values = ["2"]
         select_interaction = FakeInteraction()
@@ -1066,8 +1294,10 @@ async def count_candidates(_guild_id, category_ids, _excluded_user_ids):
         back_interaction = FakeInteraction()
         await back_button.callback(back_interaction)
         reopened = back_interaction.response.modals[0]
-        self.assertEqual(reopened.pr_title.default, "title")
-        self.assertEqual(reopened.pr_link.default, "link")
+        self.assertEqual(
+            reopened.pr_link.default,
+            "https://github.com/NewHorizons/NHCogs/pull/42",
+        )
         self.assertEqual(
             [option.default for option in reopened.categories.options],
             [False, True],
@@ -1103,19 +1333,17 @@ async def list_categories(self, guild_id):
         actor = coordinator.TicketActor(10, True, False)
         create_calls = []
 
-        async def create_ticket(request, selected_actor):
+        async def create_ticket(request, selected_actor, _pull_request):
             await asyncio.sleep(0)
             create_calls.append((request, selected_actor))
             return coordinator.TicketResult(True)
 
         modal = await self.open_ticket_modal(store, actor, create_ticket)
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         submit_interaction = FakeInteraction()
         await modal.on_submit(submit_interaction)
-        view = submit_interaction.response.messages[0][1]["view"]
+        view = submit_interaction.followup.send.await_args.kwargs["view"]
         create_button = next(
             item
             for item in view.children
@@ -1144,18 +1372,16 @@ async def test_confirmation_selection_creates_only_the_visible_defaults(self):
         ]
         create_calls = []
 
-        async def create_ticket(request, actor):
+        async def create_ticket(request, actor, _pull_request):
             create_calls.append((request, actor))
             return coordinator.TicketResult(True)
 
         modal = await self.open_ticket_modal(store, create_ticket=create_ticket)
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         submit_interaction = FakeInteraction()
         await modal.on_submit(submit_interaction)
-        view = submit_interaction.response.messages[0][1]["view"]
+        view = submit_interaction.followup.send.await_args.kwargs["view"]
         view.categories.values = ["2"]
         await view.categories.callback(FakeInteraction())
         create_button = next(
@@ -1181,8 +1407,6 @@ async def test_direct_automatic_count_excludes_author_and_direct_target(self):
             store,
             count_candidates=count_candidates,
         )
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.DIRECT_AUTOMATIC.value
         modal.direct_reviewer.values = [types.SimpleNamespace(id=99)]
@@ -1207,13 +1431,11 @@ async def test_confirmation_revalidates_categories_before_refreshing_count(self)
             store,
             count_candidates=count_candidates,
         )
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         submit_interaction = FakeInteraction()
         await modal.on_submit(submit_interaction)
-        view = submit_interaction.response.messages[0][1]["view"]
+        view = submit_interaction.followup.send.await_args.kwargs["view"]
         store.categories = [store.categories[0]]
         view.categories.values = ["1", "2"]
         interaction = FakeInteraction()
@@ -1234,8 +1456,6 @@ async def test_confirmation_reports_when_no_one_matches_all_categories(self):
             models.Category(2, 100, "mixins", now),
         ]
         modal = await self.open_ticket_modal(store)
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         submit_interaction = FakeInteraction()
@@ -1243,7 +1463,7 @@ async def test_confirmation_reports_when_no_one_matches_all_categories(self):
         await modal.on_submit(submit_interaction)
 
         self.assertEqual(
-            submit_interaction.response.messages[0][0],
+            submit_interaction.followup.send.await_args.args[0],
             "Confirm categories\nNo one can receive automatic pings for all selected categories",
         )
 
@@ -1260,10 +1480,8 @@ async def test_direct_self_review_is_rejected_before_category_confirmation(self)
             store,
             coordinator.TicketActor(10, True, False),
             create_ticket,
-            count_candidates,
+            count_candidates=count_candidates,
         )
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1", "2"]
         modal.ping_behavior.value = models.RoutingMode.DIRECT_AUTOMATIC.value
         modal.direct_reviewer.values = [types.SimpleNamespace(id=10)]
@@ -1284,13 +1502,11 @@ async def test_direct_reviewer_is_ignored_for_non_direct_routing(self):
         store.categories = [models.Category(1, 100, "rendering", now)]
         create_calls = []
 
-        async def create_ticket(request, actor):
+        async def create_ticket(request, actor, _pull_request):
             create_calls.append((request, actor))
             return coordinator.TicketResult(True)
 
         modal = await self.open_ticket_modal(store, create_ticket=create_ticket)
-        modal.pr_title.value = "title"
-        modal.pr_link.value = "link"
         modal.categories.values = ["1"]
         modal.ping_behavior.value = models.RoutingMode.AUTOMATIC.value
         modal.direct_reviewer.values = [types.SimpleNamespace(id=10)]
@@ -1308,7 +1524,7 @@ async def test_new_ticket_returns_only_accepted_validation_and_coordinator_error
         actor = coordinator.TicketActor(10, True, False)
         create_calls = []
 
-        async def create_ticket(request, selected_actor):
+        async def create_ticket(request, selected_actor, _pull_request):
             create_calls.append((request, selected_actor))
             return coordinator.TicketResult(False, "coordinator error")
 
diff --git a/tests/test_github_tickets_discord_projection.py b/tests/test_github_tickets_discord_projection.py
index 5790a7c..cec6030 100644
--- a/tests/test_github_tickets_discord_projection.py
+++ b/tests/test_github_tickets_discord_projection.py
@@ -79,6 +79,15 @@ def _load_modules():
 models, presentation, projection_module, adapter_module = _load_modules()
 
 
+def make_projection(bot, view_factory=lambda _ticket: object()):
+    return adapter_module.DiscordTicketProjection(
+        bot,
+        view_factory,
+        category_prompt_view_factory=lambda _ticket: object(),
+        draft_prompt_view_factory=lambda _ticket: object(),
+    )
+
+
 def ticket(**changes):
     now = datetime(2026, 8, 26, 12, 0, tzinfo=timezone.utc)
     values = {
@@ -221,7 +230,7 @@ async def test_recovery_history_uses_lookback_but_keeps_exact_correlations(self)
         channel = FakeChannel()
         thread = FakeChannel(66)
         bot = FakeBot({channel.id: channel, thread.id: thread})
-        adapter = adapter_module.DiscordTicketProjection(bot, lambda _ticket: object())
+        adapter = make_projection(bot)
         current = ticket(created_at=now, public_token="opaque-token")
         main = types.SimpleNamespace(
             id=77,
@@ -261,10 +270,7 @@ async def test_thread_recovery_fetches_saved_message_only_in_recovery_path(self)
         channel.fetched_message = types.SimpleNamespace(
             thread=types.SimpleNamespace(id=88)
         )
-        adapter = adapter_module.DiscordTicketProjection(
-            FakeBot({channel.id: channel}),
-            lambda _ticket: object(),
-        )
+        adapter = make_projection(FakeBot({channel.id: channel}))
 
         thread_id = await adapter.find_ticket_thread(ticket(message_id=55))
 
@@ -281,7 +287,7 @@ def view_factory(current):
             view_tickets.append((current.ticket_id, current.state is models.TicketState.CLAIMED))
             return view
 
-        adapter = adapter_module.DiscordTicketProjection(bot, view_factory)
+        adapter = make_projection(bot, view_factory)
         current = ticket(pr_title="x" * 101)
 
         message_id = await adapter.send_ticket(current)
@@ -321,7 +327,7 @@ def view_factory(current):
             view_tickets.append((current.ticket_id, current.state is models.TicketState.CLAIMED))
             return view
 
-        adapter = adapter_module.DiscordTicketProjection(bot, view_factory)
+        adapter = make_projection(bot, view_factory)
         current = ticket(
             message_id=55,
             state=models.TicketState.CLAIMED,
@@ -355,10 +361,7 @@ def view_factory(current):
     async def test_open_ticket_edit_does_not_display_the_pinged_target_as_reviewer(self):
         channel = FakeChannel()
         bot = FakeBot({channel.id: channel})
-        adapter = adapter_module.DiscordTicketProjection(
-            bot,
-            lambda _ticket: object(),
-        )
+        adapter = make_projection(bot)
         current = ticket(
             message_id=55,
             state=models.TicketState.OPEN,
@@ -377,10 +380,71 @@ async def test_open_ticket_edit_does_not_display_the_pinged_target_as_reviewer(s
             ),
         )
 
+    async def test_github_prompts_use_cached_thread_once_with_exact_views(self):
+        thread = FakeThread(66)
+        bot = FakeBot({thread.id: thread})
+        category_view = object()
+        draft_view = object()
+        category_tickets = []
+        draft_tickets = []
+        adapter = adapter_module.DiscordTicketProjection(
+            bot,
+            lambda _ticket: object(),
+            category_prompt_view_factory=lambda current: (
+                category_tickets.append(current.ticket_id) or category_view
+            ),
+            draft_prompt_view_factory=lambda current: (
+                draft_tickets.append(current.ticket_id) or draft_view
+            ),
+        )
+        current = ticket(thread_id=66, author_id=30)
+
+        await adapter.prompt_categories(current, 66)
+        await adapter.prompt_draft_decision(current)
+
+        self.assertEqual(category_tickets, [current.ticket_id])
+        self.assertEqual(draft_tickets, [current.ticket_id])
+        self.assertEqual(len(thread.send_calls), 2)
+        category_content, category_kwargs = thread.send_calls[0]
+        draft_content, draft_kwargs = thread.send_calls[1]
+        self.assertEqual(
+            category_content,
+            presentation.add_categories_notification("<@30>"),
+        )
+        self.assertEqual(
+            draft_content,
+            presentation.draft_ticket_notification("<@30>"),
+        )
+        self.assertIs(category_kwargs["view"], category_view)
+        self.assertIs(draft_kwargs["view"], draft_view)
+        self.assertEqual(category_kwargs["allowed_mentions"].users[0].id, 30)
+        self.assertEqual(draft_kwargs["allowed_mentions"].users[0].id, 30)
+        self.assertEqual(bot.fetch_calls, 0)
+
+    async def test_unmapped_github_category_prompt_is_neutral_and_non_pinging(self):
+        thread = FakeThread(66)
+        bot = FakeBot({thread.id: thread})
+        category_view = object()
+        adapter = adapter_module.DiscordTicketProjection(
+            bot,
+            lambda _ticket: object(),
+            category_prompt_view_factory=lambda _ticket: category_view,
+            draft_prompt_view_factory=lambda _ticket: object(),
+        )
+
+        await adapter.prompt_categories(ticket(author_id=None), 66)
+
+        self.assertEqual(len(thread.send_calls), 1)
+        content, kwargs = thread.send_calls[0]
+        self.assertEqual(content, "Add categories to start automatic routing")
+        self.assertIs(kwargs["view"], category_view)
+        self.assertFalse(kwargs["allowed_mentions"].users)
+        self.assertEqual(bot.fetch_calls, 0)
+
     async def test_ping_uses_exact_copy_and_allows_only_the_new_target_mention(self):
         thread = FakeThread(66)
         bot = FakeBot({thread.id: thread})
-        adapter = adapter_module.DiscordTicketProjection(bot, lambda _ticket: object())
+        adapter = make_projection(bot)
 
         await adapter.ping_reviewer(66, 41, False)
         await adapter.ping_reviewer(66, 42, True)
@@ -404,7 +468,7 @@ async def test_deletes_use_saved_ids_partial_message_and_cached_thread(self):
         channel = FakeChannel()
         thread = FakeThread(66)
         bot = FakeBot({channel.id: channel, thread.id: thread})
-        adapter = adapter_module.DiscordTicketProjection(bot, lambda _ticket: object())
+        adapter = make_projection(bot)
 
         await adapter.delete_message(channel.id, 55)
         await adapter.delete_thread(thread.id)
@@ -421,9 +485,7 @@ async def test_required_mutation_not_found_is_mapped_to_projection_not_found(sel
         with self.subTest(operation="send"):
             channel = FakeChannel()
             channel.error = error
-            adapter = adapter_module.DiscordTicketProjection(
-                FakeBot({channel.id: channel}), lambda _ticket: object()
-            )
+            adapter = make_projection(FakeBot({channel.id: channel}))
             with self.assertRaises(projection_module.ProjectionNotFound):
                 await adapter.send_ticket(ticket())
 
@@ -431,9 +493,7 @@ async def test_required_mutation_not_found_is_mapped_to_projection_not_found(sel
             with self.subTest(operation=operation):
                 channel = FakeChannel()
                 channel.message.error = error
-                adapter = adapter_module.DiscordTicketProjection(
-                    FakeBot({channel.id: channel}), lambda _ticket: object()
-                )
+                adapter = make_projection(FakeBot({channel.id: channel}))
                 if operation == "create_thread":
                     with self.assertRaises(projection_module.ProjectionNotFound):
                         await adapter.create_thread(ticket(), 55)
@@ -448,9 +508,7 @@ async def test_required_mutation_not_found_is_mapped_to_projection_not_found(sel
             with self.subTest(operation=operation):
                 thread = FakeThread(66)
                 thread.error = error
-                adapter = adapter_module.DiscordTicketProjection(
-                    FakeBot({thread.id: thread}), lambda _ticket: object()
-                )
+                adapter = make_projection(FakeBot({thread.id: thread}))
                 if operation == "ping_reviewer":
                     with self.assertRaises(projection_module.ProjectionNotFound):
                         await adapter.ping_reviewer(thread.id, 41, True)
@@ -462,7 +520,7 @@ async def test_cache_miss_uses_partial_ping_and_targeted_thread_delete_fetch(sel
         bot = FakeBot({})
         archived = FakeThread(66)
         bot.fetched_channels[66] = archived
-        adapter = adapter_module.DiscordTicketProjection(bot, lambda _ticket: object())
+        adapter = make_projection(bot)
 
         with self.assertRaises(projection_module.ProjectionUnavailable):
             await adapter.send_ticket(ticket())
diff --git a/tests/test_github_tickets_github_persistence.py b/tests/test_github_tickets_github_persistence.py
new file mode 100644
index 0000000..8927693
--- /dev/null
+++ b/tests/test_github_tickets_github_persistence.py
@@ -0,0 +1,1123 @@
+from __future__ import annotations
+
+import sqlite3
+import unittest
+from contextlib import closing
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from tests.test_github_tickets_store import models, store_module
+
+
+def _create_current_schema_fixture(connection: sqlite3.Connection) -> None:
+    connection.executescript(
+        """
+        CREATE TABLE categories (
+            category_id INTEGER PRIMARY KEY AUTOINCREMENT,
+            guild_id INTEGER NOT NULL,
+            name TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            UNIQUE (guild_id, name)
+        );
+        CREATE TABLE profiles (
+            guild_id INTEGER NOT NULL,
+            user_id INTEGER NOT NULL,
+            github_username TEXT,
+            automatic_pings INTEGER NOT NULL CHECK (automatic_pings IN (0, 1)),
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (guild_id, user_id)
+        );
+        CREATE TABLE profile_categories (
+            guild_id INTEGER NOT NULL,
+            user_id INTEGER NOT NULL,
+            category_id INTEGER NOT NULL,
+            PRIMARY KEY (guild_id, user_id, category_id),
+            FOREIGN KEY (guild_id, user_id)
+                REFERENCES profiles (guild_id, user_id) ON DELETE CASCADE,
+            FOREIGN KEY (category_id)
+                REFERENCES categories (category_id) ON DELETE CASCADE
+        );
+        CREATE TABLE tickets (
+            ticket_id INTEGER PRIMARY KEY AUTOINCREMENT,
+            public_token TEXT NOT NULL UNIQUE,
+            guild_id INTEGER NOT NULL,
+            channel_id INTEGER NOT NULL,
+            message_id INTEGER UNIQUE,
+            thread_id INTEGER UNIQUE,
+            author_id INTEGER NOT NULL,
+            pr_title TEXT NOT NULL,
+            pr_url TEXT NOT NULL,
+            category_display TEXT NOT NULL,
+            routing_mode TEXT NOT NULL CHECK (
+                routing_mode IN (
+                    'none', 'automatic', 'direct_wait', 'direct_automatic'
+                )
+            ),
+            state TEXT NOT NULL CHECK (
+                state IN ('creating', 'open', 'claimed', 'finishing')
+            ),
+            direct_target_id INTEGER,
+            current_target_id INTEGER,
+            assignee_id INTEGER,
+            ping_count INTEGER NOT NULL DEFAULT 0 CHECK (ping_count >= 0),
+            protection_until TEXT,
+            next_action TEXT CHECK (
+                next_action IS NULL OR next_action IN (
+                    'direct_ping', 'automatic_ping', 'target_timeout'
+                )
+            ),
+            next_action_at TEXT,
+            pending_target_id INTEGER,
+            pending_presence_tier TEXT CHECK (
+                pending_presence_tier IS NULL OR pending_presence_tier IN (
+                    'online', 'idle', 'do_not_disturb', 'offline'
+                )
+            ),
+            pending_ping_automatic INTEGER CHECK (
+                pending_ping_automatic IS NULL OR pending_ping_automatic IN (0, 1)
+            ),
+            pending_ping_reserved_at TEXT,
+            pending_response_deadline TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            projection_sync_at TEXT,
+            transition_version INTEGER NOT NULL DEFAULT 0
+                CHECK (transition_version >= 0),
+            CHECK (
+                (next_action IS NULL AND next_action_at IS NULL)
+                OR (next_action IS NOT NULL AND next_action_at IS NOT NULL)
+            ),
+            CHECK (
+                (pending_target_id IS NULL
+                    AND pending_ping_automatic IS NULL
+                    AND pending_ping_reserved_at IS NULL
+                    AND pending_response_deadline IS NULL)
+                OR (pending_target_id IS NOT NULL
+                    AND pending_ping_automatic IS NOT NULL
+                    AND pending_ping_reserved_at IS NOT NULL
+                    AND pending_response_deadline IS NOT NULL)
+            )
+        );
+        CREATE TABLE ticket_categories (
+            ticket_id INTEGER NOT NULL,
+            category_id INTEGER NOT NULL,
+            PRIMARY KEY (ticket_id, category_id),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE,
+            FOREIGN KEY (category_id)
+                REFERENCES categories (category_id) ON DELETE CASCADE
+        );
+        CREATE TABLE ticket_exclusions (
+            ticket_id INTEGER NOT NULL,
+            user_id INTEGER NOT NULL,
+            reason TEXT NOT NULL CHECK (
+                reason IN ('declined', 'unassigned', 'timed_out')
+            ),
+            created_at TEXT NOT NULL,
+            PRIMARY KEY (ticket_id, user_id),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE
+        );
+        CREATE TABLE ticket_pings (
+            ticket_id INTEGER NOT NULL,
+            sequence_number INTEGER NOT NULL CHECK (sequence_number > 0),
+            target_user_id INTEGER NOT NULL,
+            presence_tier TEXT CHECK (
+                presence_tier IS NULL OR presence_tier IN (
+                    'online', 'idle', 'do_not_disturb', 'offline'
+                )
+            ),
+            automatic INTEGER NOT NULL CHECK (automatic IN (0, 1)),
+            sent_at TEXT NOT NULL,
+            response_deadline TEXT NOT NULL,
+            PRIMARY KEY (ticket_id, sequence_number),
+            FOREIGN KEY (ticket_id)
+                REFERENCES tickets (ticket_id) ON DELETE CASCADE
+        );
+        CREATE INDEX idx_categories_guild ON categories (guild_id, name);
+        CREATE INDEX idx_profiles_guild ON profiles (guild_id, user_id);
+        CREATE INDEX idx_ticket_deadlines ON tickets (next_action_at, ticket_id)
+            WHERE next_action_at IS NOT NULL;
+        CREATE INDEX idx_ticket_message ON tickets (message_id)
+            WHERE message_id IS NOT NULL;
+        CREATE INDEX idx_ticket_thread ON tickets (thread_id)
+            WHERE thread_id IS NOT NULL;
+        CREATE INDEX idx_ticket_assignee ON tickets (guild_id, assignee_id)
+            WHERE assignee_id IS NOT NULL;
+        CREATE INDEX idx_ticket_pings_target
+            ON ticket_pings (target_user_id, sent_at);
+        """
+    )
+
+
+class GitHubTicketsGitHubPersistenceTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        self.directory = TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.path = Path(self.directory.name) / "githubtickets.sqlite"
+        self.store = store_module.GitHubTicketsStore(self.path)
+        await self.store.initialize()
+        self.now = datetime(2026, 8, 28, 10, 0, tzinfo=timezone.utc)
+
+    def pull_request(
+        self,
+        *,
+        repository_id: int = 100,
+        pr_number: int = 7,
+        github_pr_id: int = 700,
+        github_author_id: int = 900,
+        title: str = "Add GitHub App integration",
+        login: str = "octocat",
+        assignees: tuple[str, ...] = (),
+        updated_at: datetime | None = None,
+        last_processed_action: str | None = "labeled",
+    ):
+        return models.GitHubPullRequest(
+            repository_id=repository_id,
+            pr_number=pr_number,
+            github_pr_id=github_pr_id,
+            github_author_id=github_author_id,
+            repository_full_name="NewHorizons/NHCogs",
+            url=f"https://github.com/NewHorizons/NHCogs/pull/{pr_number}",
+            title=title,
+            github_author_login=login,
+            draft=False,
+            open=True,
+            labels=("discord-ticket", "python"),
+            github_updated_at=updated_at or self.now,
+            assignees=assignees,
+            last_processed_action=last_processed_action,
+        )
+
+    def new_ticket(self, *, author_id: int | None = None):
+        return models.NewTicket(
+            guild_id=10,
+            channel_id=20,
+            author_id=author_id,
+            pr_title="Add GitHub App integration",
+            pr_url="https://github.com/NewHorizons/NHCogs/pull/7",
+            category_display="",
+            routing_mode=models.RoutingMode.NONE,
+            direct_target_id=None,
+            category_ids=(),
+            created_at=self.now,
+            origin=models.TicketOrigin.GITHUB,
+        )
+
+    async def create_pending_outbox(
+        self,
+        *,
+        repository_id: int,
+        pr_number: int,
+        github_pr_id: int,
+        assignee_id: int,
+        github_login: str,
+    ):
+        ticket = await self.store.create_ticket_for_pull_request(
+            self.new_ticket(author_id=111),
+            self.pull_request(
+                repository_id=repository_id,
+                pr_number=pr_number,
+                github_pr_id=github_pr_id,
+            ),
+        )
+        await self.store.activate_ticket(
+            ticket.ticket_id,
+            message_id=10_000 + ticket.ticket_id,
+            thread_id=20_000 + ticket.ticket_id,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        await self.store.claim_with_github_assignment(
+            ticket.ticket_id,
+            assignee_id=assignee_id,
+            github_login=github_login,
+            github_write_required=True,
+            protection_until=self.now,
+            updated_at=self.now,
+        )
+        return ticket
+
+    async def test_current_schema_migration_preserves_ticket_and_routing_state(self):
+        legacy_path = Path(self.directory.name) / "legacy-githubtickets.sqlite"
+        timestamp = self.now.isoformat()
+        deadline = (self.now + timedelta(hours=1)).isoformat()
+        with closing(store_module.connect(legacy_path)) as connection:
+            _create_current_schema_fixture(connection)
+            connection.execute(
+                "INSERT INTO categories VALUES (1, 10, 'python', ?)",
+                (timestamp,),
+            )
+            connection.execute(
+                "INSERT INTO profiles VALUES (10, 111, 'octocat', 1, ?)",
+                (timestamp,),
+            )
+            connection.execute(
+                "INSERT INTO profile_categories VALUES (10, 111, 1)"
+            )
+            connection.execute(
+                """
+                INSERT INTO tickets (
+                    ticket_id, public_token, guild_id, channel_id, message_id,
+                    thread_id, author_id, pr_title, pr_url, category_display,
+                    routing_mode, state, direct_target_id, current_target_id,
+                    assignee_id, ping_count, protection_until, next_action,
+                    next_action_at, pending_target_id, pending_presence_tier,
+                    pending_ping_automatic, pending_ping_reserved_at,
+                    pending_response_deadline, created_at, updated_at,
+                    projection_sync_at, transition_version
+                ) VALUES (
+                    1, 'stable-token', 10, 20, 30, 40, 111, 'Legacy title',
+                    'https://example.test/pull/1', 'python', 'direct_automatic',
+                    'open', 222, 333, NULL, 1, ?, 'target_timeout', ?, 444,
+                    'online', 1, ?, ?, ?, ?, ?, 8
+                )
+                """,
+                (timestamp, deadline, timestamp, deadline, timestamp, timestamp, deadline),
+            )
+            connection.execute("INSERT INTO ticket_categories VALUES (1, 1)")
+            connection.execute(
+                "INSERT INTO ticket_exclusions VALUES (1, 555, 'declined', ?)",
+                (timestamp,),
+            )
+            connection.execute(
+                """
+                INSERT INTO ticket_pings VALUES (
+                    1, 1, 444, 'online', 1, ?, ?
+                )
+                """,
+                (timestamp, deadline),
+            )
+            connection.execute("PRAGMA user_version = 1")
+            connection.commit()
+
+        migrated = store_module.GitHubTicketsStore(legacy_path)
+        await migrated.initialize()
+
+        profile = await migrated.get_profile(10, 111)
+        ticket = await migrated.get_ticket(1)
+        self.assertEqual(profile.github_username, "octocat")
+        self.assertEqual(profile.category_ids, (1,))
+        self.assertEqual(ticket.author_id, 111)
+        self.assertEqual(ticket.origin, models.TicketOrigin.DISCORD)
+        self.assertEqual(ticket.public_token, "stable-token")
+        self.assertEqual(
+            (await migrated.get_ticket_by_public_token("stable-token")).ticket_id,
+            1,
+        )
+        self.assertEqual(ticket.message_id, 30)
+        self.assertEqual(ticket.thread_id, 40)
+        self.assertEqual(ticket.routing_mode, models.RoutingMode.DIRECT_AUTOMATIC)
+        self.assertEqual(ticket.current_target_id, 333)
+        self.assertEqual(ticket.pending_target_id, 444)
+        self.assertEqual(ticket.next_action, models.NextAction.TARGET_TIMEOUT)
+        self.assertEqual(ticket.next_action_at.isoformat(), deadline)
+        self.assertEqual(ticket.transition_version, 8)
+        self.assertEqual(
+            await migrated.due_ticket_ids(self.now + timedelta(hours=2)),
+            (1,),
+        )
+        self.assertEqual(len(await migrated.list_exclusions(1)), 1)
+        self.assertEqual(len(await migrated.list_pings(1)), 1)
+        with closing(store_module.connect(legacy_path)) as connection:
+            self.assertEqual(connection.execute("PRAGMA user_version").fetchone()[0], 3)
+            self.assertEqual(connection.execute("PRAGMA foreign_key_check").fetchall(), [])
+
+    async def test_pull_request_binding_reserves_one_active_ticket_and_keeps_identity_immutable(
+        self,
+    ):
+        self.assertTrue(
+            hasattr(self.store, "create_ticket_for_pull_request"),
+            "the store must own atomic pull request binding",
+        )
+        ticket = await self.store.create_ticket_for_pull_request(
+            self.new_ticket(),
+            self.pull_request(),
+        )
+
+        self.assertIsNone(ticket.author_id)
+        self.assertEqual(ticket.origin, models.TicketOrigin.GITHUB)
+        bound = await self.store.get_pull_request(100, 7)
+        self.assertEqual(bound.current_ticket_id, ticket.ticket_id)
+
+        with self.assertRaises(models.ActivePullRequestTicketExists):
+            await self.store.create_ticket_for_pull_request(
+                self.new_ticket(author_id=111),
+                self.pull_request(title="Mutable title"),
+            )
+
+        with self.assertRaisesRegex(ValueError, "immutable GitHub identity"):
+            await self.store.observe_pull_request(
+                self.pull_request(
+                    github_pr_id=701,
+                    title="Attempted identity replacement",
+                    updated_at=self.now + timedelta(minutes=1),
+                )
+            )
+
+        unchanged = await self.store.get_pull_request(100, 7)
+        self.assertEqual(unchanged.github_pr_id, 700)
+        self.assertEqual(unchanged.title, "Add GitHub App integration")
+
+        mutable = await self.store.observe_pull_request(
+            self.pull_request(
+                title="Updated title",
+                login="OctoCat-Renamed",
+                updated_at=self.now + timedelta(minutes=2),
+            )
+        )
+        self.assertIs(mutable.state, models.PullRequestObservationState.APPLIED)
+        self.assertEqual(mutable.pull_request.github_pr_id, 700)
+        self.assertEqual(mutable.pull_request.github_author_id, 900)
+        self.assertEqual(mutable.pull_request.title, "Updated title")
+        self.assertEqual(mutable.pull_request.github_author_login, "OctoCat-Renamed")
+        ignored_older = await self.store.observe_pull_request(
+            self.pull_request(
+                title="Stale title",
+                updated_at=self.now + timedelta(minutes=1),
+            )
+        )
+        self.assertIs(ignored_older.state, models.PullRequestObservationState.STALE)
+        self.assertEqual(ignored_older.pull_request.title, "Updated title")
+
+        conflict = await self.store.observe_pull_request(
+            self.pull_request(
+                title="Conflicting title",
+                login="OctoCat-Renamed",
+                updated_at=self.now + timedelta(minutes=2),
+            )
+        )
+        self.assertIs(conflict.state, models.PullRequestObservationState.CONFLICT)
+        self.assertEqual(conflict.pull_request.title, "Updated title")
+
+        authoritative = await self.store.observe_pull_request(
+            self.pull_request(
+                title="Authoritative title",
+                login="OctoCat-Renamed",
+                updated_at=self.now + timedelta(minutes=2),
+            ),
+            authoritative=True,
+        )
+        self.assertIs(authoritative.state, models.PullRequestObservationState.APPLIED)
+        self.assertEqual(authoritative.pull_request.title, "Authoritative title")
+
+        self.assertTrue(await self.store.delete_ticket(ticket.ticket_id))
+        self.assertIsNone((await self.store.get_pull_request(100, 7)).current_ticket_id)
+        replacement = await self.store.create_ticket_for_pull_request(
+            self.new_ticket(author_id=111),
+            self.pull_request(updated_at=self.now + timedelta(minutes=3)),
+        )
+        self.assertNotEqual(replacement.ticket_id, ticket.ticket_id)
+
+    async def test_ticket_creation_requires_authority_for_each_origin(self):
+        invalid_discord = models.NewTicket(
+            guild_id=10,
+            channel_id=20,
+            author_id=None,
+            pr_title="Missing Discord author",
+            pr_url="https://example.test/pull/1",
+            category_display="",
+            routing_mode=models.RoutingMode.NONE,
+            direct_target_id=None,
+            category_ids=(),
+            created_at=self.now,
+        )
+        with self.assertRaisesRegex(ValueError, "Discord.*author"):
+            await self.store.create_ticket(invalid_discord)
+
+        with self.assertRaisesRegex(ValueError, "pull request binding"):
+            await self.store.create_ticket(self.new_ticket())
+
+        self.assertEqual(await self.store.list_projection_cleanup_tickets(), ())
+
+    async def test_observation_without_action_preserves_last_processed_action(self):
+        await self.store.create_ticket_for_pull_request(
+            self.new_ticket(),
+            self.pull_request(),
+        )
+
+        observed = await self.store.observe_pull_request(
+            self.pull_request(
+                title="Title-only observation",
+                updated_at=self.now + timedelta(minutes=1),
+                last_processed_action=None,
+            )
+        )
+
+        self.assertIs(observed.state, models.PullRequestObservationState.APPLIED)
+        self.assertEqual(observed.pull_request.title, "Title-only observation")
+        self.assertEqual(observed.pull_request.last_processed_action, "labeled")
+
+    async def test_assignees_round_trip_and_conflict_at_equal_timestamp(self):
+        applied = await self.store.observe_pull_request(
+            self.pull_request(assignees=("ReviewerOne",))
+        )
+
+        self.assertIs(applied.state, models.PullRequestObservationState.APPLIED)
+        self.assertEqual(applied.pull_request.assignees, ("ReviewerOne",))
+        self.assertEqual(
+            (await self.store.get_pull_request(100, 7)).assignees,
+            ("ReviewerOne",),
+        )
+
+        conflict = await self.store.observe_pull_request(
+            self.pull_request(assignees=("ReviewerTwo",))
+        )
+        self.assertIs(conflict.state, models.PullRequestObservationState.CONFLICT)
+        self.assertEqual(conflict.pull_request.assignees, ("ReviewerOne",))
+
+        authoritative = await self.store.observe_pull_request(
+            self.pull_request(assignees=("ReviewerTwo",)),
+            authoritative=True,
+        )
+        self.assertIs(authoritative.state, models.PullRequestObservationState.APPLIED)
+        self.assertEqual(authoritative.pull_request.assignees, ("ReviewerTwo",))
+
+    async def test_ticket_deletion_preserves_executable_github_intent(self):
+        ticket = await self.store.create_ticket_for_pull_request(
+            self.new_ticket(),
+            self.pull_request(),
+        )
+        await self.store.activate_ticket(
+            ticket.ticket_id,
+            message_id=1001,
+            thread_id=2001,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        self.assertTrue(
+            await self.store.claim_with_github_assignment(
+                ticket.ticket_id,
+                assignee_id=222,
+                github_login="Reviewer",
+                github_write_required=True,
+                protection_until=self.now + timedelta(seconds=10),
+                updated_at=self.now,
+            )
+        )
+
+        self.assertTrue(await self.store.delete_ticket(ticket.ticket_id))
+        intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+
+        self.assertIsNotNone(intent)
+        assert intent is not None
+        self.assertEqual(intent.repository_id, 100)
+        self.assertEqual(intent.pr_number, 7)
+        self.assertEqual(intent.github_login, "reviewer")
+        self.assertTrue(
+            await self.store.complete_outbox(intent.outbox_id, completed_at=self.now)
+        )
+
+    async def test_delivery_inbox_deduplicates_recovers_stale_work_and_clears_successful_body(
+        self,
+    ):
+        self.assertTrue(
+            hasattr(self.store, "accept_delivery"),
+            "the store must own durable delivery acceptance",
+        )
+        for guid in ("delivery-b", "delivery-a"):
+            self.assertTrue(
+                await self.store.accept_delivery(
+                    delivery_guid=guid,
+                    github_delivery_id=None,
+                    event="pull_request",
+                    action="labeled",
+                    installation_id=123,
+                    repository_id=100,
+                    pr_number=7,
+                    received_at=self.now,
+                    raw_body=b'{"private":"payload"}',
+                )
+            )
+        self.assertFalse(
+            await self.store.accept_delivery(
+                delivery_guid="delivery-a",
+                github_delivery_id=None,
+                event="pull_request",
+                action="edited",
+                installation_id=123,
+                repository_id=100,
+                pr_number=7,
+                received_at=self.now + timedelta(minutes=1),
+                raw_body=b"different duplicate body",
+            )
+        )
+
+        reopened = store_module.GitHubTicketsStore(self.path)
+        await reopened.initialize()
+        first = await reopened.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        second = await reopened.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(first.delivery_guid, "delivery-a")
+        self.assertEqual(second.delivery_guid, "delivery-b")
+        self.assertEqual(first.attempts, 1)
+        self.assertEqual(first.raw_body, b'{"private":"payload"}')
+        self.assertFalse(
+            await reopened.accept_delivery(
+                delivery_guid="delivery-a",
+                github_delivery_id=None,
+                event="pull_request",
+                action="labeled",
+                installation_id=123,
+                repository_id=100,
+                pr_number=7,
+                received_at=self.now + timedelta(minutes=1),
+                raw_body=b"processing duplicate",
+            )
+        )
+        self.assertIsNone(
+            await reopened.claim_next_delivery(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+
+        recovered = await reopened.claim_next_delivery(
+            now=self.now + timedelta(minutes=10),
+            stale_before=self.now + timedelta(minutes=1),
+        )
+        self.assertEqual(recovered.delivery_guid, "delivery-a")
+        self.assertEqual(recovered.attempts, 2)
+        self.assertTrue(
+            await reopened.complete_delivery(
+                recovered.delivery_guid,
+                completed_at=self.now + timedelta(minutes=10),
+            )
+        )
+        completed = await reopened.get_delivery(recovered.delivery_guid)
+        self.assertEqual(completed.state, models.GitHubDeliveryState.PROCESSED)
+        self.assertIsNone(completed.raw_body)
+        self.assertFalse(
+            await reopened.accept_delivery(
+                delivery_guid="delivery-a",
+                github_delivery_id=None,
+                event="pull_request",
+                action="labeled",
+                installation_id=123,
+                repository_id=100,
+                pr_number=7,
+                received_at=self.now + timedelta(minutes=11),
+                raw_body=b"processed duplicate",
+            )
+        )
+
+        with self.assertRaisesRegex(ValueError, "raw body"):
+            await reopened.accept_delivery(
+                delivery_guid="too-large",
+                github_delivery_id=None,
+                event="ping",
+                action=None,
+                installation_id=123,
+                repository_id=None,
+                pr_number=None,
+                received_at=self.now,
+                raw_body=b"x" * (store_module.MAX_DELIVERY_BODY_BYTES + 1),
+            )
+
+    async def test_recovery_checkpoint_is_durable_and_globally_owned(self):
+        self.assertEqual(
+            await self.store.get_delivery_recovery_checkpoint(),
+            (1, None),
+        )
+        await self.store.save_delivery_recovery_checkpoint(
+            next_page=4,
+            last_delivery_id=321,
+            checked_at=self.now,
+        )
+        await self.store.save_profile(
+            guild_id=10,
+            user_id=20,
+            github_username="someone",
+            category_ids=(),
+            automatic_pings=False,
+            updated_at=self.now,
+        )
+
+        reloaded = store_module.GitHubTicketsStore(self.path)
+        await reloaded.initialize()
+        self.assertEqual(
+            await reloaded.get_delivery_recovery_checkpoint(),
+            (4, 321),
+        )
+        self.assertTrue(await reloaded.delete_guild_state(10))
+        self.assertEqual(
+            await reloaded.get_delivery_recovery_checkpoint(),
+            (4, 321),
+        )
+
+    async def test_delivery_retention_bounds_failed_bodies_and_keeps_identity_for_seven_days(
+        self,
+    ):
+        self.assertTrue(
+            hasattr(self.store, "prune_deliveries"),
+            "the store must own delivery retention cutoffs",
+        )
+        await self.store.accept_delivery(
+            delivery_guid="failed-delivery",
+            github_delivery_id=1234,
+            event="pull_request",
+            action="edited",
+            installation_id=123,
+            repository_id=100,
+            pr_number=7,
+            received_at=self.now,
+            raw_body=b'{"private":"payload"}',
+        )
+        await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        await self.store.fail_delivery(
+            "failed-delivery",
+            completed_at=self.now,
+            error_summary="terminal failure",
+        )
+        await self.store.accept_delivery(
+            delivery_guid="awaiting-redelivery",
+            github_delivery_id=1235,
+            event="pull_request",
+            action="edited",
+            installation_id=123,
+            repository_id=100,
+            pr_number=8,
+            received_at=self.now,
+            raw_body=b'{"private":"redelivery"}',
+        )
+        awaiting = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertIsNotNone(awaiting)
+        assert awaiting is not None
+        await self.store.fail_delivery(
+            awaiting.delivery_guid,
+            completed_at=self.now,
+            error_summary="retry through GitHub",
+        )
+        await self.store.prepare_delivery_redelivery(
+            awaiting.delivery_guid,
+            github_delivery_id=1235,
+            now=self.now,
+            next_attempt_at=self.now + timedelta(minutes=1),
+        )
+
+        self.assertEqual(
+            await self.store.prune_deliveries(self.now + timedelta(days=4)),
+            (2, 0),
+        )
+        retained = await self.store.get_delivery("failed-delivery")
+        self.assertIsNone(retained.raw_body)
+        self.assertEqual(retained.github_delivery_id, 1234)
+        awaiting_retained = await self.store.get_delivery("awaiting-redelivery")
+        self.assertEqual(
+            awaiting_retained.state,
+            models.GitHubDeliveryState.AWAITING_REDELIVERY,
+        )
+        self.assertIsNone(awaiting_retained.raw_body)
+        self.assertEqual(
+            await self.store.prune_deliveries(self.now + timedelta(days=8)),
+            (0, 2),
+        )
+        self.assertIsNone(await self.store.get_delivery("failed-delivery"))
+        self.assertIsNone(await self.store.get_delivery("awaiting-redelivery"))
+
+    async def test_delivery_retry_ignored_and_terminal_states_are_durable(self):
+        await self.store.accept_delivery(
+            delivery_guid="retry-delivery",
+            github_delivery_id=None,
+            event="pull_request",
+            action="edited",
+            installation_id=123,
+            repository_id=100,
+            pr_number=7,
+            received_at=self.now,
+            raw_body=b"retry body",
+        )
+        retry = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        retry_at = self.now + timedelta(minutes=5)
+        self.assertTrue(
+            await self.store.defer_delivery(
+                retry.delivery_guid,
+                next_attempt_at=retry_at,
+                error_summary="x" * 1_000,
+            )
+        )
+        self.assertFalse(
+            await self.store.accept_delivery(
+                delivery_guid="retry-delivery",
+                github_delivery_id=None,
+                event="pull_request",
+                action="edited",
+                installation_id=123,
+                repository_id=100,
+                pr_number=7,
+                received_at=self.now + timedelta(minutes=1),
+                raw_body=b"retry duplicate",
+            )
+        )
+        await self.store.accept_delivery(
+            delivery_guid="ignored-delivery",
+            github_delivery_id=None,
+            event="unknown_event",
+            action=None,
+            installation_id=123,
+            repository_id=None,
+            pr_number=None,
+            received_at=self.now,
+            raw_body=b"ignored body",
+        )
+        ignored = await self.store.claim_next_delivery(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertTrue(
+            await self.store.complete_delivery(
+                ignored.delivery_guid,
+                completed_at=self.now,
+                ignored=True,
+            )
+        )
+        stored_ignored = await self.store.get_delivery(ignored.delivery_guid)
+        self.assertEqual(stored_ignored.state, models.GitHubDeliveryState.IGNORED)
+        self.assertIsNone(stored_ignored.raw_body)
+        self.assertFalse(
+            await self.store.accept_delivery(
+                delivery_guid="ignored-delivery",
+                github_delivery_id=None,
+                event="unknown_event",
+                action=None,
+                installation_id=123,
+                repository_id=None,
+                pr_number=None,
+                received_at=self.now + timedelta(minutes=1),
+                raw_body=b"ignored duplicate",
+            )
+        )
+        self.assertIsNone(
+            await self.store.claim_next_delivery(
+                now=self.now + timedelta(minutes=4),
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+        retried = await self.store.claim_next_delivery(
+            now=retry_at,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(retried.delivery_guid, retry.delivery_guid)
+        self.assertEqual(retried.attempts, 2)
+        self.assertEqual(len(retried.error_summary), store_module.MAX_ERROR_SUMMARY_LENGTH)
+        self.assertTrue(
+            await self.store.fail_delivery(
+                retried.delivery_guid,
+                completed_at=retry_at,
+                error_summary="y" * 1_000,
+            )
+        )
+        failed = await self.store.get_delivery(retried.delivery_guid)
+        self.assertEqual(failed.state, models.GitHubDeliveryState.FAILED)
+        self.assertEqual(len(failed.error_summary), store_module.MAX_ERROR_SUMMARY_LENGTH)
+        self.assertIsNone(
+            await self.store.claim_next_delivery(
+                now=self.now + timedelta(days=1),
+                stale_before=self.now + timedelta(hours=1),
+            )
+        )
+
+    async def test_outbox_ordering_retry_and_terminal_states_are_durable(self):
+        await self.create_pending_outbox(
+            repository_id=102,
+            pr_number=9,
+            github_pr_id=900,
+            assignee_id=201,
+            github_login="zeta-user",
+        )
+        await self.create_pending_outbox(
+            repository_id=103,
+            pr_number=10,
+            github_pr_id=1_000,
+            assignee_id=202,
+            github_login="alpha-user",
+        )
+
+        first = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(first.github_login, "zeta-user")
+        retry_at = self.now + timedelta(minutes=5)
+        self.assertTrue(
+            await self.store.defer_outbox(
+                first.outbox_id,
+                next_attempt_at=retry_at,
+                error_summary="x" * 1_000,
+            )
+        )
+        second = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(second.github_login, "alpha-user")
+        self.assertTrue(
+            await self.store.fail_outbox(
+                second.outbox_id,
+                failed_at=self.now,
+                error_summary="y" * 1_000,
+            )
+        )
+        failed = await self.store.get_outbox_item(second.outbox_id)
+        self.assertEqual(failed.state, models.GitHubOutboxState.FAILED)
+        self.assertEqual(len(failed.error_summary), store_module.MAX_ERROR_SUMMARY_LENGTH)
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now + timedelta(minutes=4),
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+        retried = await self.store.claim_next_outbox(
+            now=retry_at,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(retried.outbox_id, first.outbox_id)
+        self.assertEqual(retried.attempts, 2)
+        self.assertEqual(len(retried.error_summary), store_module.MAX_ERROR_SUMMARY_LENGTH)
+        self.assertTrue(
+            await self.store.complete_outbox(
+                retried.outbox_id,
+                completed_at=retry_at,
+            )
+        )
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now + timedelta(days=1),
+                stale_before=self.now + timedelta(hours=1),
+            )
+        )
+
+    async def test_deferred_outbox_intent_blocks_later_intents_for_same_pr(self):
+        ticket = await self.create_pending_outbox(
+            repository_id=102,
+            pr_number=9,
+            github_pr_id=900,
+            assignee_id=201,
+            github_login="reviewer",
+        )
+        add_intent = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        retry_at = self.now + timedelta(minutes=5)
+        self.assertTrue(
+            await self.store.defer_outbox(
+                add_intent.outbox_id,
+                next_attempt_at=retry_at,
+                error_summary="temporary failure",
+            )
+        )
+        self.assertEqual(
+            await self.store.unassign_with_github_outbox(
+                ticket.ticket_id,
+                protection_until=self.now + timedelta(minutes=1),
+                next_action=None,
+                next_action_at=None,
+                updated_at=self.now + timedelta(seconds=1),
+            ),
+            201,
+        )
+
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now + timedelta(seconds=1),
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+        retried_add = await self.store.claim_next_outbox(
+            now=retry_at,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(retried_add.outbox_id, add_intent.outbox_id)
+        self.assertTrue(
+            await self.store.complete_outbox(
+                retried_add.outbox_id,
+                completed_at=retry_at,
+            )
+        )
+        remove_intent = await self.store.claim_next_outbox(
+            now=retry_at,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(
+            remove_intent.operation,
+            models.GitHubOutboxOperation.REMOVE_ASSIGNEE,
+        )
+
+    async def test_claim_and_unassign_commit_outbox_intents_atomically(self):
+        self.assertTrue(
+            hasattr(self.store, "claim_with_github_assignment"),
+            "the store must own the local transition and outbox transaction",
+        )
+        ticket = await self.store.create_ticket_for_pull_request(
+            self.new_ticket(author_id=111),
+            self.pull_request(),
+        )
+        await self.store.activate_ticket(
+            ticket.ticket_id,
+            message_id=300,
+            thread_id=400,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+
+        self.assertTrue(
+            await self.store.claim_with_github_assignment(
+                ticket.ticket_id,
+                assignee_id=222,
+                github_login=" OctoCat ",
+                github_write_required=True,
+                protection_until=self.now + timedelta(minutes=5),
+                updated_at=self.now,
+            )
+        )
+        claimed_ticket = await self.store.get_ticket(ticket.ticket_id)
+        self.assertEqual(claimed_ticket.state, models.TicketState.CLAIMED)
+        self.assertEqual(claimed_ticket.assignee_id, 222)
+
+        reopened = store_module.GitHubTicketsStore(self.path)
+        await reopened.initialize()
+        add_intent = await reopened.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(
+            add_intent.operation,
+            models.GitHubOutboxOperation.ADD_ASSIGNEE,
+        )
+        self.assertEqual(add_intent.github_login, "octocat")
+        self.assertEqual(add_intent.actor_user_id, 222)
+        self.assertEqual(add_intent.repository_id, 100)
+        self.assertEqual(add_intent.repository_full_name, "NewHorizons/NHCogs")
+        self.assertEqual(add_intent.pr_number, 7)
+        self.assertEqual(add_intent.transition_version, claimed_ticket.transition_version)
+        self.assertTrue(
+            await reopened.complete_outbox(
+                add_intent.outbox_id,
+                completed_at=self.now + timedelta(seconds=1),
+            )
+        )
+
+        with closing(store_module.connect(self.path)) as connection:
+            connection.execute(
+                f"""
+                CREATE TRIGGER reject_test_remove_outbox
+                BEFORE INSERT ON github_outbox
+                WHEN NEW.ticket_id = {ticket.ticket_id}
+                    AND NEW.operation = 'remove_assignee'
+                BEGIN
+                    SELECT RAISE(ABORT, 'test remove outbox failure');
+                END
+                """
+            )
+            connection.commit()
+        with self.assertRaises(sqlite3.IntegrityError):
+            await reopened.unassign_with_github_outbox(
+                ticket.ticket_id,
+                protection_until=self.now + timedelta(minutes=10),
+                next_action=None,
+                next_action_at=None,
+                updated_at=self.now + timedelta(seconds=2),
+            )
+        still_claimed = await reopened.get_ticket(ticket.ticket_id)
+        self.assertEqual(still_claimed.state, models.TicketState.CLAIMED)
+        self.assertEqual(still_claimed.assignee_id, 222)
+        with closing(store_module.connect(self.path)) as connection:
+            connection.execute("DROP TRIGGER reject_test_remove_outbox")
+            connection.commit()
+
+        self.assertEqual(
+            await reopened.unassign_with_github_outbox(
+                ticket.ticket_id,
+                protection_until=self.now + timedelta(minutes=10),
+                next_action=None,
+                next_action_at=None,
+                updated_at=self.now + timedelta(seconds=2),
+            ),
+            222,
+        )
+        remove_intent = await reopened.claim_next_outbox(
+            now=self.now + timedelta(seconds=2),
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(
+            remove_intent.operation,
+            models.GitHubOutboxOperation.REMOVE_ASSIGNEE,
+        )
+        self.assertEqual(remove_intent.github_login, "octocat")
+        self.assertEqual(remove_intent.repository_full_name, "NewHorizons/NHCogs")
+        self.assertEqual(remove_intent.actor_user_id, 222)
+        recovered_remove = await reopened.claim_next_outbox(
+            now=self.now + timedelta(minutes=10),
+            stale_before=self.now + timedelta(minutes=1),
+        )
+        self.assertEqual(recovered_remove.outbox_id, remove_intent.outbox_id)
+        self.assertEqual(recovered_remove.attempts, 2)
+
+        second = await reopened.create_ticket_for_pull_request(
+            self.new_ticket(author_id=333),
+            self.pull_request(
+                repository_id=101,
+                pr_number=8,
+                github_pr_id=800,
+                updated_at=self.now + timedelta(minutes=1),
+            ),
+        )
+        await reopened.activate_ticket(
+            second.ticket_id,
+            message_id=301,
+            thread_id=401,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        with closing(store_module.connect(self.path)) as connection:
+            connection.execute(
+                f"""
+                CREATE TRIGGER reject_test_outbox
+                BEFORE INSERT ON github_outbox
+                WHEN NEW.ticket_id = {second.ticket_id}
+                BEGIN
+                    SELECT RAISE(ABORT, 'test outbox failure');
+                END
+                """
+            )
+            connection.commit()
+
+        with self.assertRaises(sqlite3.IntegrityError):
+            await reopened.claim_with_github_assignment(
+                second.ticket_id,
+                assignee_id=444,
+                github_login="other-user",
+                github_write_required=True,
+                protection_until=self.now + timedelta(minutes=5),
+                updated_at=self.now,
+            )
+        unchanged = await reopened.get_ticket(second.ticket_id)
+        self.assertEqual(unchanged.state, models.TicketState.OPEN)
+        self.assertIsNone(unchanged.assignee_id)
diff --git a/tests/test_github_tickets_lifecycle.py b/tests/test_github_tickets_lifecycle.py
index ac710d3..3778430 100644
--- a/tests/test_github_tickets_lifecycle.py
+++ b/tests/test_github_tickets_lifecycle.py
@@ -16,6 +16,7 @@ def __init__(self, *, ready=False):
         self.channels = {}
         self.guild_map = {}
         self.fetch_calls = 0
+        self.api_tokens = {}
 
     def get_channel(self, channel_id):
         return self.channels.get(channel_id)
@@ -30,6 +31,35 @@ async def fetch_channel(self, _channel_id):
         self.fetch_calls += 1
         raise AssertionError("startup must not fetch Discord objects")
 
+    async def get_shared_api_tokens(self, service):
+        return self.api_tokens if service == "githubtickets" else {}
+
+
+class FakeGitHubSession:
+    def __init__(self):
+        self.closed = False
+
+    async def close(self):
+        self.closed = True
+
+
+class FakeGitHubRuntime:
+    instances = []
+
+    def __init__(self, store, **kwargs):
+        self.store = store
+        self.kwargs = kwargs
+        self.started = []
+        self.closed = False
+        self.__class__.instances.append(self)
+
+    async def start(self, host, port):
+        self.started.append((host, port))
+        return port
+
+    async def close(self):
+        self.closed = True
+
 
 class FakeInteractionResponse:
     def __init__(self):
@@ -106,6 +136,10 @@ def setUp(self):
         self.temporary_directory = TemporaryDirectory()
         self.addCleanup(self.temporary_directory.cleanup)
         self.data_path = Path(self.temporary_directory.name)
+        secret_path = self.data_path / "secrets"
+        secret_path.mkdir()
+        (secret_path / "github-app.pem").write_bytes(b"private-key")
+        (secret_path / "webhook-secret.txt").write_bytes(b"webhook-secret")
 
     async def test_startup_restores_views_locally_then_starts_deadline_scheduler(self):
         with isolated_githubtickets_modules(self.data_path) as modules:
@@ -172,10 +206,10 @@ async def test_startup_restores_views_locally_then_starts_deadline_scheduler(sel
                         break
                     await asyncio.sleep(0.01)
 
-                self.assertEqual(len(bot.restored_views), 2)
+                self.assertEqual(len(bot.restored_views), 6)
                 self.assertEqual(
                     [message_id for _view, message_id in bot.restored_views],
-                    [40, 41],
+                    [40, None, None, 41, None, None],
                 )
                 self.assertTrue(
                     all(view.timeout is None for view, _message_id in bot.restored_views)
@@ -190,6 +224,147 @@ async def test_startup_restores_views_locally_then_starts_deadline_scheduler(sel
             self.assertIsNone(cog.scheduler._task)
             await asyncio.sleep(0.01)
 
+    async def test_configured_github_runtime_starts_after_discord_restore_and_closes(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            bot = FakeBot(ready=True)
+            bot.api_tokens = {
+                "organization": "NewHorizons",
+                "client_id": "Iv1.client",
+                "app_id": "123",
+                "installation_id": "456",
+            }
+            cog = modules.githubtickets.GitHubTickets(bot)
+            await cog.config.set_raw("guild_id", value=10)
+            await cog.config.set_raw("enabled", value=True)
+            await cog.config.set_raw("bind_host", value="127.0.0.1")
+            await cog.config.set_raw("bind_port", value=8765)
+            await cog.config.set_raw("recovery_seconds", value=60)
+            session = FakeGitHubSession()
+            FakeGitHubRuntime.instances.clear()
+
+            with (
+                mock.patch.object(
+                    modules.githubtickets.aiohttp,
+                    "ClientSession",
+                    return_value=session,
+                ),
+                mock.patch.object(
+                    modules.githubtickets,
+                    "GitHubIntegrationRuntime",
+                    FakeGitHubRuntime,
+                ),
+            ):
+                await cog.cog_load()
+                for _attempt in range(50):
+                    if getattr(cog, "_github_runtime", None) is not None:
+                        break
+                    await asyncio.sleep(0.01)
+
+                self.assertEqual(len(FakeGitHubRuntime.instances), 1)
+                runtime = FakeGitHubRuntime.instances[0]
+                self.assertIs(cog._github_runtime, runtime)
+                self.assertEqual(runtime.started, [("127.0.0.1", 8765)])
+                self.assertEqual(runtime.kwargs["guild_id"], 10)
+                self.assertEqual(
+                    runtime.kwargs["recovery_interval"].total_seconds(),
+                    60,
+                )
+                self.assertIsInstance(
+                    runtime.kwargs["delivery_handler"],
+                    modules.event_handler.GitHubEventHandler,
+                )
+                self.assertEqual(cog._github_organization, "NewHorizons")
+
+                await cog.cog_unload()
+
+            self.assertTrue(runtime.closed)
+            self.assertTrue(session.closed)
+            self.assertIsNone(cog._github_runtime)
+            self.assertIsNone(cog._github_client)
+
+    async def test_shared_githubtickets_token_update_restarts_only_its_runtime(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            cog = modules.githubtickets.GitHubTickets(FakeBot(ready=True))
+            listener = getattr(cog, "on_red_api_tokens_update", None)
+            self.assertIsNotNone(listener)
+            if listener is None:
+                return
+            cog._restart_github_integration = mock.AsyncMock(return_value=True)
+
+            await listener("youtube", {"api_key": "ignored"})
+            cog._restart_github_integration.assert_not_awaited()
+
+            await listener("githubtickets", {"client_id": "replacement"})
+            cog._restart_github_integration.assert_awaited_once_with()
+
+            failure = RuntimeError("restart failed")
+            cog._restart_github_integration = mock.AsyncMock(side_effect=failure)
+            with mock.patch.object(
+                modules.githubtickets,
+                "report_operational_error",
+                new=mock.AsyncMock(),
+            ) as report:
+                await listener("githubtickets", {})
+
+            report.assert_awaited_once()
+            self.assertEqual(report.await_args.kwargs["source"], "GitHubTickets")
+            self.assertEqual(
+                report.await_args.kwargs["action"],
+                "restart GitHub integration after API token update",
+            )
+            self.assertIs(report.await_args.kwargs["error"], failure)
+
+    async def test_lifecycle_stop_disables_owner_until_moderator_enable(self):
+        with isolated_githubtickets_modules(self.data_path) as modules:
+            bot = FakeBot(ready=True)
+            bot.api_tokens = {
+                "organization": "NewHorizons",
+                "client_id": "Iv1.client",
+                "app_id": "123",
+                "installation_id": "456",
+            }
+            cog = modules.githubtickets.GitHubTickets(bot)
+            await cog.config.set_raw("guild_id", value=10)
+            await cog.config.set_raw("enabled", value=True)
+            await cog.config.set_raw("bind_host", value="127.0.0.1")
+            await cog.config.set_raw("bind_port", value=8765)
+            session = FakeGitHubSession()
+            FakeGitHubRuntime.instances.clear()
+
+            with (
+                mock.patch.object(
+                    modules.githubtickets.aiohttp,
+                    "ClientSession",
+                    return_value=session,
+                ),
+                mock.patch.object(
+                    modules.githubtickets,
+                    "GitHubIntegrationRuntime",
+                    FakeGitHubRuntime,
+                ),
+            ):
+                self.assertTrue(await cog._restart_github_integration())
+                runtime = FakeGitHubRuntime.instances[0]
+                lifecycle_stopped = runtime.kwargs.get("lifecycle_stopped")
+                self.assertIsNotNone(lifecycle_stopped)
+                if lifecycle_stopped is None:
+                    return
+
+                await lifecycle_stopped(runtime)
+
+                integration = modules.settings.GitHubIntegrationSettings.from_mapping(
+                    await cog.config.all()
+                )
+                self.assertFalse(integration.enabled)
+                self.assertIsNone(cog._github_runtime)
+                self.assertIsNone(cog._github_client)
+                self.assertIsNone(cog._github_session)
+                self.assertIsNone(cog._github_organization)
+                self.assertTrue(session.closed)
+
+                self.assertFalse(await cog._restart_github_integration())
+                self.assertEqual(len(FakeGitHubRuntime.instances), 1)
+
     async def test_application_commands_are_guild_only_and_runtime_authorized(self):
         with isolated_githubtickets_modules(self.data_path) as modules:
             bot = FakeBot(ready=False)
@@ -242,8 +417,21 @@ async def test_application_commands_are_guild_only_and_runtime_authorized(self):
 
                 accepted = FakeInteraction(role_ids=(99,))
                 await new_ticket_command.callback(accepted)
+                self.assertEqual(
+                    accepted.response.messages[0][0],
+                    "GitHub integration is unavailable",
+                )
+                self.assertTrue(accepted.response.messages[0][1]["ephemeral"])
+                self.assertEqual(accepted.response.modals, [])
+
+                cog._github_client = SimpleNamespace(
+                    get_pull_request=mock.AsyncMock(),
+                )
+                cog._github_organization = "NewHorizons"
+                configured = FakeInteraction(role_ids=(99,))
+                await new_ticket_command.callback(configured)
                 self.assertIsInstance(
-                    accepted.response.modals[0],
+                    configured.response.modals[0],
                     modules.dashboard.NewTicketModal,
                 )
 
@@ -1021,7 +1209,7 @@ async def test_red_privacy_deletion_keeps_existing_finishing_cleanup_ids(self):
 
             cleanup = await cog.store.get_ticket(created.ticket_id)
             self.assertEqual(cleanup.state, modules.models.TicketState.FINISHING)
-            self.assertEqual(cleanup.author_id, 0)
+            self.assertIsNone(cleanup.author_id)
             self.assertEqual(cleanup.pr_title, "")
             self.assertEqual(cleanup.pr_url, "")
             self.assertEqual(cleanup.category_display, "")
diff --git a/tests/test_github_tickets_presentation.py b/tests/test_github_tickets_presentation.py
index d3e0dc9..12c3e89 100644
--- a/tests/test_github_tickets_presentation.py
+++ b/tests/test_github_tickets_presentation.py
@@ -166,6 +166,21 @@ def test_finished_ticket_log_omits_a_missing_reviewer(self):
             "Finished by <@40> | Author <@30>",
         )
 
+    def test_finished_ticket_log_handles_github_finish_without_discord_author(self):
+        presentation = load_presentation_module()
+
+        self.assertEqual(
+            presentation.finished_ticket_log(
+                title="Improve rendering",
+                url="https://github.com/example/repository/pull/123",
+                actor_id=None,
+                author_id=None,
+                reviewer_id=50,
+            ),
+            "[Improve rendering](<https://github.com/example/repository/pull/123>)\n"
+            "Finished from GitHub | Reviewer <@50>",
+        )
+
     def test_configuration_overview_uses_the_accepted_labels(self):
         presentation = load_presentation_module()
 
diff --git a/tests/test_github_tickets_settings.py b/tests/test_github_tickets_settings.py
index 95d4e4a..ef3a6fb 100644
--- a/tests/test_github_tickets_settings.py
+++ b/tests/test_github_tickets_settings.py
@@ -5,9 +5,7 @@
 from dataclasses import asdict
 from pathlib import Path
 
-SETTINGS_PATH = (
-    Path(__file__).parents[1] / "NHCogs" / "githubtickets" / "settings.py"
-)
+SETTINGS_PATH = Path(__file__).parents[1] / "NHCogs" / "githubtickets" / "settings.py"
 INFO_PATH = Path(__file__).parents[1] / "NHCogs" / "githubtickets" / "info.json"
 
 
@@ -111,6 +109,50 @@ def test_malformed_or_negative_values_fall_back_independently(self):
 
         self.assertEqual(snapshot, settings.GuildSettings.from_mapping({}))
 
+    def test_github_integration_defaults_are_dormant_and_unconfigured(self):
+        settings = load_settings_module()
+
+        snapshot = settings.GitHubIntegrationSettings.from_mapping({})
+
+        self.assertEqual(asdict(snapshot), settings.GITHUB_INTEGRATION_DEFAULTS)
+        self.assertFalse(snapshot.receiver_configured)
+
+    def test_github_integration_mapping_normalizes_runtime_configuration(self):
+        settings = load_settings_module()
+
+        snapshot = settings.GitHubIntegrationSettings.from_mapping(
+            {
+                "guild_id": "42",
+                "enabled": True,
+                "bind_host": " 127.0.0.1 ",
+                "bind_port": 8080,
+                "recovery_seconds": 30,
+                "private_key": "must not be modeled",
+            }
+        )
+
+        self.assertEqual(snapshot.guild_id, 42)
+        self.assertTrue(snapshot.enabled)
+        self.assertEqual(snapshot.bind_host, "127.0.0.1")
+        self.assertEqual(snapshot.bind_port, 8080)
+        self.assertEqual(snapshot.recovery_seconds, 30)
+        self.assertTrue(snapshot.receiver_configured)
+
+    def test_github_integration_mapping_rejects_partial_or_malformed_bind_values(self):
+        settings = load_settings_module()
+
+        snapshot = settings.GitHubIntegrationSettings.from_mapping(
+            {
+                "guild_id": 0,
+                "enabled": "yes",
+                "bind_host": "  ",
+                "bind_port": 65536,
+                "recovery_seconds": 0,
+            }
+        )
+
+        self.assertEqual(snapshot, settings.GitHubIntegrationSettings.from_mapping({}))
+
     def test_duration_parser_accepts_compact_units_and_distinguishes_negatives(self):
         settings = load_settings_module()
 
diff --git a/tests/test_github_tickets_store.py b/tests/test_github_tickets_store.py
index f3b69d4..2a385ac 100644
--- a/tests/test_github_tickets_store.py
+++ b/tests/test_github_tickets_store.py
@@ -68,13 +68,16 @@ async def test_initialize_creates_versioned_schema_with_foreign_keys(self):
                 )
             }
             ticket_columns = {
-                row[1]
+                row[1]: row
                 for row in connection.execute("PRAGMA table_info(tickets)")
             }
 
-        self.assertEqual(version, 1)
+        self.assertEqual(version, 3)
         self.assertEqual(foreign_keys, 1)
         self.assertIn("projection_sync_at", ticket_columns)
+        self.assertIn("category_prompt_retry_at", ticket_columns)
+        self.assertIn("origin", ticket_columns)
+        self.assertEqual(ticket_columns["author_id"][3], 0)
         self.assertTrue(
             {
                 "categories",
@@ -84,15 +87,18 @@ async def test_initialize_creates_versioned_schema_with_foreign_keys(self):
                 "ticket_categories",
                 "ticket_exclusions",
                 "ticket_pings",
+                "github_pull_requests",
+                "github_deliveries",
+                "github_outbox",
             }.issubset(tables)
         )
 
     async def test_initialize_rejects_newer_schema_version(self):
         self.assertIsNotNone(self.store, "the GitHub Tickets store interface is missing")
         with closing(sqlite3.connect(self.path)) as connection:
-            connection.execute("PRAGMA user_version = 2")
+            connection.execute("PRAGMA user_version = 4")
 
-        with self.assertRaisesRegex(ValueError, "newer than supported version 1"):
+        with self.assertRaisesRegex(ValueError, "newer than supported version 3"):
             await self.store.initialize()
 
     async def test_categories_normalize_validate_and_enforce_guild_limit(self):
@@ -246,6 +252,148 @@ async def _create_open_ticket(
         self.assertTrue(activated)
         return await self.store.get_ticket(ticket.ticket_id)
 
+    async def test_start_automatic_routing_persists_categories_and_schedule(self):
+        await self.store.initialize()
+        rendering = await self.store.add_category(10, "rendering", self.now)
+        python = await self.store.add_category(10, "python", self.now)
+        ticket = await self._create_open_ticket(
+            routing_mode=models.RoutingMode.NONE,
+        )
+        next_action_at = self.now + timedelta(seconds=10)
+        updated_at = self.now + timedelta(seconds=1)
+
+        routed = await self.store.start_automatic_routing(
+            ticket.ticket_id,
+            category_ids=(
+                rendering.category_id,
+                python.category_id,
+                rendering.category_id,
+            ),
+            category_display="rendering, python",
+            next_action_at=next_action_at,
+            updated_at=updated_at,
+        )
+
+        self.assertIsNotNone(routed)
+        self.assertEqual(
+            routed.category_ids,
+            (python.category_id, rendering.category_id),
+        )
+        self.assertEqual(routed.category_display, "rendering, python")
+        self.assertEqual(routed.routing_mode, models.RoutingMode.AUTOMATIC)
+        self.assertEqual(routed.next_action, models.NextAction.AUTOMATIC_PING)
+        self.assertEqual(routed.next_action_at, next_action_at)
+        self.assertEqual(routed.updated_at, updated_at)
+        self.assertEqual(routed.transition_version, ticket.transition_version + 1)
+        self.assertEqual(await self.store.get_ticket(ticket.ticket_id), routed)
+
+    async def test_start_automatic_routing_attaches_claimed_categories_without_deadline(
+        self,
+    ):
+        await self.store.initialize()
+        rendering = await self.store.add_category(10, "rendering", self.now)
+        ticket = await self._create_open_ticket(
+            routing_mode=models.RoutingMode.NONE,
+        )
+        self.assertTrue(
+            await self.store.claim(
+                ticket.ticket_id,
+                200,
+                self.now + timedelta(minutes=1),
+                self.now,
+            )
+        )
+        claimed = await self.store.get_ticket(ticket.ticket_id)
+        next_action_at = self.now + timedelta(seconds=10)
+
+        routed = await self.store.start_automatic_routing(
+            claimed.ticket_id,
+            category_ids=(rendering.category_id,),
+            category_display="rendering",
+            next_action_at=next_action_at,
+            updated_at=self.now + timedelta(seconds=1),
+        )
+
+        self.assertIsNotNone(routed)
+        self.assertEqual(routed.state, models.TicketState.CLAIMED)
+        self.assertEqual(routed.assignee_id, 200)
+        self.assertEqual(routed.routing_mode, models.RoutingMode.AUTOMATIC)
+        self.assertIsNone(routed.next_action)
+        self.assertIsNone(routed.next_action_at)
+        self.assertEqual(routed.category_ids, (rendering.category_id,))
+
+    async def test_start_automatic_routing_rejects_invalid_transitions_atomically(self):
+        await self.store.initialize()
+        rendering = await self.store.add_category(10, "rendering", self.now)
+        other_guild = await self.store.add_category(20, "rendering", self.now)
+        next_action_at = self.now + timedelta(seconds=10)
+        parameters = {
+            "category_ids": (rendering.category_id,),
+            "category_display": "rendering",
+            "next_action_at": next_action_at,
+            "updated_at": self.now + timedelta(seconds=1),
+        }
+
+        self.assertIsNone(await self.store.start_automatic_routing(999, **parameters))
+
+        creating = await self.store.create_ticket(
+            models.NewTicket(
+                guild_id=10,
+                channel_id=20,
+                author_id=100,
+                pr_title="Creating",
+                pr_url="https://example.test/pull/creating",
+                category_display="",
+                routing_mode=models.RoutingMode.NONE,
+                direct_target_id=None,
+                category_ids=(),
+                created_at=self.now,
+            )
+        )
+        self.assertIsNone(
+            await self.store.start_automatic_routing(creating.ticket_id, **parameters)
+        )
+        self.assertEqual(await self.store.get_ticket(creating.ticket_id), creating)
+
+        already_routed = await self._create_open_ticket(
+            routing_mode=models.RoutingMode.AUTOMATIC,
+        )
+        self.assertIsNone(
+            await self.store.start_automatic_routing(
+                already_routed.ticket_id,
+                **parameters,
+            )
+        )
+        self.assertEqual(
+            await self.store.get_ticket(already_routed.ticket_id),
+            already_routed,
+        )
+
+        finishing = await self._create_open_ticket(
+            routing_mode=models.RoutingMode.NONE,
+        )
+        self.assertTrue(await self.store.begin_finishing(finishing.ticket_id, self.now))
+        finishing = await self.store.get_ticket(finishing.ticket_id)
+        self.assertIsNone(
+            await self.store.start_automatic_routing(finishing.ticket_id, **parameters)
+        )
+        self.assertEqual(await self.store.get_ticket(finishing.ticket_id), finishing)
+
+        unchanged = await self._create_open_ticket(
+            category_ids=(rendering.category_id,),
+            category_display="original",
+            routing_mode=models.RoutingMode.NONE,
+        )
+        with self.assertRaisesRegex(ValueError, "must belong to the guild"):
+            await self.store.start_automatic_routing(
+                unchanged.ticket_id,
+                category_ids=(other_guild.category_id,),
+                category_display="foreign",
+                next_action_at=next_action_at,
+                updated_at=self.now + timedelta(seconds=1),
+            )
+        self.assertEqual(await self.store.get_ticket(unchanged.ticket_id), unchanged)
+
     async def test_candidate_history_batches_all_persisted_facts_in_candidate_order(self):
         await self.store.initialize()
         rendering = await self.store.add_category(10, "rendering", self.now)
diff --git a/tests/test_github_tickets_store_cleanup.py b/tests/test_github_tickets_store_cleanup.py
index 07fc971..9b19f12 100644
--- a/tests/test_github_tickets_store_cleanup.py
+++ b/tests/test_github_tickets_store_cleanup.py
@@ -181,7 +181,7 @@ async def test_authored_ticket_cleanup_redacts_content_before_projection_deletio
 
         self.assertIsNotNone(cleanup)
         self.assertEqual(cleanup.state, models.TicketState.FINISHING)
-        self.assertEqual(cleanup.author_id, 0)
+        self.assertIsNone(cleanup.author_id)
         self.assertEqual(cleanup.pr_title, "")
         self.assertEqual(cleanup.pr_url, "")
         self.assertEqual(cleanup.category_display, "")
@@ -207,7 +207,7 @@ async def test_authored_ticket_cleanup_redacts_content_before_projection_deletio
         await reopened.initialize()
         persisted = await reopened.get_ticket(ticket.ticket_id)
         self.assertEqual(persisted.state, models.TicketState.FINISHING)
-        self.assertEqual(persisted.author_id, 0)
+        self.assertIsNone(persisted.author_id)
         self.assertEqual(persisted.message_id, ticket.message_id)
         self.assertEqual(persisted.thread_id, ticket.thread_id)
 
@@ -244,7 +244,7 @@ async def test_authored_ticket_cleanup_redacts_existing_finishing_state(self):
 
         self.assertIsNotNone(cleanup)
         self.assertEqual(cleanup.state, models.TicketState.FINISHING)
-        self.assertEqual(cleanup.author_id, 0)
+        self.assertIsNone(cleanup.author_id)
         self.assertEqual(cleanup.pr_title, "")
         self.assertEqual(cleanup.pr_url, "")
         self.assertEqual(cleanup.message_id, ticket.message_id)
@@ -443,3 +443,180 @@ async def test_user_redaction_requires_every_affected_guild_deadline_before_muta
         unchanged = await self.store.get_ticket(assigned.ticket_id)
         self.assertEqual(unchanged.state, models.TicketState.CLAIMED)
         self.assertEqual(unchanged.assignee_id, user_id)
+
+    async def test_user_and_guild_cleanup_preserve_nonterminal_github_intents(self):
+        user_id = 500
+        pull_request = models.GitHubPullRequest(
+            repository_id=100,
+            pr_number=7,
+            github_pr_id=700,
+            github_author_id=900,
+            repository_full_name="NewHorizons/NHCogs",
+            url="https://github.com/NewHorizons/NHCogs/pull/7",
+            title="Private linked ticket",
+            github_author_login="octocat",
+            draft=False,
+            open=True,
+            labels=("discord-ticket",),
+            github_updated_at=self.now,
+        )
+        ticket = await self.store.create_ticket_for_pull_request(
+            models.NewTicket(
+                guild_id=10,
+                channel_id=30,
+                author_id=100,
+                pr_title=pull_request.title,
+                pr_url=pull_request.url,
+                category_display="",
+                routing_mode=models.RoutingMode.NONE,
+                direct_target_id=None,
+                category_ids=(),
+                created_at=self.now,
+                origin=models.TicketOrigin.GITHUB,
+            ),
+            pull_request,
+        )
+        await self.store.activate_ticket(
+            ticket.ticket_id,
+            message_id=1000,
+            thread_id=2000,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        await self.store.claim_with_github_assignment(
+            ticket.ticket_id,
+            assignee_id=user_id,
+            github_login="private-login",
+            github_write_required=True,
+            protection_until=self.now,
+            updated_at=self.now,
+        )
+        outbox = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        pending_pull_request = models.GitHubPullRequest(
+            repository_id=101,
+            pr_number=8,
+            github_pr_id=701,
+            github_author_id=901,
+            repository_full_name="NewHorizons/NHCogs",
+            url="https://github.com/NewHorizons/NHCogs/pull/8",
+            title="Second linked ticket",
+            github_author_login="other-author",
+            draft=False,
+            open=True,
+            labels=("discord-ticket",),
+            github_updated_at=self.now,
+        )
+        pending_ticket = await self.store.create_ticket_for_pull_request(
+            models.NewTicket(
+                guild_id=10,
+                channel_id=30,
+                author_id=101,
+                pr_title=pending_pull_request.title,
+                pr_url=pending_pull_request.url,
+                category_display="",
+                routing_mode=models.RoutingMode.NONE,
+                direct_target_id=None,
+                category_ids=(),
+                created_at=self.now,
+                origin=models.TicketOrigin.GITHUB,
+            ),
+            pending_pull_request,
+        )
+        await self.store.activate_ticket(
+            pending_ticket.ticket_id,
+            message_id=1001,
+            thread_id=2001,
+            protection_until=self.now,
+            next_action=None,
+            next_action_at=None,
+            updated_at=self.now,
+        )
+        await self.store.claim_with_github_assignment(
+            pending_ticket.ticket_id,
+            assignee_id=user_id,
+            github_login="pending-login",
+            github_write_required=True,
+            protection_until=self.now,
+            updated_at=self.now,
+        )
+        await self.store.accept_delivery(
+            delivery_guid="private-delivery",
+            github_delivery_id=None,
+            event="pull_request",
+            action="assigned",
+            installation_id=123,
+            repository_id=100,
+            pr_number=7,
+            received_at=self.now,
+            raw_body=b'{"private":"payload"}',
+        )
+
+        self.assertEqual(await self.store.user_reference_guild_ids(user_id), (10,))
+        await self.store.redact_user(
+            user_id,
+            protection_until_by_guild={10: self.now + timedelta(minutes=1)},
+            updated_at=self.now,
+        )
+
+        processing_after_redaction = await self.store.get_outbox_item(outbox.outbox_id)
+        self.assertEqual(processing_after_redaction.state, models.GitHubOutboxState.PROCESSING)
+        self.assertIsNone(processing_after_redaction.actor_user_id)
+        self.assertEqual(processing_after_redaction.github_login, "private-login")
+        redacted = await self.store.get_ticket(ticket.ticket_id)
+        self.assertEqual(redacted.state, models.TicketState.OPEN)
+        self.assertIsNone(redacted.assignee_id)
+        self.assertIsNotNone(await self.store.get_pull_request(100, 7))
+
+        self.assertTrue(await self.store.delete_guild_state(10))
+        self.assertIsNone(await self.store.get_pull_request(100, 7))
+        self.assertIsNone(await self.store.get_delivery("private-delivery"))
+        processing_after_cleanup = await self.store.get_outbox_item(outbox.outbox_id)
+        self.assertEqual(processing_after_cleanup.state, models.GitHubOutboxState.PROCESSING)
+        self.assertEqual(
+            processing_after_cleanup.repository_full_name,
+            "NewHorizons/NHCogs",
+        )
+        self.assertIsNone(processing_after_cleanup.actor_user_id)
+        self.assertTrue(
+            await self.store.complete_outbox(
+                processing_after_cleanup.outbox_id,
+                completed_at=self.now,
+            )
+        )
+        pending = await self.store.claim_next_outbox(
+            now=self.now,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(pending.github_login, "pending-login")
+        self.assertEqual(pending.repository_full_name, "NewHorizons/NHCogs")
+        self.assertIsNone(pending.actor_user_id)
+        retry_at = self.now + timedelta(minutes=1)
+        self.assertTrue(
+            await self.store.defer_outbox(
+                pending.outbox_id,
+                next_attempt_at=retry_at,
+                error_summary="retry after cleanup",
+            )
+        )
+        self.assertIsNone(
+            await self.store.claim_next_outbox(
+                now=self.now,
+                stale_before=self.now - timedelta(minutes=5),
+            )
+        )
+        retried = await self.store.claim_next_outbox(
+            now=retry_at,
+            stale_before=self.now - timedelta(minutes=5),
+        )
+        self.assertEqual(retried.outbox_id, pending.outbox_id)
+        self.assertTrue(
+            await self.store.complete_outbox(
+                retried.outbox_id,
+                completed_at=retry_at,
+            )
+        )
diff --git a/tests/test_github_tickets_ticket_views.py b/tests/test_github_tickets_ticket_views.py
index 46aca83..b775aa9 100644
--- a/tests/test_github_tickets_ticket_views.py
+++ b/tests/test_github_tickets_ticket_views.py
@@ -22,6 +22,7 @@ class ButtonStyle:
         primary = "primary"
         success = "success"
         danger = "danger"
+        secondary = "secondary"
 
     class View:
         def __init__(self, *, timeout=None):
@@ -32,16 +33,40 @@ def add_item(self, item):
             self.children.append(item)
 
     class Button:
-        def __init__(self, *, label, style, custom_id):
+        def __init__(self, *, label, style, custom_id=None):
             self.label = label
             self.style = style
             self.custom_id = custom_id
             self.callback = None
 
+    class Select:
+        def __init__(
+            self,
+            *,
+            placeholder,
+            options,
+            min_values,
+            max_values,
+            required,
+        ):
+            self.placeholder = placeholder
+            self.options = options
+            self.min_values = min_values
+            self.max_values = max_values
+            self.required = required
+            self.values = []
+
+    class SelectOption:
+        def __init__(self, *, label, value):
+            self.label = label
+            self.value = value
+
     ui.View = View
     ui.Button = Button
+    ui.Select = Select
     discord.ui = ui
     discord.ButtonStyle = ButtonStyle
+    discord.SelectOption = SelectOption
     discord.Interaction = type("Interaction", (), {})
     sys.modules["discord"] = discord
     sys.modules["discord.ui"] = ui
@@ -74,18 +99,25 @@ class FakeResponse:
     def __init__(self):
         self.defer_calls = 0
         self.messages = []
+        self.message_kwargs = []
+        self.edit_calls = []
 
     async def defer(self):
         self.defer_calls += 1
 
-    async def send_message(self, content, *, ephemeral):
+    async def send_message(self, content, *, ephemeral, **kwargs):
         self.messages.append((content, ephemeral))
+        self.message_kwargs.append(kwargs)
+
+    async def edit_message(self, **kwargs):
+        self.edit_calls.append(kwargs)
 
 
 class FakeInteraction:
     def __init__(self):
         self.response = FakeResponse()
         self.followup = types.SimpleNamespace(send=mock.AsyncMock())
+        self.edit_original_response = mock.AsyncMock()
 
 
 class TicketControlsTests(unittest.IsolatedAsyncioTestCase):
@@ -214,3 +246,141 @@ async def test_unexpected_action_failure_is_logged_and_accepted_ephemerally(self
             ticket_views.presentation.COULD_NOT_COMPLETE_ACTION,
             ephemeral=True,
         )
+
+
+class GitHubLifecycleControlsTests(unittest.IsolatedAsyncioTestCase):
+    def actor(self, *, participant=True, staff=False):
+        return types.SimpleNamespace(
+            can_participate=participant or staff,
+            can_manage_messages=staff,
+        )
+
+    async def test_category_prompt_opens_selection_and_confirms_public_action(self):
+        categories = (
+            types.SimpleNamespace(category_id=1, name="rendering"),
+            types.SimpleNamespace(category_id=2, name="mixins"),
+        )
+        actor = self.actor()
+        category_calls = []
+        action_calls = []
+
+        async def get_categories(guild_id):
+            category_calls.append(guild_id)
+            return categories
+
+        async def add_categories(public_token, category_ids, selected_actor):
+            action_calls.append((public_token, category_ids, selected_actor))
+            return types.SimpleNamespace(success=True, response=None)
+
+        prompt = ticket_views.GitHubCategoryPrompt(
+            10,
+            "opaque-ticket-token",
+            actor_factory=lambda _interaction: actor,
+            get_categories=get_categories,
+            add_categories=add_categories,
+        )
+        open_interaction = FakeInteraction()
+
+        await prompt.children[0].callback(open_interaction)
+
+        self.assertEqual(
+            (
+                prompt.children[0].label,
+                prompt.children[0].custom_id,
+            ),
+            (
+                ticket_views.presentation.ADD_CATEGORIES,
+                "githubtickets:opaque-ticket-token:add_categories",
+            ),
+        )
+        selection = open_interaction.response.message_kwargs[0]["view"]
+        selection.categories.values = ["2"]
+        confirm_interaction = FakeInteraction()
+
+        await selection.children[1].callback(confirm_interaction)
+
+        self.assertEqual(category_calls, [10, 10])
+        self.assertEqual(
+            action_calls,
+            [("opaque-ticket-token", (2,), actor)],
+        )
+        confirm_interaction.edit_original_response.assert_awaited_once_with(
+            content=ticket_views.presentation.CATEGORIES_ADDED,
+            view=None,
+        )
+
+    async def test_category_prompt_rejects_non_participant_before_catalog_lookup(self):
+        get_categories = mock.AsyncMock()
+        prompt = ticket_views.GitHubCategoryPrompt(
+            10,
+            "opaque-ticket-token",
+            actor_factory=lambda _interaction: self.actor(participant=False),
+            get_categories=get_categories,
+            add_categories=mock.AsyncMock(),
+        )
+        interaction = FakeInteraction()
+
+        await prompt.children[0].callback(interaction)
+
+        self.assertEqual(
+            interaction.response.messages,
+            [(ticket_views.presentation.CANNOT_USE_ACTION, True)],
+        )
+        get_categories.assert_not_awaited()
+
+    async def test_draft_keep_retains_only_remove_and_remove_defers_cleanup(self):
+        actor = self.actor(participant=False, staff=True)
+        calls = []
+
+        async def keep_ticket(public_token, selected_actor):
+            calls.append(("keep", public_token, selected_actor))
+            return types.SimpleNamespace(success=True, response=None)
+
+        async def remove_ticket(public_token, selected_actor):
+            calls.append(("remove", public_token, selected_actor))
+            return types.SimpleNamespace(success=True, response=None)
+
+        view = ticket_views.DraftTicketControls(
+            "opaque-ticket-token",
+            actor_factory=lambda _interaction: actor,
+            keep_ticket=keep_ticket,
+            remove_ticket=remove_ticket,
+        )
+        self.assertEqual(
+            [(button.label, button.custom_id) for button in view.children],
+            [
+                (
+                    ticket_views.presentation.KEEP_TICKET,
+                    "githubtickets:opaque-ticket-token:keep_draft_ticket",
+                ),
+                (
+                    ticket_views.presentation.REMOVE_TICKET,
+                    "githubtickets:opaque-ticket-token:remove_draft_ticket",
+                ),
+            ],
+        )
+        keep_interaction = FakeInteraction()
+
+        await view.children[0].callback(keep_interaction)
+
+        retained = keep_interaction.response.edit_calls[0]["view"]
+        self.assertEqual(
+            [(button.label, button.custom_id) for button in retained.children],
+            [
+                (
+                    ticket_views.presentation.REMOVE_TICKET,
+                    "githubtickets:opaque-ticket-token:remove_draft_ticket",
+                )
+            ],
+        )
+        remove_interaction = FakeInteraction()
+        await retained.children[0].callback(remove_interaction)
+
+        self.assertEqual(
+            calls,
+            [
+                ("keep", "opaque-ticket-token", actor),
+                ("remove", "opaque-ticket-token", actor),
+            ],
+        )
+        self.assertEqual(remove_interaction.response.defer_calls, 1)
diff --git a/tests/test_github_webhook_receiver.py b/tests/test_github_webhook_receiver.py
new file mode 100644
index 0000000..4747c05
--- /dev/null
+++ b/tests/test_github_webhook_receiver.py
@@ -0,0 +1,423 @@
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import socket
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from unittest.mock import AsyncMock
+
+import aiohttp
+from aiohttp.test_utils import TestClient, TestServer
+
+from tests.githubtickets_loader import isolated_githubtickets_modules
+
+
+class GitHubWebhookReceiverTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self) -> None:
+        self.data_dir = TemporaryDirectory()
+        self.modules = isolated_githubtickets_modules(Path(self.data_dir.name))
+        self.loaded = self.modules.__enter__()
+
+    async def asyncSetUp(self) -> None:
+        self.store = self.loaded.store.GitHubTicketsStore(
+            Path(self.data_dir.name) / "githubtickets.sqlite"
+        )
+        await self.store.initialize()
+        self.credentials = self.loaded.github_app.GitHubAppCredentials(
+            organization="GTNewHorizons",
+            client_id="Iv1.client",
+            app_id=123,
+            installation_id=456,
+            private_key=b"private-key",
+            webhook_secret=b"webhook-secret",
+        )
+        self.receiver = self.loaded.webhook.GitHubWebhookReceiver(
+            self.store,
+            self.credentials,
+        )
+        self.client = TestClient(TestServer(self.receiver.application))
+        await self.client.start_server()
+
+    async def asyncTearDown(self) -> None:
+        await self.client.close()
+
+    def tearDown(self) -> None:
+        self.modules.__exit__(None, None, None)
+        self.data_dir.cleanup()
+
+    @staticmethod
+    def payload() -> dict[str, object]:
+        return {
+            "action": "labeled",
+            "installation": {"id": 456},
+            "organization": {"login": "GTNewHorizons"},
+            "repository": {
+                "id": 9001,
+                "full_name": "GTNewHorizons/Example",
+            },
+            "pull_request": {"number": 42},
+        }
+
+    def signed_headers(
+        self,
+        body: bytes,
+        *,
+        delivery: str = "delivery-guid",
+        event: str = "pull_request",
+    ) -> dict[str, str]:
+        signature = "sha256=" + hmac.new(
+            self.credentials.webhook_secret,
+            body,
+            hashlib.sha256,
+        ).hexdigest()
+        return {
+            "Content-Type": "application/json",
+            "X-GitHub-Delivery": delivery,
+            "X-GitHub-Event": event,
+            "X-Hub-Signature-256": signature,
+        }
+
+    async def test_valid_delivery_is_durable_before_success_response(self) -> None:
+        body = json.dumps(self.payload(), separators=(",", ":")).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body),
+        )
+
+        self.assertEqual(response.status, 202)
+        delivery = await self.store.get_delivery("delivery-guid")
+        self.assertIsNotNone(delivery)
+        assert delivery is not None
+        self.assertEqual(delivery.event, "pull_request")
+        self.assertEqual(delivery.action, "labeled")
+        self.assertEqual(delivery.installation_id, 456)
+        self.assertEqual(delivery.repository_id, 9001)
+        self.assertEqual(delivery.pr_number, 42)
+        self.assertEqual(delivery.raw_body, body)
+
+    async def test_documented_ping_without_installation_is_accepted(self) -> None:
+        body = json.dumps(
+            {
+                "hook": {"type": "App"},
+                "organization": {"login": "GTNewHorizons"},
+                "repository": {
+                    "id": 9001,
+                    "full_name": "GTNewHorizons/Example",
+                },
+                "sender": {"login": "octocat"},
+                "zen": "Keep it logically awesome",
+            },
+            separators=(",", ":"),
+        ).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body, event="ping"),
+        )
+
+        self.assertEqual(response.status, 202)
+        delivery = await self.store.get_delivery("delivery-guid")
+        self.assertIsNotNone(delivery)
+        assert delivery is not None
+        self.assertEqual(delivery.event, "ping")
+        self.assertEqual(delivery.installation_id, 456)
+        self.assertIsNone(delivery.repository_id)
+        self.assertIsNone(delivery.pr_number)
+
+    async def test_non_pull_request_event_is_accepted_without_pr_target(self) -> None:
+        payload = self.payload()
+        del payload["pull_request"]
+        payload["action"] = "created"
+        body = json.dumps(payload, separators=(",", ":")).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body, event="check_run"),
+        )
+
+        self.assertEqual(response.status, 202)
+        delivery = await self.store.get_delivery("delivery-guid")
+        self.assertIsNotNone(delivery)
+        assert delivery is not None
+        self.assertEqual(delivery.event, "check_run")
+        self.assertIsNone(delivery.repository_id)
+        self.assertIsNone(delivery.pr_number)
+
+    async def test_app_lifecycle_delivery_is_durable_before_acknowledgement(self) -> None:
+        body = json.dumps(
+            {
+                "action": "removed",
+                "installation": {"id": 456},
+                "organization": {"login": "GTNewHorizons"},
+                "repositories_removed": [
+                    {"id": 9001, "full_name": "GTNewHorizons/Example"}
+                ],
+            },
+            separators=(",", ":"),
+        ).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(
+                body,
+                delivery="installation-repositories-removed",
+                event="installation_repositories",
+            ),
+        )
+
+        self.assertEqual(response.status, 202)
+        delivery = await self.store.get_delivery("installation-repositories-removed")
+        self.assertIsNotNone(delivery)
+        assert delivery is not None
+        self.assertEqual(delivery.event, "installation_repositories")
+        self.assertEqual(delivery.action, "removed")
+        self.assertEqual(delivery.raw_body, body)
+
+    async def test_invalid_requests_are_rejected_without_persistence(self) -> None:
+        cases: list[tuple[str, bytes, dict[str, str], int]] = []
+
+        valid_body = json.dumps(self.payload(), separators=(",", ":")).encode()
+        invalid_signature = self.signed_headers(valid_body)
+        invalid_signature["X-Hub-Signature-256"] = "sha256=invalid"
+        cases.append(("signature", valid_body, invalid_signature, 401))
+
+        malformed_body = b"not-json"
+        cases.append(
+            ("payload", malformed_body, self.signed_headers(malformed_body), 400)
+        )
+
+        wrong_installation = self.payload()
+        wrong_installation["installation"] = {"id": 999}
+        wrong_installation_body = json.dumps(
+            wrong_installation, separators=(",", ":")
+        ).encode()
+        cases.append(
+            (
+                "installation",
+                wrong_installation_body,
+                self.signed_headers(wrong_installation_body),
+                403,
+            )
+        )
+
+        wrong_organization = self.payload()
+        wrong_organization["organization"] = {"login": "SomeoneElse"}
+        wrong_organization_body = json.dumps(
+            wrong_organization, separators=(",", ":")
+        ).encode()
+        cases.append(
+            (
+                "organization",
+                wrong_organization_body,
+                self.signed_headers(wrong_organization_body),
+                403,
+            )
+        )
+
+        missing_event_headers = self.signed_headers(valid_body)
+        del missing_event_headers["X-GitHub-Event"]
+        cases.append(("event", valid_body, missing_event_headers, 400))
+
+        for name, body, headers, status in cases:
+            with self.subTest(name=name):
+                response = await self.client.post(
+                    self.loaded.webhook.WEBHOOK_PATH,
+                    data=body,
+                    headers=headers,
+                )
+                self.assertEqual(response.status, status)
+
+        self.assertIsNone(await self.store.get_delivery("delivery-guid"))
+
+    async def test_signature_covers_the_exact_raw_json_bytes(self) -> None:
+        compact_body = json.dumps(self.payload(), separators=(",", ":")).encode()
+        formatted_body = json.dumps(self.payload(), indent=2).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=formatted_body,
+            headers=self.signed_headers(compact_body),
+        )
+
+        self.assertEqual(response.status, 401)
+        self.assertIsNone(await self.store.get_delivery("delivery-guid"))
+
+    async def test_only_the_fixed_post_route_accepts_webhooks(self) -> None:
+        get_response = await self.client.get(self.loaded.webhook.WEBHOOK_PATH)
+        wrong_route_response = await self.client.post("/other")
+
+        self.assertEqual(get_response.status, 405)
+        self.assertEqual(wrong_route_response.status, 404)
+
+    async def test_pull_request_delivery_requires_repository_and_pr_identity(self) -> None:
+        payload = self.payload()
+        del payload["repository"]
+        body = json.dumps(payload, separators=(",", ":")).encode()
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body),
+        )
+
+        self.assertEqual(response.status, 400)
+        self.assertIsNone(await self.store.get_delivery("delivery-guid"))
+
+    async def test_duplicate_delivery_is_acknowledged_without_replacing_payload(self) -> None:
+        first_body = json.dumps(self.payload(), separators=(",", ":")).encode()
+        first_response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=first_body,
+            headers=self.signed_headers(first_body),
+        )
+
+        duplicate_payload = self.payload()
+        duplicate_payload["action"] = "edited"
+        duplicate_body = json.dumps(
+            duplicate_payload, separators=(",", ":")
+        ).encode()
+        duplicate_response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=duplicate_body,
+            headers=self.signed_headers(duplicate_body),
+        )
+
+        self.assertEqual(first_response.status, 202)
+        self.assertEqual(duplicate_response.status, 202)
+        delivery = await self.store.get_delivery("delivery-guid")
+        self.assertIsNotNone(delivery)
+        assert delivery is not None
+        self.assertEqual(delivery.action, "labeled")
+        self.assertEqual(delivery.raw_body, first_body)
+
+    async def test_prepared_failed_delivery_accepts_verified_same_guid_redelivery(
+        self,
+    ) -> None:
+        first_body = json.dumps(self.payload(), separators=(",", ":")).encode()
+        first_response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=first_body,
+            headers=self.signed_headers(first_body),
+        )
+        self.assertEqual(first_response.status, 202)
+        claimed = await self.store.claim_next_delivery(
+            now=datetime.now(timezone.utc),
+            stale_before=datetime(2000, 1, 1, tzinfo=timezone.utc),
+        )
+        self.assertIsNotNone(claimed)
+        assert claimed is not None
+        self.assertTrue(
+            await self.store.fail_delivery(
+                claimed.delivery_guid,
+                completed_at=datetime.now(timezone.utc),
+                error_summary="terminal delivery failure",
+            )
+        )
+
+        duplicate_body = json.dumps(self.payload(), indent=2).encode()
+        duplicate_response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=duplicate_body,
+            headers=self.signed_headers(duplicate_body),
+        )
+        self.assertEqual(duplicate_response.status, 202)
+        unchanged = await self.store.get_delivery("delivery-guid")
+        self.assertEqual(unchanged.state, self.loaded.models.GitHubDeliveryState.FAILED)
+        self.assertEqual(unchanged.raw_body, first_body)
+
+        now = datetime.now(timezone.utc)
+        self.assertTrue(
+            await self.store.prepare_delivery_redelivery(
+                "delivery-guid",
+                github_delivery_id=765,
+                now=now,
+                next_attempt_at=now + timedelta(minutes=1),
+            )
+        )
+        awaiting = await self.store.get_delivery("delivery-guid")
+        self.assertEqual(awaiting.state.value, "awaiting_redelivery")
+        self.assertEqual(awaiting.raw_body, first_body)
+        redelivery_response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=duplicate_body,
+            headers=self.signed_headers(duplicate_body),
+        )
+
+        self.assertEqual(redelivery_response.status, 202)
+        reopened = await self.store.get_delivery("delivery-guid")
+        self.assertEqual(reopened.state, self.loaded.models.GitHubDeliveryState.PENDING)
+        self.assertEqual(reopened.github_delivery_id, 765)
+        self.assertEqual(reopened.attempts, 0)
+        self.assertEqual(reopened.raw_body, duplicate_body)
+        self.assertIsNone(reopened.error_summary)
+
+    async def test_store_failure_is_not_acknowledged(self) -> None:
+        body = json.dumps(self.payload(), separators=(",", ":")).encode()
+        self.store.accept_delivery = AsyncMock(side_effect=OSError("database unavailable"))
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body),
+        )
+
+        self.assertEqual(response.status, 503)
+
+    async def test_body_larger_than_limit_is_rejected(self) -> None:
+        body = b"x" * (2 * 1024 * 1024)
+
+        response = await self.client.post(
+            self.loaded.webhook.WEBHOOK_PATH,
+            data=body,
+            headers=self.signed_headers(body),
+        )
+
+        self.assertEqual(response.status, 413)
+
+    async def test_receiver_start_and_close_control_network_acceptance(self) -> None:
+        with socket.socket() as reserved:
+            reserved.bind(("127.0.0.1", 0))
+            port = reserved.getsockname()[1]
+
+        receiver = self.loaded.webhook.GitHubWebhookReceiver(
+            self.store,
+            self.credentials,
+        )
+        started_port = await receiver.start("127.0.0.1", port)
+        self.assertEqual(started_port, port)
+
+        async with aiohttp.ClientSession() as session:
+            response = await session.post(
+                f"http://127.0.0.1:{port}{self.loaded.webhook.WEBHOOK_PATH}"
+            )
+            self.assertEqual(response.status, 401)
+
+            await receiver.close()
+            with self.assertRaises(aiohttp.ClientConnectionError):
+                await session.post(
+                    f"http://127.0.0.1:{port}{self.loaded.webhook.WEBHOOK_PATH}"
+                )
+
+    async def test_bind_failure_cleans_up_for_a_later_start(self) -> None:
+        receiver = self.loaded.webhook.GitHubWebhookReceiver(
+            self.store,
+            self.credentials,
+        )
+        with socket.socket() as reserved:
+            reserved.bind(("127.0.0.1", 0))
+            reserved.listen()
+            port = reserved.getsockname()[1]
+            with self.assertRaises(OSError):
+                await receiver.start("127.0.0.1", port)
+
+        self.assertEqual(await receiver.start("127.0.0.1", port), port)
+        await receiver.close()
diff --git a/tests/test_joinwatch_retry.py b/tests/test_joinwatch_retry.py
index a605f67..4abf2e0 100644
--- a/tests/test_joinwatch_retry.py
+++ b/tests/test_joinwatch_retry.py
@@ -441,6 +441,7 @@ async def test_assignment_and_role_retries_are_scheduled_one_minute_later(self):
                     joinwatch_pending_roles=lambda: self._Store(roles),
                 )
                 cog.config = SimpleNamespace(guild=lambda _guild: guild_config)
+                cog._record_operational_failure = mock.AsyncMock()
                 honeypot.joinwatch.joinwatch_publication.publish_joinwatch_incident = mock.AsyncMock()
                 now = datetime(2026, 7, 15, 12, tzinfo=timezone.utc)
 
@@ -467,11 +468,11 @@ async def test_assignment_and_role_retries_are_scheduled_one_minute_later(self):
                     datetime.fromisoformat(roles["200"]["expires_at"]),
                     now + timedelta(minutes=1),
                 )
-                failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures, guild.id
-                )
                 self.assertEqual(
-                    {failure.source for failure in failures},
+                    {
+                        call.args[1]
+                        for call in cog._record_operational_failure.await_args_list
+                    },
                     {"joinwatch_role_assignment", "joinwatch_role_action"},
                 )
 
@@ -487,6 +488,7 @@ async def test_fifth_retry_is_the_last_and_a_sixth_is_not_scheduled(self):
                     joinwatch_pending_role_assignments=lambda: self._Store(assignments),
                 )
                 cog.config = SimpleNamespace(guild=lambda _guild: guild_config)
+                cog._record_operational_failure = mock.AsyncMock()
                 honeypot.joinwatch.joinwatch_publication.publish_joinwatch_incident = mock.AsyncMock()
 
                 scheduled = await honeypot.joinwatch._reschedule_joinwatch_assignment_retry(
@@ -500,8 +502,7 @@ async def test_fifth_retry_is_the_last_and_a_sixth_is_not_scheduled(self):
 
                 self.assertFalse(scheduled)
                 self.assertNotIn("200", assignments)
-                failures = await asyncio.to_thread(
-                    cog._case_store.list_operational_failures, guild.id
-                )
-                self.assertEqual(len(failures), 1)
-                self.assertEqual(failures[0].source, "joinwatch_role_assignment")
+                cog._record_operational_failure.assert_awaited_once()
+                failure = cog._record_operational_failure.await_args
+                self.assertEqual(failure.args[1], "joinwatch_role_assignment")
+                self.assertIs(failure.kwargs["terminal"], True)
diff --git a/tests/test_nhcogs_suite.py b/tests/test_nhcogs_suite.py
index e3be292..6c64b85 100644
--- a/tests/test_nhcogs_suite.py
+++ b/tests/test_nhcogs_suite.py
@@ -37,6 +37,14 @@ def __init__(self, bot):
         _record_construction(bot, self.qualified_name)
 
 
+class StubOperationalErrors(StubLifecycle):
+    qualified_name = "OperationalErrors"
+
+    def __init__(self, bot):
+        self.bot = bot
+        _record_construction(bot, self.qualified_name)
+
+
 class StubNHMisc(StubLifecycle):
     qualified_name = "NHMisc"
     CONFIG_IDENTIFIER = 8597423150612235807
@@ -95,7 +103,7 @@ def __init__(self, bot):
 
 
 @contextmanager
-def load_suite_module():
+def load_suite_module():  # noqa: PLR0915
     names = (
         "redbot",
         "redbot.core",
@@ -103,6 +111,7 @@ def load_suite_module():
         "redbot.core.utils",
         "NHCogs",
         "NHCogs.consoledump",
+        "NHCogs.operationalerrors",
         "NHCogs.nhmisc",
         "NHCogs.honeypot",
         "NHCogs.cleanup",
@@ -119,6 +128,8 @@ def load_suite_module():
     redbot_utils.get_end_user_data_statement = lambda **_kwargs: "data statement"
     console_dump = types.ModuleType("NHCogs.consoledump")
     console_dump.ConsoleDump = StubConsoleDump
+    operational_errors = types.ModuleType("NHCogs.operationalerrors")
+    operational_errors.OperationalErrors = StubOperationalErrors
     nhmisc = types.ModuleType("NHCogs.nhmisc")
     nhmisc.NHMisc = StubNHMisc
     honeypot = types.ModuleType("NHCogs.honeypot")
@@ -171,6 +182,7 @@ def assert_safe_to_replace(bot):
                 "redbot.core.utils": redbot_utils,
                 "NHCogs": module,
                 "NHCogs.consoledump": console_dump,
+                "NHCogs.operationalerrors": operational_errors,
                 "NHCogs.nhmisc": nhmisc,
                 "NHCogs.honeypot": honeypot,
                 "NHCogs.cleanup": cleanup,
@@ -238,6 +250,7 @@ async def test_setup_registers_the_complete_nhcogs_suite(self):
             bot.added,
             [
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "Cleanup",
@@ -250,6 +263,7 @@ async def test_setup_registers_the_complete_nhcogs_suite(self):
             set(bot.cogs),
             {
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "Cleanup",
@@ -274,6 +288,7 @@ async def test_custom_commands_conflict_does_not_block_other_subcogs(self):
             set(bot.cogs),
             {
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "Cleanup",
@@ -297,6 +312,7 @@ async def test_cleanup_conflict_does_not_block_other_subcogs(self):
             set(bot.cogs),
             {
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "GitHubTickets",
@@ -311,6 +327,8 @@ async def test_each_subcog_add_failure_is_isolated_and_logged(self):
         failures = (
             ("ConsoleDump", "before"),
             ("ConsoleDump", "after"),
+            ("OperationalErrors", "before"),
+            ("OperationalErrors", "after"),
             ("NHMisc", "before"),
             ("NHMisc", "after"),
             ("Honeypot", "before"),
@@ -337,6 +355,7 @@ async def test_each_subcog_add_failure_is_isolated_and_logged(self):
                 if failure[0] != "CustomCommandsMigration":
                     for name in (
                         "ConsoleDump",
+                        "OperationalErrors",
                         "NHMisc",
                         "Honeypot",
                         "Cleanup",
@@ -356,6 +375,7 @@ async def test_each_subcog_add_failure_is_isolated_and_logged(self):
     async def test_each_subcog_construction_failure_is_isolated_and_logged(self):
         for name in (
             "ConsoleDump",
+            "OperationalErrors",
             "NHMisc",
             "Honeypot",
             "Cleanup",
@@ -372,6 +392,7 @@ async def test_each_subcog_construction_failure_is_isolated_and_logged(self):
                 self.assertNotIn(name, bot.cogs)
                 for other in (
                     "ConsoleDump",
+                    "OperationalErrors",
                     "NHMisc",
                     "Honeypot",
                     "Cleanup",
@@ -390,6 +411,7 @@ async def test_each_subcog_construction_failure_is_isolated_and_logged(self):
     async def test_each_subcog_cog_load_failure_is_cleaned_up_and_isolated(self):
         for name in (
             "ConsoleDump",
+            "OperationalErrors",
             "NHMisc",
             "Honeypot",
             "Cleanup",
@@ -408,6 +430,7 @@ async def test_each_subcog_cog_load_failure_is_cleaned_up_and_isolated(self):
                 self.assertIn(f"failed loading {name}", "\n".join(captured.output))
                 for other in (
                     "ConsoleDump",
+                    "OperationalErrors",
                     "NHMisc",
                     "Honeypot",
                     "Cleanup",
@@ -427,8 +450,14 @@ async def test_setup_cancellation_cleans_loaded_and_partial_cogs_then_reraises(s
                 await suite.setup(bot)
 
         self.assertEqual(bot.cogs, {})
-        self.assertEqual(bot.removed, ["NHMisc", "ConsoleDump"])
-        self.assertEqual(bot.unloaded, ["Honeypot", "NHMisc", "ConsoleDump"])
+        self.assertEqual(
+            bot.removed,
+            ["NHMisc", "OperationalErrors", "ConsoleDump"],
+        )
+        self.assertEqual(
+            bot.unloaded,
+            ["Honeypot", "NHMisc", "OperationalErrors", "ConsoleDump"],
+        )
 
     async def test_framework_cleanup_is_not_repeated_by_supervisor(self):
         with load_suite_module() as suite:
@@ -459,6 +488,7 @@ def import_with_githubtickets_failure(name, package=None):
             set(bot.cogs),
             {
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "Cleanup",
@@ -484,6 +514,7 @@ async def test_existing_cog_conflict_does_not_block_other_subcogs(self):
             set(bot.cogs),
             {
                 "ConsoleDump",
+                "OperationalErrors",
                 "NHMisc",
                 "Honeypot",
                 "Cleanup",
@@ -501,7 +532,7 @@ def test_combined_metadata_preserves_both_data_contracts(self):
         self.assertEqual(metadata["name"], "NHCogs")
         self.assertEqual(
             metadata["description"],
-            "Loads ConsoleDump, NHMisc, Honeypot, Cleanup, GitHubTickets, NHModeration, and Custom Commands together "
+            "Loads ConsoleDump, OperationalErrors, NHMisc, Honeypot, Cleanup, GitHubTickets, NHModeration, and Custom Commands together "
             "while preserving their separate commands, configuration, and stored data",
         )
         self.assertEqual(metadata["min_bot_version"], "3.5.23")
@@ -520,8 +551,31 @@ def test_combined_metadata_preserves_both_data_contracts(self):
         self.assertIn("moderation case metadata", statement)
         self.assertIn("Custom Commands stores guild IDs", statement)
         self.assertIn("Operational error records store the guild", statement)
-        self.assertIn("GitHubTickets stores guild and user IDs", statement)
+        self.assertIn("GitHubTickets stores Discord guild and user IDs", statement)
         self.assertIn("NHModeration stores source observations", statement)
+        github_metadata = json.loads(
+            (PACKAGE_PATH / "githubtickets" / "info.json").read_text("utf-8")
+        )
+        for data_statement in (
+            statement,
+            github_metadata["end_user_data_statement"],
+        ):
+            self.assertIn(
+                "terminal failures, may retain raw request bodies until the three-day",
+                data_statement,
+            )
+            self.assertIn(
+                "Red user-data deletion removes or redacts matching Discord-user profile and ticket data",
+                data_statement,
+            )
+            self.assertIn(
+                "does not delete GitHub delivery identities or pull request rows that remain unbound",
+                data_statement,
+            )
+            self.assertNotIn(
+                "then cleared after successful or terminal processing",
+                data_statement,
+            )
 
     async def test_teardown_removes_late_registered_replacement_cog(self):
         with load_suite_module() as suite:
diff --git a/tests/test_nhmoderation_cog.py b/tests/test_nhmoderation_cog.py
index e1eb295..d46aa4c 100644
--- a/tests/test_nhmoderation_cog.py
+++ b/tests/test_nhmoderation_cog.py
@@ -316,7 +316,6 @@ async def test_message_filter_cache_is_restored_during_cog_load(self):
                 value=["first phrase", "second phrase"],
             )
             subject.history.initialize = mock.AsyncMock()
-            subject._operational_errors.initialize = mock.AsyncMock()
             subject._weekly_scheduler = mock.AsyncMock()
             subject._startup_catchup = mock.AsyncMock()
 
@@ -728,12 +727,17 @@ class UserFeedbackCheckFailure(CheckFailure):
     async def test_operational_error_is_written_to_python_logger(self):
         with loaded_nhmoderation() as module:
             subject = object.__new__(module.NHModeration)
-            subject._operational_errors = SimpleNamespace(
-                report=mock.AsyncMock(return_value=object())
-            )
+            subject.bot = object()
             error = RuntimeError("sync failed")
 
-            with mock.patch.object(module.log, "error") as logger:
+            with (
+                mock.patch.object(module.log, "error") as logger,
+                mock.patch.object(
+                    module,
+                    "report_operational_error",
+                    new=mock.AsyncMock(return_value=object()),
+                ) as report,
+            ):
                 result = await module.NHModeration.report_operational_error(
                     subject,
                     guild_id=10,
@@ -742,6 +746,15 @@ async def test_operational_error_is_written_to_python_logger(self):
                 )
 
             self.assertIsNotNone(result)
+            report.assert_awaited_once_with(
+                subject.bot,
+                guild_id=10,
+                source="NHModeration",
+                action="weekly reconciliation",
+                error=error,
+                channel_id=None,
+                message_id=None,
+            )
             logger.assert_called_once()
             self.assertEqual(logger.call_args.kwargs["exc_info"][1], error)
 
@@ -759,13 +772,15 @@ async def test_successful_startup_sync_marks_prior_failures_recovered(self):
                 )
             )
             subject._run_sync = mock.AsyncMock()
-            subject._operational_errors = SimpleNamespace(
-                mark_action_recovered=mock.AsyncMock(return_value=1)
-            )
-
-            await module.NHModeration._startup_catchup(subject)
+            with mock.patch.object(
+                module,
+                "mark_operational_error_recovered",
+                new=mock.AsyncMock(return_value=1),
+            ) as recovered:
+                await module.NHModeration._startup_catchup(subject)
 
-            subject._operational_errors.mark_action_recovered.assert_awaited_once_with(
+            recovered.assert_awaited_once_with(
+                subject.bot,
                 guild_id=10,
                 source="NHModeration",
                 action="startup sync",
@@ -782,12 +797,16 @@ async def test_ready_event_runs_debounced_incremental_catchup(self):
                 )
             )
             subject._run_sync = mock.AsyncMock()
-            subject._operational_errors = SimpleNamespace(
-                mark_action_recovered=mock.AsyncMock(return_value=0)
-            )
             subject._gateway_catchup_task = None
 
-            with mock.patch.object(module.asyncio, "sleep", new=mock.AsyncMock()):
+            with (
+                mock.patch.object(module.asyncio, "sleep", new=mock.AsyncMock()),
+                mock.patch.object(
+                    module,
+                    "mark_operational_error_recovered",
+                    new=mock.AsyncMock(return_value=0),
+                ) as recovered,
+            ):
                 await module.NHModeration.on_ready(subject)
                 await subject._gateway_catchup_task
 
@@ -795,7 +814,8 @@ async def test_ready_event_runs_debounced_incremental_catchup(self):
                 guild,
                 module.SyncMode.INCREMENTAL,
             )
-            subject._operational_errors.mark_action_recovered.assert_awaited_once_with(
+            recovered.assert_awaited_once_with(
+                subject.bot,
                 guild_id=10,
                 source="NHModeration",
                 action="gateway catch-up",
diff --git a/tests/test_operational_errors.py b/tests/test_operational_errors.py
index 19bb333..b002dc4 100644
--- a/tests/test_operational_errors.py
+++ b/tests/test_operational_errors.py
@@ -1,144 +1,300 @@
-import importlib.util
-import logging
+import importlib
+import inspect
 import sys
 import types
 import unittest
+from contextlib import contextmanager
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from types import SimpleNamespace
 from unittest import mock
 
-from tests.test_chatchart import nhmisc
+PACKAGE_ROOT = Path(__file__).parents[1] / "NHCogs"
+ROOT_PACKAGE = "operational_errors_test_root"
+SUBJECT_PACKAGE = f"{ROOT_PACKAGE}.operationalerrors"
+_MISSING = object()
+
+
+class _FakeCommand:
+    def __init__(self, callback, *, kind="command", parent=None, **attrs):
+        self.callback = callback
+        self.kind = kind
+        self.parent = parent
+        self.name = attrs.get("name", callback.__name__)
+        self.aliases = attrs.get("aliases", [])
+        self.invoke_without_command = attrs.get("invoke_without_command", False)
+        self.commands = []
+        if parent is not None:
+            parent.commands.append(self)
+
+    @property
+    def qualified_name(self):
+        if self.parent is None:
+            return self.name
+        return f"{self.parent.qualified_name} {self.name}"
+
+    @property
+    def short_doc(self):
+        lines = (self.callback.__doc__ or "").strip().splitlines()
+        return lines[0] if lines else ""
+
+    @property
+    def signature(self):
+        parameters = list(inspect.signature(self.callback).parameters.values())[2:]
+        return " ".join(
+            f"<{parameter.name}>"
+            if parameter.default is inspect.Parameter.empty
+            else f"[{parameter.name}]"
+            for parameter in parameters
+        )
 
-MODULE_PATH = (
-    Path(__file__).parents[1] / "NHCogs" / "operational_errors.py"
-)
+    def command(self, **attrs):
+        return lambda callback: _FakeCommand(callback, parent=self, **attrs)
 
+    def group(self, **attrs):
+        return lambda callback: _FakeCommand(
+            callback,
+            kind="group",
+            parent=self,
+            **attrs,
+        )
 
-def load_operational_errors_module():
-    module_name = "test_operational_errors_subject"
-    discord = types.ModuleType("discord")
 
-    class AllowedMentions:
-        def __init__(self, **values):
-            self.__dict__.update(values)
+def _tag(name, value=True):
+    def decorator(target):
+        callback = target.callback if isinstance(target, _FakeCommand) else target
+        setattr(callback, name, value)
+        return target
 
-    class File:
-        def __init__(self, fp, *, filename):
-            self.fp = fp
-            self.filename = filename
-
-    discord.AllowedMentions = AllowedMentions
-    discord.File = File
-    discord.Object = lambda *, id: SimpleNamespace(id=id)
-    spec = importlib.util.spec_from_file_location(module_name, MODULE_PATH)
-    assert spec is not None
-    assert spec.loader is not None
-    module = importlib.util.module_from_spec(spec)
-    old_discord = sys.modules.get("discord")
-    sys.modules[module_name] = module
-    sys.modules["discord"] = discord
-    try:
-        spec.loader.exec_module(module)
-    finally:
-        if old_discord is None:
-            sys.modules.pop("discord", None)
-        else:
-            sys.modules["discord"] = old_discord
-    return module
+    return decorator
 
 
-operational_errors = load_operational_errors_module()
+class _FakeCog:
+    @staticmethod
+    def listener(event_name=None):
+        return _tag("listener_event", event_name)
 
 
 class _Setting:
-    def __init__(self, value):
+    def __init__(self, value=None):
         self.value = value
+        self.read_count = 0
+        self.set_count = 0
 
     def __call__(self):
         async def read():
+            self.read_count += 1
             return self.value
 
         return read()
 
+    async def set(self, value):
+        self.set_count += 1
+        self.value = value
+
+    async def clear(self):
+        self.value = None
 
-class _Config:
-    def __init__(self, *, channel_id, maintainer_id):
-        self._guild = SimpleNamespace(
-            error_channel=_Setting(channel_id),
-            error_maintainer_id=_Setting(maintainer_id),
-        )
 
-    def guild_from_id(self, _guild_id):
-        return self._guild
+class _FakeConfig:
+    last = None
+
+    def __init__(self):
+        self.error_channel = _Setting()
+        self.error_maintainer_id = _Setting()
+        self.registered = None
+
+    @classmethod
+    def get_conf(cls, *_args, **_kwargs):
+        cls.last = cls()
+        return cls.last
+
+    def register_global(self, **values):
+        self.registered = values
+
+
+class _Embed:
+    def __init__(self, *, title=None, description=None):
+        self.title = title
+        self.description = description
+        self.fields = []
+
+    def add_field(self, *, name, value, inline):
+        self.fields.append(SimpleNamespace(name=name, value=value, inline=inline))
+
+
+class _AllowedMentions:
+    none_marker = object()
+
+    def __init__(self, **values):
+        self.__dict__.update(values)
+
+    @classmethod
+    def none(cls):
+        return cls.none_marker
+
+
+class _File:
+    def __init__(self, fp, *, filename):
+        self.data = fp.read()
+        self.filename = filename
 
 
 class _Channel:
-    def __init__(self, channel_id):
+    def __init__(self, channel_id, guild, *, public=False):
         self.id = channel_id
+        self.name = "operational-errors"
+        self.guild = guild
+        self.public = public
         self.send = mock.AsyncMock()
 
-    @staticmethod
-    def permissions_for(_role):
-        return SimpleNamespace(view_channel=False)
+    def permissions_for(self, target):
+        if target is self.guild.default_role:
+            return SimpleNamespace(view_channel=self.public)
+        return SimpleNamespace(
+            view_channel=True,
+            send_messages=True,
+            attach_files=True,
+        )
 
 
 class _Guild:
-    def __init__(self, channel, maintainer):
+    def __init__(self, guild_id=100):
+        self.id = guild_id
         self.default_role = object()
-        self._channel = channel
-        self._maintainer = maintainer
+        self.me = object()
+        self.channel = None
+        self.maintainer = SimpleNamespace(
+            id=300,
+            mention="<@300>",
+            display_name="maintainer",
+        )
 
     def get_channel(self, channel_id):
-        return self._channel if channel_id == self._channel.id else None
+        if self.channel is not None and channel_id == self.channel.id:
+            return self.channel
+        return None
 
     def get_member(self, member_id):
-        return self._maintainer if member_id == self._maintainer.id else None
+        return self.maintainer if member_id == self.maintainer.id else None
 
 
 class _Bot:
-    def __init__(self, guild_id, guild):
-        self._guild_id = guild_id
-        self._guild = guild
+    def __init__(self, guild):
+        self.guild = guild
+        self.cog = None
 
-    def get_guild(self, guild_id):
-        return self._guild if guild_id == self._guild_id else None
+    def get_channel(self, channel_id):
+        return self.guild.get_channel(channel_id)
 
+    def get_cog(self, name):
+        if name == "OperationalErrors":
+            return self.cog
+        return None
 
-class OperationalErrorCommandTests(unittest.TestCase):
-    def test_nhmisc_exposes_error_configuration_group(self):
-        self.assertTrue(hasattr(nhmisc.NHMisc, "nhmisc_errors"))
+
+@contextmanager
+def _isolated_operational_errors(data_path: Path):
+    discord = types.ModuleType("discord")
+    discord.AllowedMentions = _AllowedMentions
+    discord.Embed = _Embed
+    discord.File = _File
+    discord.Guild = _Guild
+    discord.Member = type("Member", (), {})
+    discord.Object = lambda *, id: SimpleNamespace(id=id)
+    discord.TextChannel = type("TextChannel", (), {})
+
+    commands = types.ModuleType("redbot.core.commands")
+    commands.Cog = _FakeCog
+    commands.Context = object
+    commands.Group = _FakeCommand
+    commands.UserFeedbackCheckFailure = type(
+        "UserFeedbackCheckFailure",
+        (Exception,),
+        {},
+    )
+    commands.group = lambda **attrs: lambda callback: _FakeCommand(
+        callback,
+        kind="group",
+        **attrs,
+    )
+    commands.guild_only = lambda: _tag("guild_only")
+    commands.has_permissions = lambda **permissions: _tag(
+        "required_permissions",
+        permissions,
+    )
+
+    redbot = types.ModuleType("redbot")
+    core = types.ModuleType("redbot.core")
+    core.Config = _FakeConfig
+    core.commands = commands
+    data_manager = types.ModuleType("redbot.core.data_manager")
+    data_manager.cog_data_path = lambda _cog: data_path
+
+    root = types.ModuleType(ROOT_PACKAGE)
+    root.__path__ = [str(PACKAGE_ROOT)]
+    names = (
+        "discord",
+        "redbot",
+        "redbot.core",
+        "redbot.core.commands",
+        "redbot.core.data_manager",
+        ROOT_PACKAGE,
+        f"{ROOT_PACKAGE}.command_overview",
+        SUBJECT_PACKAGE,
+        f"{SUBJECT_PACKAGE}.cog",
+    )
+    previous = {name: sys.modules.get(name, _MISSING) for name in names}
+    sys.modules.update(
+        {
+            "discord": discord,
+            "redbot": redbot,
+            "redbot.core": core,
+            "redbot.core.commands": commands,
+            "redbot.core.data_manager": data_manager,
+            ROOT_PACKAGE: root,
+        }
+    )
+    try:
+        yield importlib.import_module(SUBJECT_PACKAGE)
+    finally:
+        for name, old_module in previous.items():
+            if old_module is _MISSING:
+                sys.modules.pop(name, None)
+            else:
+                sys.modules[name] = old_module
+
+
+def _reporting_fixture(module):
+    guild = _Guild()
+    channel = _Channel(200, guild)
+    guild.channel = channel
+    bot = _Bot(guild)
+    cog = module.OperationalErrors(bot)
+    bot.cog = cog
+    cog.config.error_channel.value = channel.id
+    cog.config.error_maintainer_id.value = guild.maintainer.id
+    return cog, bot, guild, channel
 
 
 class OperationalErrorReporterTests(unittest.IsolatedAsyncioTestCase):
     async def test_report_persists_occurrences_and_alerts_each_time(self):
-        guild_id = 100
-        maintainer = SimpleNamespace(id=300, mention="<@300>")
-        channel = _Channel(200)
-        bot = _Bot(guild_id, _Guild(channel, maintainer))
-        config = _Config(channel_id=channel.id, maintainer_id=maintainer.id)
-
         with TemporaryDirectory() as directory:
-            reporter = operational_errors.OperationalErrorReporter(
-                bot,
-                config,
-                Path(directory) / "operational_errors.sqlite",
-                logger=logging.getLogger("test.operational-errors"),
-            )
-            await reporter.initialize()
-            try:
-                raise ValueError("Discord rejected the message")
-            except ValueError as error:
-                first = await reporter.report(
-                    guild_id=guild_id,
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, channel = _reporting_fixture(module)
+                await cog.cog_load()
+
+                error = ValueError("Discord rejected the message")
+                first = await cog.report(
+                    guild_id=guild.id,
                     source="CustomCommands",
                     action="send response",
                     error=error,
                     channel_id=400,
                     message_id=500,
                 )
-                second = await reporter.report(
-                    guild_id=guild_id,
+                second = await cog.report(
+                    guild_id=guild.id,
                     source="CustomCommands",
                     action="send response",
                     error=error,
@@ -146,142 +302,287 @@ async def test_report_persists_occurrences_and_alerts_each_time(self):
                     message_id=500,
                 )
 
-        self.assertIsNotNone(first)
-        self.assertEqual(first.occurrences, 1)
-        self.assertEqual(second.occurrences, 2)
-        self.assertEqual(first.fingerprint, second.fingerprint)
-        self.assertEqual(channel.send.await_count, 2)
+                self.assertEqual(first.occurrences, 1)
+                self.assertEqual(second.occurrences, 2)
+                self.assertEqual(first.fingerprint, second.fingerprint)
+                self.assertEqual(channel.send.await_count, 2)
 
-    async def test_recovery_closes_the_active_fingerprint(self):
-        guild_id = 100
-        maintainer = SimpleNamespace(id=300, mention="<@300>")
-        channel = _Channel(200)
+    async def test_correlation_key_groups_retries_and_recovers_only_matching_work(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, bot, guild, _channel = _reporting_fixture(module)
+                await cog.cog_load()
+
+                try:
+                    first = await module.report_operational_error(
+                        bot,
+                        guild_id=guild.id,
+                        source="Honeypot",
+                        action="role_apply",
+                        error=RuntimeError("first attempt"),
+                        correlation_key="operation-1",
+                    )
+                    retry = await module.report_operational_error(
+                        bot,
+                        guild_id=guild.id,
+                        source="Honeypot",
+                        action="role_apply",
+                        error=RuntimeError("different retry error"),
+                        correlation_key="operation-1",
+                    )
+                    unrelated = await module.report_operational_error(
+                        bot,
+                        guild_id=guild.id,
+                        source="Honeypot",
+                        action="role_apply",
+                        error=RuntimeError("other operation"),
+                        correlation_key="operation-2",
+                    )
+                except TypeError as error:
+                    self.fail(f"shared reporter rejected correlation_key: {error}")
+
+                self.assertEqual(first.fingerprint, retry.fingerprint)
+                self.assertEqual(retry.occurrences, 2)
+                self.assertNotEqual(first.fingerprint, unrelated.fingerprint)
+                try:
+                    recovered = await module.mark_operational_error_recovered(
+                        bot,
+                        guild_id=guild.id,
+                        source="Honeypot",
+                        action="role_apply",
+                        correlation_key="operation-1",
+                    )
+                except TypeError as error:
+                    self.fail(f"shared recovery rejected correlation_key: {error}")
+
+                self.assertEqual(recovered, 1)
+                self.assertEqual(await cog.active_count(guild.id), 1)
+
+    async def test_persistence_failure_still_attempts_the_alert(self):
         with TemporaryDirectory() as directory:
-            reporter = operational_errors.OperationalErrorReporter(
-                _Bot(guild_id, _Guild(channel, maintainer)),
-                _Config(channel_id=channel.id, maintainer_id=maintainer.id),
-                Path(directory) / "operational_errors.sqlite",
-                logger=logging.getLogger("test.operational-errors"),
-            )
-            await reporter.initialize()
-            failure = await reporter.report(
-                guild_id=guild_id,
-                source="NHMisc",
-                action="daily reconciliation",
-                error=RuntimeError("failed"),
-            )
-
-            self.assertEqual(await reporter.active_count(guild_id), 1)
-            self.assertTrue(
-                await reporter.mark_recovered(
-                    guild_id=guild_id,
-                    fingerprint=failure.fingerprint,
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, channel = _reporting_fixture(module)
+                cog._record_sync = mock.Mock(side_effect=RuntimeError("disk full"))
+
+                result = await cog.report(
+                    guild_id=guild.id,
+                    source="GitHubTickets",
+                    action="accept webhook",
+                    error=RuntimeError("delivery failed"),
                 )
-            )
-            self.assertEqual(await reporter.active_count(guild_id), 0)
 
-    async def test_action_recovery_closes_all_active_fingerprints(self):
-        guild_id = 100
-        channel = _Channel(200)
+                self.assertIsNone(result)
+                channel.send.assert_awaited_once()
+
+    async def test_shared_entry_point_never_raises_when_reporter_is_missing_or_broken(self):
         with TemporaryDirectory() as directory:
-            reporter = operational_errors.OperationalErrorReporter(
-                _Bot(guild_id, _Guild(channel, None)),
-                _Config(channel_id=None, maintainer_id=None),
-                Path(directory) / "operational_errors.sqlite",
-                logger=logging.getLogger("test.operational-errors"),
-            )
-            await reporter.initialize()
-            for summary in ("first failure", "second failure"):
-                await reporter.report(
-                    guild_id=guild_id,
-                    source="NHModeration",
-                    action="weekly reconciliation",
-                    error=RuntimeError(summary),
+            with _isolated_operational_errors(Path(directory)) as module:
+                guild = _Guild()
+                bot = _Bot(guild)
+                error = RuntimeError("failed work")
+
+                missing = await module.report_operational_error(
+                    bot,
+                    guild_id=guild.id,
+                    source="GitHubTickets",
+                    action="recover delivery",
+                    error=error,
                 )
+                cog = module.OperationalErrors(bot)
+                bot.cog = cog
+                cog.report = mock.AsyncMock(side_effect=BaseException("reporter broke"))
+                broken = await module.report_operational_error(
+                    bot,
+                    guild_id=guild.id,
+                    source="GitHubTickets",
+                    action="recover delivery",
+                    error=error,
+                )
+
+                self.assertIsNone(missing)
+                self.assertIsNone(broken)
 
-            self.assertEqual(await reporter.active_count(guild_id), 2)
-            self.assertEqual(
-                await reporter.mark_action_recovered(
-                    guild_id=guild_id,
-                    source="NHModeration",
-                    action="weekly reconciliation",
-                ),
-                2,
-            )
-            self.assertEqual(await reporter.active_count(guild_id), 0)
-
-    async def test_alert_failure_stays_persisted_and_is_logged(self):
-        guild_id = 100
-        channel = _Channel(200)
-        channel.send.side_effect = RuntimeError("Discord unavailable")
-        logger = mock.Mock()
+
+class OperationalErrorCommandTests(unittest.IsolatedAsyncioTestCase):
+    def test_registered_command_tree_is_moderator_only_and_complete(self):
         with TemporaryDirectory() as directory:
-            reporter = operational_errors.OperationalErrorReporter(
-                _Bot(guild_id, _Guild(channel, None)),
-                _Config(channel_id=channel.id, maintainer_id=None),
-                Path(directory) / "operational_errors.sqlite",
-                logger=logger,
-            )
-            await reporter.initialize()
-
-            await reporter.report(
-                guild_id=guild_id,
-                source="NHModeration",
-                action="weekly reconciliation",
-                error=RuntimeError("failed"),
-            )
-
-            self.assertEqual(await reporter.active_count(guild_id), 1)
-            logger.exception.assert_called_once()
-
-    async def test_achievement_interaction_failure_is_reported(self):
-        cog = object.__new__(nhmisc.NHMisc)
-        cog._send_achievement_interaction_error = mock.AsyncMock()
-        cog.report_operational_error = mock.AsyncMock()
-        interaction = SimpleNamespace(
-            guild=SimpleNamespace(id=100),
-            channel_id=200,
-            user=SimpleNamespace(id=300),
-        )
-        error = RuntimeError("database unavailable")
-
-        await nhmisc.NHMisc._handle_achievement_interaction_failure(
-            cog,
-            interaction,
-            "load profile",
-            error,
-            public_defer=False,
-        )
+            with _isolated_operational_errors(Path(directory)) as module:
+                root = module.OperationalErrors.nhcogs
 
-        cog.report_operational_error.assert_awaited_once_with(
-            guild_id=100,
-            source="NHMisc",
-            action="load profile",
-            error=error,
-            channel_id=200,
-        )
+                self.assertEqual(
+                    root.callback.required_permissions,
+                    {"manage_messages": True},
+                )
+                self.assertTrue(root.callback.guild_only)
+                paths = set()
+
+                def collect(command):
+                    if not command.commands:
+                        paths.add(command.qualified_name)
+                    for child in command.commands:
+                        collect(child)
+
+                collect(root)
+
+                self.assertEqual(
+                    paths,
+                    {
+                        "nhcogs errors channel set",
+                        "nhcogs errors channel clear",
+                        "nhcogs errors maintainer set",
+                        "nhcogs errors maintainer clear",
+                    },
+                )
 
-    async def test_unexpected_prefix_command_failure_is_reported(self):
-        cog = object.__new__(nhmisc.NHMisc)
-        cog.report_operational_error = mock.AsyncMock()
-        error = RuntimeError("send failed")
-        ctx = SimpleNamespace(
-            guild=SimpleNamespace(id=100),
-            channel=SimpleNamespace(id=200),
-            message=SimpleNamespace(id=300),
-            command=SimpleNamespace(qualified_name="nhmisc log voice"),
-        )
+    async def test_public_overview_does_not_read_global_configuration(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, _channel = _reporting_fixture(module)
+                public_channel = _Channel(900, guild, public=True)
+                ctx = SimpleNamespace(
+                    guild=guild,
+                    channel=public_channel,
+                    command=module.OperationalErrors.nhcogs_errors,
+                    clean_prefix="!",
+                    send=mock.AsyncMock(),
+                )
 
-        await nhmisc.NHMisc.cog_command_error(cog, ctx, error)
+                await module.OperationalErrors.nhcogs_errors.callback(cog, ctx)
 
-        cog.report_operational_error.assert_awaited_once_with(
-            guild_id=100,
-            source="NHMisc",
-            action="nhmisc log voice",
-            error=error,
-            channel_id=200,
-            message_id=300,
-        )
+                self.assertEqual(cog.config.error_channel.read_count, 0)
+                self.assertEqual(cog.config.error_maintainer_id.read_count, 0)
+                rendered = "\n".join(
+                    field.value
+                    for call in ctx.send.await_args_list
+                    for field in call.kwargs["embed"].fields
+                )
+                self.assertIn("Current values are hidden", rendered)
+                self.assertIn("!nhcogs errors channel set <channel>", rendered)
+                self.assertIn("!nhcogs errors maintainer clear", rendered)
+
+    async def test_private_overview_reads_and_renders_global_configuration(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, channel = _reporting_fixture(module)
+                await cog.cog_load()
+                ctx = SimpleNamespace(
+                    guild=guild,
+                    channel=channel,
+                    command=module.OperationalErrors.nhcogs_errors,
+                    clean_prefix="?",
+                    send=mock.AsyncMock(),
+                )
+
+                await module.OperationalErrors.nhcogs_errors.callback(cog, ctx)
+
+                self.assertGreater(cog.config.error_channel.read_count, 0)
+                config_embed = ctx.send.await_args_list[0].kwargs["embed"]
+                values = {field.name: field.value for field in config_embed.fields}
+                self.assertEqual(values["Channel"], "#operational-errors")
+                self.assertEqual(values["Maintainer"], "@maintainer")
+                self.assertEqual(values["Active failures"], "0")
+                self.assertTrue(
+                    all(
+                        call.kwargs["allowed_mentions"] is _AllowedMentions.none_marker
+                        for call in ctx.send.await_args_list
+                    )
+                )
+
+    async def test_public_mutation_commands_reject_before_configuration_access(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, private_channel = _reporting_fixture(module)
+                public_channel = _Channel(900, guild, public=True)
+                ctx = SimpleNamespace(
+                    guild=guild,
+                    channel=public_channel,
+                    command=module.OperationalErrors.nhcogs_errors_channel_set,
+                    clean_prefix="!",
+                    send=mock.AsyncMock(),
+                )
+                feedback_error = sys.modules[
+                    "redbot.core.commands"
+                ].UserFeedbackCheckFailure
+
+                with self.assertRaisesRegex(
+                    feedback_error,
+                    "hidden from @everyone",
+                ):
+                    await module.OperationalErrors.nhcogs_errors_channel_set.callback(
+                        cog,
+                        ctx,
+                        private_channel,
+                    )
+                ctx.command = module.OperationalErrors.nhcogs_errors_maintainer_set
+                with self.assertRaisesRegex(
+                    feedback_error,
+                    "hidden from @everyone",
+                ):
+                    await module.OperationalErrors.nhcogs_errors_maintainer_set.callback(
+                        cog,
+                        ctx,
+                        guild.maintainer,
+                    )
+                ctx.command = module.OperationalErrors.nhcogs_errors_channel_clear
+                with self.assertRaisesRegex(
+                    feedback_error,
+                    "hidden from @everyone",
+                ):
+                    await module.OperationalErrors.nhcogs_errors_channel_clear.callback(
+                        cog,
+                        ctx,
+                    )
+                ctx.command = module.OperationalErrors.nhcogs_errors_maintainer_clear
+                with self.assertRaisesRegex(
+                    feedback_error,
+                    "hidden from @everyone",
+                ):
+                    await module.OperationalErrors.nhcogs_errors_maintainer_clear.callback(
+                        cog,
+                        ctx,
+                    )
+
+                self.assertEqual(cog.config.error_channel.read_count, 0)
+                self.assertEqual(cog.config.error_channel.set_count, 0)
+                self.assertEqual(cog.config.error_maintainer_id.read_count, 0)
+                self.assertEqual(cog.config.error_maintainer_id.set_count, 0)
+                self.assertEqual(cog.config.error_channel.value, private_channel.id)
+                self.assertEqual(
+                    cog.config.error_maintainer_id.value,
+                    guild.maintainer.id,
+                )
+
+    async def test_private_set_commands_write_protected_configuration(self):
+        with TemporaryDirectory() as directory:
+            with _isolated_operational_errors(Path(directory)) as module:
+                cog, _bot, guild, private_channel = _reporting_fixture(module)
+                cog.config.error_channel.value = None
+                cog.config.error_maintainer_id.value = None
+                ctx = SimpleNamespace(
+                    guild=guild,
+                    channel=private_channel,
+                    command=module.OperationalErrors.nhcogs_errors_channel_set,
+                    clean_prefix="!",
+                    send=mock.AsyncMock(),
+                )
+
+                await module.OperationalErrors.nhcogs_errors_channel_set.callback(
+                    cog,
+                    ctx,
+                    private_channel,
+                )
+                ctx.command = module.OperationalErrors.nhcogs_errors_maintainer_set
+                await module.OperationalErrors.nhcogs_errors_maintainer_set.callback(
+                    cog,
+                    ctx,
+                    guild.maintainer,
+                )
+
+                self.assertEqual(cog.config.error_channel.value, private_channel.id)
+                self.assertEqual(
+                    cog.config.error_maintainer_id.value,
+                    guild.maintainer.id,
+                )
 
 
 if __name__ == "__main__":
diff --git a/tests/test_settings_commands.py b/tests/test_settings_commands.py
index 79341b8..021ac75 100644
--- a/tests/test_settings_commands.py
+++ b/tests/test_settings_commands.py
@@ -443,7 +443,6 @@ async def test_channels_overview_lists_categories_and_active_prefix_commands(sel
                 self.assertIn("Destinations", rendered)
                 self.assertIn("Sources and scopes", rendered)
                 self.assertIn("Review: Not configured", rendered)
-                self.assertIn("Errors: Not configured", rendered)
                 self.assertIn("Daily stats: Not configured", rendered)
                 self.assertIn("GIF debug logging: false", rendered)
                 self.assertIn("??honeypot channels review [channel]", rendered)
@@ -474,7 +473,7 @@ async def test_channels_overview_uses_names_without_repeating_channel_ids(self):
                     )
                 )
                 configured = dict(honeypot.settings.DEFAULTS)
-                configured["errors_channel"] = channel.id
+                configured["review_channel"] = channel.id
                 cog = object.__new__(honeypot.Honeypot)
                 cog.bot = SimpleNamespace(get_channel=mock.Mock(return_value=None))
                 cog.config = SimpleNamespace(
@@ -493,7 +492,7 @@ async def test_channels_overview_uses_names_without_repeating_channel_ids(self):
                 rendered = "\n".join(
                     f"{label}\n{value}" for label, value in entries
                 )
-                self.assertIn("Errors: #automod-filter", rendered)
+                self.assertIn("Review: #automod-filter", rendered)
                 self.assertNotIn("<#77>", rendered)
                 self.assertNotIn("(77)", rendered)
 
@@ -543,10 +542,7 @@ async def test_deleted_channel_cleanup_clears_all_registered_references(self):
                 settings = {}
                 for category in honeypot.channel_routing.CHANNEL_CATEGORIES:
                     if category.cardinality == "single":
-                        value = deleted_id if category.key in {
-                            "errors",
-                            "gif_debug",
-                        } else 99
+                        value = deleted_id if category.key == "gif_debug" else 99
                         settings[category.config_field] = _ScalarSetting(value)
                     else:
                         values = (
@@ -567,120 +563,11 @@ async def test_deleted_channel_cleanup_clears_all_registered_references(self):
 
                 await honeypot.channel_routing.clear_deleted_channel(cog, channel)
 
-                self.assertIsNone(settings["errors_channel"].value)
                 self.assertIsNone(settings["gif_detector_debug_channel"].value)
                 self.assertEqual(settings["review_channel"].value, 99)
                 self.assertEqual(settings["honeypot_channels"].values, [11, 55])
                 self.assertEqual(settings["gif_detector_channels"].values, [11, 55])
 
-    async def test_operational_alerts_use_only_the_errors_destination(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                guild = object()
-                channel = SimpleNamespace(send=mock.AsyncMock())
-                configured = dict(honeypot.settings.DEFAULTS)
-                configured["errors_channel"] = 77
-                configured["review_channel"] = 88
-                cog = object.__new__(honeypot.Honeypot)
-                cog.bot = SimpleNamespace(get_guild=mock.Mock(return_value=guild))
-                cog.config = SimpleNamespace(
-                    guild_from_id=mock.Mock(
-                        return_value=SimpleNamespace(
-                            all=mock.AsyncMock(return_value=configured)
-                        )
-                    )
-                )
-                cog._get_text_channel_or_thread = mock.Mock(return_value=channel)
-
-                await honeypot.Honeypot._send_operational_alert(cog, 123, "failure")
-
-                cog._get_text_channel_or_thread.assert_called_once_with(guild, 77)
-                channel.send.assert_awaited_once()
-                args, kwargs = channel.send.await_args
-                self.assertEqual(args[0], "failure")
-                self.assertFalse(kwargs["allowed_mentions"].users)
-
-    async def test_operational_alert_mentions_only_the_configured_maintainer(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                guild = object()
-                channel = SimpleNamespace(send=mock.AsyncMock())
-                configured = dict(honeypot.settings.DEFAULTS)
-                configured["errors_channel"] = 77
-                configured["maintainer_id"] = 555
-                cog = object.__new__(honeypot.Honeypot)
-                cog.bot = SimpleNamespace(get_guild=mock.Mock(return_value=guild))
-                cog.config = SimpleNamespace(
-                    guild_from_id=mock.Mock(
-                        return_value=SimpleNamespace(
-                            all=mock.AsyncMock(return_value=configured)
-                        )
-                    )
-                )
-                cog._get_text_channel_or_thread = mock.Mock(return_value=channel)
-
-                with mock.patch.object(
-                    honeypot.discord,
-                    "Object",
-                    side_effect=lambda *, id: SimpleNamespace(id=id),
-                ):
-                    await honeypot.Honeypot._send_operational_alert(
-                        cog, 123, "failure"
-                    )
-
-                args, kwargs = channel.send.await_args
-                self.assertEqual(args[0], "<@555> failure")
-                mentions = kwargs["allowed_mentions"]
-                self.assertFalse(mentions.everyone)
-                self.assertFalse(mentions.roles)
-                self.assertFalse(mentions.replied_user)
-                self.assertEqual([user.id for user in mentions.users], [555])
-
-    async def test_error_maintainer_command_sets_shows_and_clears_member(self):
-        with TemporaryDirectory() as directory:
-            with _isolated_honeypot_modules(Path(directory)) as honeypot:
-                setting = _ScalarSetting(None)
-                cog = object.__new__(honeypot.Honeypot)
-                cog.config = SimpleNamespace(
-                    guild=mock.Mock(
-                        return_value=SimpleNamespace(maintainer_id=setting)
-                    )
-                )
-                member = SimpleNamespace(id=555, mention="<@555>")
-                guild = SimpleNamespace(
-                    get_member=mock.Mock(
-                        side_effect=lambda member_id: (
-                            member if member_id == member.id else None
-                        )
-                    )
-                )
-                ctx = SimpleNamespace(
-                    guild=guild,
-                    clean_prefix="??",
-                    send=mock.AsyncMock(),
-                )
-
-                await honeypot.Honeypot.honeypot_errors_maintainer_set.callback(
-                    cog, ctx, member
-                )
-                self.assertEqual(setting.value, 555)
-
-                ctx.send.reset_mock()
-                await honeypot.Honeypot.honeypot_errors_maintainer_show.callback(
-                    cog, ctx
-                )
-                rendered = ctx.send.await_args.args[0]
-                self.assertIn("Error maintainer: <@555>", rendered)
-                self.assertIn(
-                    "??honeypot errors maintainer set <member>", rendered
-                )
-                self.assertIn("??honeypot errors maintainer clear", rendered)
-
-                await honeypot.Honeypot.honeypot_errors_maintainer_clear.callback(
-                    cog, ctx
-                )
-                self.assertIsNone(setting.value)
-
     async def test_public_group_shows_runtime_syntax_without_reading_config(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
@@ -912,21 +799,6 @@ async def test_action_bearing_groups_become_namespace_overviews(self):
                         "list_multiple",
                         new=mock.AsyncMock(),
                     ) as channel_list,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors",
-                        new=mock.AsyncMock(),
-                    ) as errors_list,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors_maintainer_show",
-                        new=mock.AsyncMock(),
-                    ) as maintainer_show,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors_maintainer_set",
-                        new=mock.AsyncMock(),
-                    ) as maintainer_set,
                     mock.patch.object(
                         honeypot.diagnostics,
                         "honeypot_stats",
@@ -937,16 +809,11 @@ async def test_action_bearing_groups_become_namespace_overviews(self):
                         honeypot.Honeypot.manual_evidence_settings,
                         honeypot.Honeypot.channels_honeypot,
                         honeypot.Honeypot.channels_gif_detector,
-                        honeypot.Honeypot.honeypot_errors_group,
-                        honeypot.Honeypot.honeypot_errors_maintainer_group,
                         honeypot.Honeypot.honeypot_stats_group,
                     )
                     action_mocks = (
                         evidence_status,
                         channel_list,
-                        errors_list,
-                        maintainer_show,
-                        maintainer_set,
                         stats,
                     )
                     for group in groups:
@@ -965,13 +832,6 @@ async def test_moved_group_actions_are_available_as_leaf_commands(self):
         with TemporaryDirectory() as directory:
             with _isolated_honeypot_modules(Path(directory)) as honeypot:
                 expected_commands = {
-                    "honeypot_errors": "honeypot errors list",
-                    "honeypot_errors_maintainer_show": (
-                        "honeypot errors maintainer show"
-                    ),
-                    "honeypot_errors_maintainer_set": (
-                        "honeypot errors maintainer set"
-                    ),
                     "honeypot_stats": "honeypot stats show",
                 }
                 for attribute, qualified_name in expected_commands.items():
@@ -984,41 +844,13 @@ async def test_moved_group_actions_are_available_as_leaf_commands(self):
 
                 cog = object.__new__(honeypot.Honeypot)
                 ctx = SimpleNamespace()
-                member = SimpleNamespace(id=123)
-                with (
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors",
-                        new=mock.AsyncMock(),
-                    ) as errors_list,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors_maintainer_show",
-                        new=mock.AsyncMock(),
-                    ) as maintainer_show,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_errors_maintainer_set",
-                        new=mock.AsyncMock(),
-                    ) as maintainer_set,
-                    mock.patch.object(
-                        honeypot.diagnostics,
-                        "honeypot_stats",
-                        new=mock.AsyncMock(),
-                    ) as stats,
-                ):
-                    await honeypot.Honeypot.honeypot_errors.callback(cog, ctx)
-                    await honeypot.Honeypot.honeypot_errors_maintainer_show.callback(
-                        cog, ctx
-                    )
-                    await honeypot.Honeypot.honeypot_errors_maintainer_set.callback(
-                        cog, ctx, member
-                    )
+                with mock.patch.object(
+                    honeypot.diagnostics,
+                    "honeypot_stats",
+                    new=mock.AsyncMock(),
+                ) as stats:
                     await honeypot.Honeypot.honeypot_stats.callback(cog, ctx)
 
-                errors_list.assert_awaited_once_with(cog, ctx)
-                maintainer_show.assert_awaited_once_with(cog, ctx)
-                maintainer_set.assert_awaited_once_with(cog, ctx, member)
                 stats.assert_awaited_once_with(cog, ctx)
 
     async def test_every_applicable_bare_group_sends_an_overview(self):