Add engagement-only conversation mode

docs/configuration.md

@@ -41,7 +41,7 @@ Never document real values. `.env` is ignored and may contain production credent
 
 Physique targeting is owned only by its dedicated Monitoring controls. It is excluded from the advanced JSON response. Older cached dashboards may still submit a duplicate advanced copy; the server accepts but ignores that copy so it cannot overwrite the dedicated value persisted in `app_config`.
 
-Subreddit `type` is `image` or `chat`. Conversation policy contains `mode`, `maxAutomatedTurns`, and `rapportTurnsBeforeMediaAsk`; hybrid rapport turns must be lower than the maximum.
+Subreddit `type` is `image` or `chat`. Conversation policy contains `mode`, `maxAutomatedTurns`, and `rapportTurnsBeforeMediaAsk`; hybrid rapport turns must be lower than the maximum. `engagement` sends the normal opener but treats the first verified inbound reply as the terminal goal: no AI reply is generated and triage is marked done. `manual` also sends no automated reply, but deliberately surfaces the reply for an operator instead of completing it.
 
 ### `conversations`
 

docs/data-flow.md

@@ -88,7 +88,9 @@ flowchart TD
     CLAIM -- sent --> IGNORE
     CLAIM -- pending --> RECON["Reconcile against Matrix history"]
     CLAIM -- no --> STATE["Load or snapshot conversation policy"]
-    STATE --> STOP{"Manual, seller, image, boundary, unsafe, or turn limit?"}
+    STATE --> ENGAGE{"Engagement-only policy?"}
+    ENGAGE -- yes --> COMPLETE["Record response goal; mark triage done"]
+    ENGAGE -- no --> STOP{"Manual, seller, image, boundary, unsafe, or turn limit?"}
     STOP -- yes --> HANDOFF["Persist terminal/human-required outcome"]
     STOP -- no --> GEN["Generate policy-specific reply"]
     GEN --> SAFE{"Outbound checks pass?"}
@@ -104,6 +106,8 @@ flowchart TD
 
 The inbound event key, intended reply, claim status, and conversation state make retries idempotent. Immediately after any limiter wait, automation refreshes Matrix and revalidates the latest inbound event, boundaries, images, the shared seller/off-platform decision, policy status, and the one-media-request limit. Newer state makes the old claim terminally `superseded`; it is never sent. If the replacement event is a seller or off-platform push, the same revalidation ends and classifies the conversation instead of leaving it for a later pass. If the process dies after Matrix accepted a reply, reconciliation finds the outbound event and marks the old claim sent instead of sending it again.
 
+Engagement-only conversations use the same confirmed-opener, durable-state, and newest-inbound eligibility checks, but stop before reply claims, media exchange, second-stage screening, or generation. The first verified reply persists the `engaged` terminal state, supersedes any stale claim defensively, and resolves triage to Done. Seller/off-platform rules still run during the shared retrospective scan and may classify the conversation more specifically, but neither path sends a reply.
+
 General R4R generation explicitly permits consensual adult NSFW conversation. A model response that softly refuses, moralizes, or diverts solely because the topic is sexual is rejected before send and falls through to the next configured chat model. General replies may offer a generic approved saved picture without that offer being miscounted as a request for recipient media. Prompt instructions and deterministic output validation also keep generated private-chat text within deliverable capabilities: text and the approved saved-picture flow are supported, while voice notes, audio messages, and live voice/video/phone calls are rejected before a suggestion or automated reply can proceed.
 
 Legacy conversations may make at most one optional autonomous media request, including a request already present in the opener. The hybrid policy retains its single rapport-gated media ask. Deterministic, sequence-aware refusal checks run before generation and again at send time; generated media asks must pass the same non-explicit, non-coercive validator.

docs/frontend.md

@@ -82,6 +82,8 @@ The composer also has a separate green-screen creation panel. Its source picker
 
 The conversation inbox assigns every row to exactly one primary workflow queue: **Needs attention**, **Waiting**, **Sellers**, **Snoozed**, **Done**, **Deleted**, or **Archived**. Removed-account history belongs only to Archived, deleted recipients belong only to Deleted, and seller/off-platform outcomes belong only to Sellers, so none can leak into actionable work. Unread state, manual ownership, and received images are independent badges and secondary toggles rather than competing queues. The default queue is Needs attention. Suspended profiles are not treated as deleted.
 
+Subreddit conversation controls include an engagement-only policy. Its copy makes the boundary explicit: the normal opener is sent, the first reply completes the goal, and the bot does not answer it. Completed engagement conversations appear in Done and are not labelled as manual handoffs.
+
 ## Feature structure
 
 Each route is a slice under `features/<name>/` with page/route components, local styles, and feature-specific helpers. Cross-feature visual/domain components live under `components/`; application lifecycle belongs under `app/`; transport belongs under `api/`.

docs/product-and-safety.md

@@ -46,11 +46,12 @@ Each subreddit snapshots a policy into a conversation when automation first hand
 | Mode | Meaning |
 | --- | --- |
 | `manual` | Never auto-reply; surface a human handoff. |
+| `engagement` | Send the normal opener, count the first verified reply as success, then complete without an automated response or human handoff. |
 | `legacy` | At most one optional autonomous media request, counting a request already present in the opener, followed by human handoff. |
 | `r4r` | Bounded rapport-style replies with autonomous safety checks. |
 | `r4r-media` | Rapport first, one bounded media ask, then a handoff/terminal boundary. |
 
-The snapshot matters: changing configuration later must not silently rewrite the rules for an active conversation. Automation stops for seller/upsell evidence, an image received, a detected boundary, unsafe content, an exhausted turn budget, a repeated media request, or a manual policy.
+The snapshot matters: changing configuration later must not silently rewrite the rules for an active conversation. Engagement mode marks the conversation and operator triage done as soon as the first post-opener inbound event is durably observed; it does not generate, claim, or send a reply. Other automation stops for seller/upsell evidence, an image received, a detected boundary, unsafe content, an exhausted turn budget, a repeated media request, or a manual policy.
 
 Within those boundaries, R4R replies are expected to participate naturally in consensual adult NSFW conversation instead of moralizing, declining the topic, or diverting ordinary flirting into generic small talk. In-character soft refusals are treated like provider refusals and fall through to the next configured chat model. This does not weaken recipient boundaries, the under-18 handoff, seller/off-platform controls, location and meeting prohibitions, or the separate media-request rules.