Stale Sweep

Run one stale-sweep pass: force-escalate bot-handled conversations that sat unresolved past max_age (ADR-0049). Called every 10 min by the support-stale-sweep k8s CronJob — the safeguard's ONLY production trigger since the webhook replaced the polling loop the sweep lived in. The per-run escalation cap keeps the drain under the Yani watcher's storm-breaker threshold.

The cron sends the secret as X-Webhook-Secret — a query secret lands in the gunicorn access log on every run (144×/day). ?secret= stays accepted only because _check_secret is shared with the Crisp webhook, which can't set headers.

The response reports denominators (pages/candidates) on purpose: escalated: 0 alone can't distinguish "all clear" from "discovery went blind" (digest-style rule 9).