Triage: set owner, priority, and status before replying.

Evidence: upload private, malware-scanned logs, screenshots, exports, or run artifacts.

Escalation: urgent tickets require a reason and create an audit event.

Closure: resolve only after the requester-visible reply explains the outcome.