"""Deterministic prefilter; no model call and no secrets in returned state."""
def build_state(ticket):
    message = ticket.get('message')
    if not isinstance(message, str) or not message.strip():
        return {'action': 'request_context', 'reason': 'missing_message'}
    if len(message) > 4000:
        return {'action': 'review', 'reason': 'oversized_message'}
    failures = ticket.get('failure_count')
    if not isinstance(failures, int) or isinstance(failures, bool) or failures < 0:
        return {'action': 'request_context', 'reason': 'invalid_failure_count'}
    return {'action': 'evaluate', 'state': {
        'message': message.strip(),
        'failure_band': 'repeated' if failures >= 3 else 'isolated',
        # Explicit allowlist: api_key, email and unrelated history are not copied.
    }}

if __name__ == '__main__':
    print(build_state({'message': 'Checkout fails.', 'failure_count': 4, 'api_key': 'do-not-send'}))
    print(build_state({'failure_count': 4}))
    # Free text can itself contain secrets. Review/redact it before provider upload.