Azure Communication Services web client call to a Teams Phone Agent resource account ends 502 / subcode 8587; is this supported?

Setup: ACS Calling SDK (web) callAgent.startCall([{ teamsAppId: <resource account object ID>, cloud: "public" }]) with video, from our web app. The target is the resource account of a first-party Teams Phone Agent (auto attendant type) that has a phone number assigned. The Teams tenant lists our ACS resource under allowed ACS resources, and external access for ACS users is enabled.

What works: the same web app calling regular Teams users connects normally. Calling the agent from the Teams client inside the tenant works.

What fails: calls to the agent reach Microsoft but are never answered. Call summary logs show ParticipantEndReason 502, ParticipantEndSubCode 8587 (“Incoming Call Not Answered Within Time”) on both the kiosk leg and the target leg. A call on Nov 5 also showed 403 / 10391 on the target leg. Correlation ID for the latest call: 9ada9c13-ca15-4d36-82d6-f9799f095964 (placed about 01:22 UTC on Nov 12).

Questions: (1) Can an ACS web client call a Teams Phone Agent resource account over VoIP, with or without video? (2) What does subcode 10391 mean in this context? (3) Why would 8587 appear for a first-party agent that has no ACS answering app?