@pegma/support-desk-application 0.2.3 → 0.2.5

package/dist/index.js

@@ -1,9 +1,11 @@
+import { attachmentConfiguration, attachmentDescriptors, snapshotAttachmentInputs, newAttachment, attachmentDigest, } from "./attachments.js";
+import { assertResolutionLearningReviewAttempt, assertResolutionLearningReviewReservation, } from "./resolution-learning-staged-records.js";
 import { auditRecordId, defineAudit } from "@pegma/audit";
 import { hasPermission } from "@pegma/authorization-core";
 import { defineMail, maxMailAttempts } from "@pegma/mail";
 import { noopLogger } from "@pegma/spine";
 import { ConcurrencyError, defineCollection, MAX_SCAN_PAGE_SIZE, } from "@pegma/storage-core";
-import { applyTicketEvent, createTicket, effectiveTicketHandling, } from "@pegma/support-desk-core";
+import { applyTicketEvent, createTicket, effectiveTicketHandling, normalizeAttachmentFilename, } from "@pegma/support-desk-core";
 import { assertAssistantTurnRecord, createAssistantTurnRecord, resolveAssistantTurnOptions, } from "./assistant-turn-records.js";
 import { createAssistantTurnServices, } from "./assistant-turns.js";
 import { createEngineeringEvidenceServices, planEngineeringTicketMutation, } from "./engineering-evidence.js";
@@ -16,10 +18,113 @@ import { createEngineeringFollowupSourceServices, planEngineeringFollowupSourceC
 import { createEngineeringFollowupWorkServices } from "./engineering-followup-work.js";
 import { fields as followupFields, integer as followupInteger, text as followupText, } from "./assistant-turn-records.js";
 import { engineeringFollowupCommandKey, engineeringFollowupHeadKey, safeEngineeringFollowupSnapshot as followupSnapshot, checkEngineeringFollowupRecordCapacity, } from "./engineering-followup-records.js";
-import { engineeringFollowupNow, engineeringFollowupVersionsCurrent, } from "./engineering-followup-source.js";
+import { engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupVersionsCurrent, } from "./engineering-followup-source.js";
 import { assertResolutionLearningRecord, resolveResolutionLearningOptions, } from "./resolution-learning-records.js";
 import { createResolutionLearningServices, createResolutionLearningSource, planResolutionLearningTicketMutation, } from "./resolution-learning.js";
 export { resolutionLearningDeliveryBinding, resolutionLearningManifestHash, } from "./resolution-learning-worker.js";
+/** Reserve Audit/receipt slots so attachment cleanup can still finish at capacity. */
+function partitionSizeWithAttachmentReserve(rows) {
+    return rows.reduce((size, row) => size +
+        (row.kind === "message"
+            ? (row.message.attachments ?? []).reduce((reserved, item) => reserved +
+                (item.scanStatus === "pending_scan"
+                    ? 6
+                    : item.scanStatus === "clean" ||
+                        item.scanStatus === "quarantined"
+                        ? 4
+                        : item.scanStatus === "deleting"
+                            ? 2
+                            : 0), 0)
+            : 0), rows.length);
+}
+/** One bounded physical page per call; host persists the returned cursor. */
+export async function sweepExpiredAttachments(options) {
+    requireStaffMutationAccess(options.access, supportPermissions.manage);
+    const limit = options.limit ?? 20;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new TypeError("Invalid attachment sweep limit");
+    const now = canonicalTimestamp(options.clock.now(), "attachment sweep now");
+    const page = await options.store.collection(supportRecords).scan({
+        limit,
+        ...(options.cursor === undefined ? {} : { cursor: options.cursor }),
+    });
+    let deleted = 0;
+    const failures = [];
+    for (const row of page.records) {
+        if (row.value.kind !== "message")
+            continue;
+        for (const attachment of row.value.message.attachments ?? []) {
+            if (attachment.scanStatus === "deleted" ||
+                (attachment.scanStatus !== "deleting" &&
+                    canonicalTimestamp(attachment.expiresAt, "attachment expiresAt") >
+                        now))
+                continue;
+            const target = {
+                ticketId: row.key.partition,
+                messageId: row.value.message.id,
+                attachmentId: attachment.id,
+            };
+            try {
+                await options.application.deleteAttachment(options.access, {
+                    ...target,
+                    commandId: `expire-${attachment.id}`,
+                    correlationId: `expire-${attachment.id}`,
+                });
+                deleted++;
+            }
+            catch {
+                failures.push(target);
+            }
+        }
+    }
+    return {
+        nextCursor: page.nextCursor,
+        physicalRows: page.records.length,
+        deleted,
+        failures,
+    };
+}
+/**
+ * Host inventory supplies at most 100 candidates with the put-time context.
+ * The host MUST stop and drain ALL attachment writers across every process,
+ * including uncertain transaction outcomes, throughout withUploadsPaused.
+ * This explicit maintenance fence prevents deleting an in-flight commit's blob.
+ */
+export async function cleanupUnreferencedAttachmentBlobs(options) {
+    if (options.candidates.length > 100)
+        throw new TypeError("At most 100 orphan candidates");
+    const candidates = options.candidates.map((candidate) => {
+        const source = boundaryObject(candidate, "orphan candidate");
+        const read = (field) => boundaryString(ownDataProperty(source, field, field), field);
+        const value = {
+            key: read("key"),
+            ticketId: read("ticketId"),
+            messageId: read("messageId"),
+        };
+        requireIdentifier(value.ticketId, "ticketId");
+        requireIdentifier(value.messageId, "messageId");
+        if (!/^support-attachments\/[a-f0-9-]{36}$/.test(value.key))
+            throw new TypeError("Invalid attachment key");
+        return Object.freeze(value);
+    });
+    return options.withUploadsPaused(async () => {
+        let deleted = 0;
+        for (const candidate of candidates) {
+            if (!/^support-attachments\/[a-f0-9-]{36}$/.test(candidate.key))
+                throw new TypeError("Invalid attachment key");
+            const row = await options.store.collection(supportRecords).get({
+                partition: candidate.ticketId,
+                id: `message:${candidate.messageId}`,
+            });
+            if (row?.kind === "message" &&
+                row.message.attachments?.some((item) => item.blobKey === candidate.key && item.scanStatus !== "deleted"))
+                continue;
+            await options.blobs.delete(candidate.key);
+            deleted++;
+        }
+        return { deleted };
+    });
+}
 export { engineeringFollowupModelManifestHash, engineeringFollowupContextHash, engineeringFollowupPublicFactsHash, engineeringFollowupChecksBinding, engineeringFollowupRetestRequestId, engineeringFollowupRetestProductBinding, engineeringFollowupRetestRequestHash, engineeringFollowupRetestSummary, engineeringFollowupModelAttemptCount, } from "./engineering-followup-records.js";
 export { engineeringPolicyRecords, engineeringPolicyAudit, engineeringPolicyAuditActions, createEngineeringPolicyServices, } from "./engineering-policy.js";
 export { engineeringModelManifestHash, engineeringRoutingBinding, engineeringExportChecksBinding, engineeringRoutingBindingHash, engineeringStaffSelectionHash, } from "./engineering-work.js";
@@ -139,6 +244,9 @@ export const supportTicketAuditActions = Object.freeze({
     resolved: "support.ticket.resolved",
     closed: "support.ticket.closed",
     reopened: "support.ticket.reopened",
+    attachmentScan: "support.ticket.attachment_scan",
+    attachmentDeleting: "support.ticket.attachment_deleting",
+    attachmentDeleted: "support.ticket.attachment_deleted",
     assistantReplied: "support.ticket.assistant_replied",
     humanRequested: "support.ticket.human_requested",
     humanEscalated: "support.ticket.human_escalated",
@@ -148,6 +256,7 @@ export const supportTicketAuditActions = Object.freeze({
     learningEvidenceRecorded: "support.learning.evidence_recorded",
     learningEvidenceInvalidated: "support.learning.evidence_invalidated",
     learningWithdrawn: "support.learning.withdrawn",
+    learningReviewRequested: "support.learning.review_requested",
     learningReviewed: "support.learning.reviewed",
     learningReviewCancelled: "support.learning.review_cancelled",
     engineeringEnrolled: "support.engineering.enrolled",
@@ -205,10 +314,46 @@ function receiptSlotId(slot, field) {
     }
     return `slot:${slot}`;
 }
+function assertAttachmentDeletionReceipt(value, location) {
+    if (value === null || typeof value !== "object")
+        return;
+    const record = value;
+    if (record.attachmentDeletion === undefined)
+        return;
+    const marker = boundaryObject(record.attachmentDeletion, "attachment deletion receipt");
+    const expected = [
+        "phase",
+        "actorId",
+        "messageId",
+        "attachmentId",
+        "correlationId",
+    ];
+    if (Object.keys(marker).length !== expected.length ||
+        Object.keys(marker).some((key) => !expected.includes(key)))
+        throw new TypeError("Invalid attachment deletion receipt fields");
+    for (const name of expected.slice(1))
+        requireIdentifier(boundaryString(ownDataProperty(marker, name, name), name), name);
+    const phase = ownDataProperty(marker, "phase", "attachment deletion phase");
+    if (phase !== "pending" && phase !== "complete")
+        throw new TypeError("Invalid attachment deletion phase");
+    if (record.kind !== "command" ||
+        record.commandType !== "attachment_state" ||
+        record.partition !== location.partition ||
+        record.id !== location.id ||
+        location.id !== `command:${record.commandId}` ||
+        record.messageId !== undefined ||
+        typeof record.requestFingerprint !== "string" ||
+        !/^[a-f0-9]{64}$/.test(record.requestFingerprint))
+        throw new TypeError("Invalid attachment deletion receipt identity");
+    requireIdentifier(record.commandId, "attachment deletion commandId");
+    requireIdentifier(record.partition, "attachment deletion ticketId");
+    canonicalTimestamp(record.completedAt, "attachment deletion timestamp");
+}
 function jsonCodec(key) {
     return {
         encode(value) {
             const location = key(value);
+            assertAttachmentDeletionReceipt(value, location);
             if ([
                 "engineering_followup_head",
                 "engineering_followup_work",
@@ -227,6 +372,15 @@ function jsonCodec(key) {
                 location.id.startsWith("engineering-work:") ||
                 location.id.startsWith("engineering-command:"))
                 assertEngineeringRecord(value, location);
+            if (value.kind ===
+                "resolution_learning_review_attempt" ||
+                location.id.startsWith("learning-review-attempt:"))
+                assertResolutionLearningReviewAttempt(value, location);
+            if (value.kind ===
+                "resolution_learning_review_reservation" ||
+                (location.id.startsWith("learning-command:") &&
+                    value.kind !== "resolution_learning_receipt"))
+                assertResolutionLearningReviewReservation(value, location);
             if ([
                 "resolution_learning_source",
                 "resolution_learning_work",
@@ -250,6 +404,16 @@ function jsonCodec(key) {
                 throw new TypeError("stored Support Desk record has no JSON payload");
             }
             const decoded = JSON.parse(record.payload);
+            if (decoded?.attachmentDeletion !==
+                undefined) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Attachment deletion receipt has invalid physical envelope");
+                assertAttachmentDeletionReceipt(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
             if ([
                 "engineering_followup_head",
                 "engineering_followup_work",
@@ -284,6 +448,32 @@ function jsonCodec(key) {
                     id: record.id,
                 });
             }
+            if (decoded?.kind ===
+                "resolution_learning_review_attempt" ||
+                (typeof record.id === "string" &&
+                    record.id.startsWith("learning-review-attempt:"))) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Review attempt has invalid physical envelope");
+                assertResolutionLearningReviewAttempt(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
+            if (decoded?.kind ===
+                "resolution_learning_review_reservation" ||
+                (typeof record.id === "string" &&
+                    record.id.startsWith("learning-command:") &&
+                    decoded?.kind !==
+                        "resolution_learning_receipt")) {
+                if (typeof record.partition !== "string" ||
+                    typeof record.id !== "string")
+                    throw new TypeError("Review reservation has invalid physical envelope");
+                assertResolutionLearningReviewReservation(decoded, {
+                    partition: record.partition,
+                    id: record.id,
+                });
+            }
             if ([
                 "resolution_learning_source",
                 "resolution_learning_work",
@@ -415,7 +605,7 @@ export const supportAudit = defineAudit({
 });
 function ticketAuditAction(input) {
     return supportAudit.action({
-        id: input.commandId,
+        id: input.eventId ?? input.commandId,
         occurredAt: input.occurredAt,
         actor: { kind: "principal", principalId: input.actorId },
         action: input.action,
@@ -493,6 +683,20 @@ const maxNotificationVariableBytes = 8_192;
 const maxNotificationVariableTotalBytes = 8_192;
 const maxAllowedCategories = 32;
 const categoryPattern = /^[a-z][a-z0-9_]{0,31}$/;
+function snapshotAttachmentStateCommand(input) {
+    const source = boundaryObject(input, "attachment command");
+    const read = (field) => boundaryString(ownDataProperty(source, field, field), field);
+    const command = {
+        ticketId: read("ticketId"),
+        messageId: read("messageId"),
+        attachmentId: read("attachmentId"),
+        commandId: read("commandId"),
+        correlationId: read("correlationId"),
+    };
+    for (const [field, value] of Object.entries(command))
+        requireIdentifier(value, field);
+    return Object.freeze(command);
+}
 function requirePermission(access, permission) {
     if (!hasPermission(access, permission)) {
         throw new SupportDeskAuthorizationError(permission);
@@ -849,6 +1053,7 @@ function snapshotCreateCustomerTicketCommand(input) {
         ? undefined
         : snapshotNotification(raw.notification);
     return Object.freeze({
+        attachments: snapshotAttachmentInputs(ownDataProperty(source, "attachments", "attachments", true)),
         commandId: boundaryString(raw.commandId, "create command.commandId"),
         correlationId: boundaryString(raw.correlationId, "create command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "create command.ticketId"),
@@ -861,6 +1066,66 @@ function snapshotCreateCustomerTicketCommand(input) {
         ...(initialHandling === undefined ? {} : { initialHandling }),
     });
 }
+function snapshotCustomerTicketAdmission(input) {
+    const source = boundaryObject(input, "admitted create command");
+    const allowed = [
+        "commandId",
+        "correlationId",
+        "ticketId",
+        "messageId",
+        "subject",
+        "body",
+        "category",
+        "requesterEmail",
+        "attachments",
+        "preference",
+        "disclosureVersion",
+    ];
+    const keys = Reflect.ownKeys(source);
+    if (Array.isArray(source) ||
+        keys.some((key) => typeof key !== "string" || !allowed.includes(key)))
+        throw new TypeError("Invalid admitted create command fields");
+    const command = Object.freeze(Object.fromEntries(keys.map((key) => [
+        key,
+        ownDataProperty(source, key, "admitted create command field"),
+    ])));
+    const preference = ownDataProperty(command, "preference", "preference");
+    if (preference !== "human" && preference !== "assistant_if_available")
+        throw new TypeError("Invalid admitted create preference");
+    const raw = ownDataProperty(command, "disclosureVersion", "disclosureVersion", true);
+    const disclosureVersion = raw === undefined ? undefined : boundaryString(raw, "disclosureVersion");
+    if (disclosureVersion !== undefined)
+        requireIdentifier(disclosureVersion, "disclosureVersion");
+    return {
+        command,
+        intent: Object.freeze({
+            preference,
+            ...(disclosureVersion === undefined ? {} : { disclosureVersion }),
+        }),
+    };
+}
+function customerCreateMethods(create) {
+    return {
+        async createCustomerTicket(access, input) {
+            return (await create(access, input)).view;
+        },
+        async createAdmittedCustomerTicket(access, input, options) {
+            requirePermission(access, supportPermissions.create);
+            requirePermission(access, supportPermissions.readOwn);
+            const { command, intent } = snapshotCustomerTicketAdmission(input);
+            return create(access, command, {
+                intent,
+                ...(options === undefined ? {} : { options }),
+            });
+        },
+    };
+}
+function admittedCreateMode(record) {
+    if (record?.kind !== "command" ||
+        (record.initialMode !== "human" && record.initialMode !== "assistant"))
+        throw new SupportDeskConflictError("Admitted create receipt mode is invalid");
+    return record.initialMode;
+}
 function snapshotReplyToCustomerTicketCommand(input) {
     const source = boundaryObject(input, "reply command");
     const raw = {
@@ -875,6 +1140,7 @@ function snapshotReplyToCustomerTicketCommand(input) {
         ? undefined
         : snapshotNotification(raw.notification);
     return Object.freeze({
+        attachments: snapshotAttachmentInputs(ownDataProperty(source, "attachments", "attachments", true)),
         commandId: boundaryString(raw.commandId, "reply command.commandId"),
         correlationId: boundaryString(raw.correlationId, "reply command.correlationId"),
         ticketId: boundaryString(raw.ticketId, "reply command.ticketId"),
@@ -938,8 +1204,24 @@ function toCustomerMessage(message) {
         format: message.format,
         body: message.body,
         createdAt: message.createdAt,
+        ...(message.attachments === undefined
+            ? {}
+            : {
+                attachments: message.attachments.map((item) => ({
+                    id: item.id,
+                    filename: item.filename,
+                    contentType: item.contentType,
+                    size: item.size,
+                    expiresAt: item.expiresAt,
+                    scanStatus: item.scanStatus,
+                })),
+            }),
     });
 }
+/** Assistant ports remain body-only even when browser views include safe attachments. */
+function assistantConversationMessages(records) {
+    return customerMessages(records).map(({ attachments: _attachments, ...message }) => Object.freeze(message));
+}
 function customerMessages(records) {
     const messages = records.filter((record) => record.kind === "message" && record.message.visibility === "customer");
     const ordinals = new Set();
@@ -1023,6 +1305,7 @@ function parseAllowedCategories(input, name = "application options.allowedCatego
 }
 function duplicateMatches(existing, commandType, messageId, requestFingerprint) {
     return (existing?.kind === "command" &&
+        existing.attachmentDeletion?.phase !== "pending" &&
         existing.commandType === commandType &&
         existing.messageId === messageId &&
         existing.requestFingerprint === requestFingerprint);
@@ -1152,7 +1435,11 @@ function derivationReserveRows(rows, consuming = false) {
             ? row.terminalReserveRows
             : 0), 0);
     const followup = rows.reduce((sum, row) => sum + (row.kind === "engineering_followup_work" ? row.completionRows : 0), 0);
-    return learning + engineering + terminal + followup;
+    const stagedReviews = rows.reduce((sum, row) => sum +
+        (row.kind === "resolution_learning_review_attempt"
+            ? row.completionRows
+            : 0), 0);
+    return learning + engineering + terminal + followup + stagedReviews;
 }
 /** Reserve is opt-in metadata on the existing quota, never a second counter. */
 function enforceManagedAdmission(ticket, rows, limits, additionalRows, addsMessage = false, firstHumanReply = false, consumesWithdrawalReserve = false) {
@@ -1160,7 +1447,7 @@ function enforceManagedAdmission(ticket, rows, limits, additionalRows, addsMessa
     const reserved = quota?.assistantManaged === true &&
         ticket.firstStaffRespondedAt === undefined &&
         !firstHumanReply;
-    enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket -
+    enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket -
         (reserved ? humanReserveRows(rows) : 0) -
         derivationReserveRows(rows, consumesWithdrawalReserve), additionalRows);
     if (addsMessage &&
@@ -1182,7 +1469,7 @@ function enforceHandlingControlAdmission(ticket, rows, limits, additionalRows, c
     const quota = rows.find((row) => row.kind === "ticket_quota");
     const reserved = quota?.assistantManaged === true &&
         ticket.firstStaffRespondedAt === undefined;
-    enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket -
+    enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket -
         (reserved ? firstHumanReplyReserveRows : 0) -
         derivationReserveRows(rows, consumesWithdrawalReserve), additionalRows);
     if (reserved && quota.messageCount >= limits.maxMessagesPerTicket)
@@ -1293,6 +1580,7 @@ function snapshotStaffReplyCommand(input) {
         ? undefined
         : snapshotNotification(raw.notification);
     return Object.freeze({
+        attachments: snapshotAttachmentInputs(ownDataProperty(source, "attachments", "attachments", true)),
         ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "staff reply command.commandId"),
         correlationId: boundaryString(raw.correlationId, "staff reply command.correlationId"),
@@ -1312,6 +1600,7 @@ function snapshotAddNoteCommand(input) {
         body: ownDataProperty(source, "body", "add note command.body"),
     };
     return Object.freeze({
+        attachments: snapshotAttachmentInputs(ownDataProperty(source, "attachments", "attachments", true)),
         ...snapshotRevisionHint(source),
         commandId: boundaryString(raw.commandId, "add note command.commandId"),
         correlationId: boundaryString(raw.correlationId, "add note command.correlationId"),
@@ -2032,6 +2321,7 @@ export function createSupportDeskApplication(options) {
         typeof rawMaxConflictAttempts !== "number") {
         throw new TypeError("application options.maxConflictAttempts must be a number");
     }
+    const attachmentConfig = attachmentConfiguration(ownDataProperty(source, "attachments", "application options.attachments", true));
     const records = store.collection(supportRecords);
     const index = store.collection(customerTicketIndex);
     const numbers = store.collection(ticketNumbers);
@@ -2322,6 +2612,466 @@ export function createSupportDeskApplication(options) {
     async function reserveTicketNumber() {
         return reserveNextTicketNumber(numbers, maxConflictAttempts);
     }
+    function validateNewAttachmentPolicy(inputs, descriptors) {
+        if (!inputs.length)
+            return;
+        if (!attachmentConfig.blobs)
+            throw new TypeError("Attachments require a host blob port");
+        if (inputs.length > attachmentConfig.perMessage ||
+            inputs.reduce((n, item) => n + item.bytes.byteLength, 0) >
+                attachmentConfig.messageBytes)
+            throw new TypeError("Attachment message limit exceeded");
+        if (descriptors.some((item) => item.size > attachmentConfig.bytes ||
+            !attachmentConfig.allowed.has(item.contentType)))
+            throw new TypeError("Attachment size or MIME type refused");
+        if (inputs.length > attachmentConfig.perTicket)
+            throw new TypeError("Ticket attachment limit exceeded");
+    }
+    async function transactWithAttachments(ticketId, actions, inputs, descriptors, beforeCommit) {
+        if (!inputs.length) {
+            const assertCurrent = await beforeCommit?.();
+            if (assertCurrent !== undefined)
+                assertCurrent();
+            return records.transact(ticketId, actions);
+        }
+        validateNewAttachmentPolicy(inputs, descriptors);
+        const rows = await records.list(ticketId);
+        enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket, inputs.length * 6 +
+            actions.filter((action) => action.action === "insert").length);
+        const count = rows.reduce((n, row) => n +
+            (row.kind === "message" ? (row.message.attachments?.length ?? 0) : 0), 0);
+        if (count + inputs.length > attachmentConfig.perTicket)
+            throw new TypeError("Ticket attachment limit exceeded");
+        const attachments = descriptors.map((item) => newAttachment({
+            ...item,
+            filename: normalizeAttachmentFilename(item.filename, attachmentConfig.filename),
+        }, clock.now(), attachmentConfig.retention));
+        const blobs = attachmentConfig.blobs;
+        const attemptedKeys = [];
+        const cleanup = async () => {
+            await Promise.allSettled(attemptedKeys.map((key) => blobs.delete(key)));
+        };
+        try {
+            const message = actions.find((action) => action.action === "insert" && action.value.kind === "message");
+            if (!message ||
+                message.action !== "insert" ||
+                message.value.kind !== "message")
+                throw new TypeError("Attachment transaction requires a message");
+            for (let index = 0; index < inputs.length; index++) {
+                const key = attachments[index].blobKey;
+                attemptedKeys.push(key);
+                const result = await blobs.put(key, inputs[index].bytes, {
+                    ticketId,
+                    messageId: message.value.message.id,
+                });
+                if (result === "exists") {
+                    attemptedKeys.pop();
+                    throw new SupportDeskConflictError("Attachment blob key collision; retry command");
+                }
+            }
+            const assertCurrent = await beforeCommit?.();
+            if (assertCurrent !== undefined)
+                assertCurrent();
+        }
+        catch (error) {
+            await cleanup();
+            throw error;
+        }
+        const prepared = actions.map((action) => {
+            if (action.action === "insert" && action.value.kind === "message")
+                return {
+                    ...action,
+                    value: {
+                        ...action.value,
+                        message: { ...action.value.message, attachments },
+                    },
+                };
+            return action;
+        });
+        // A thrown transaction has an unknown outcome. Preserve its blobs for
+        // reconciliation; deleting them could damage a successfully committed row.
+        const result = await records.transact(ticketId, prepared);
+        if (!result.committed)
+            await cleanup();
+        return result;
+    }
+    async function changeAttachmentState(access, input, status, digest) {
+        requireStaffMutationAccess(access, supportPermissions.manage);
+        for (const [field, value] of Object.entries(input))
+            requireIdentifier(value, field);
+        const fingerprint = await requestFingerprint({
+            ...input,
+            status,
+            digest: digest ?? null,
+        });
+        for (let attempt = 0; attempt < maxConflictAttempts; attempt++) {
+            const duplicate = await records.get(commandKey(input.ticketId, input.commandId));
+            if (duplicateMatches(duplicate, "attachment_state", undefined, fingerprint))
+                return;
+            if (duplicate)
+                throw new SupportDeskConflictError("Command ID reused with different input");
+            const ticket = await records.getVersioned(ticketKey(input.ticketId));
+            const message = await records.getVersioned({
+                partition: input.ticketId,
+                id: `message:${input.messageId}`,
+            });
+            if (ticket?.value.kind !== "ticket" || message?.value.kind !== "message")
+                throw new SupportDeskNotFoundError();
+            const attachment = message.value.message.attachments?.find((item) => item.id === input.attachmentId);
+            if (!attachment)
+                throw new SupportDeskNotFoundError();
+            if (digest !== undefined && digest !== attachment.sha256)
+                throw new SupportDeskConflictError("Scan digest mismatch");
+            if ((status === "clean" || status === "quarantined") &&
+                attachment.scanStatus !== "pending_scan")
+                throw new SupportDeskConflictError("Scan result is already final");
+            if (status === "deleting" && attachment.scanStatus === "deleted")
+                return;
+            if (status === "deleting" && attachment.scanStatus === "deleting")
+                return;
+            if (status === "deleted" && attachment.scanStatus === "deleted")
+                return;
+            if (status === "deleted" && attachment.scanStatus !== "deleting")
+                throw new SupportDeskConflictError("Deletion must be fenced first");
+            const rows = await records.list(input.ticketId);
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket, 2);
+            const now = clampTicketTime(clock.now(), ticket.value.ticket.updatedAt);
+            const updated = {
+                ...ticket.value.ticket,
+                revision: ticket.value.ticket.revision + 1,
+                updatedAt: now,
+            };
+            const result = await records.transact(input.ticketId, [
+                {
+                    action: "putIfUnchanged",
+                    version: ticket.version,
+                    value: { ...ticket.value, ticket: updated },
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: message.version,
+                    value: {
+                        ...message.value,
+                        message: {
+                            ...message.value.message,
+                            attachments: message.value.message.attachments.map((item) => item.id === attachment.id
+                                ? { ...item, scanStatus: status }
+                                : item),
+                        },
+                    },
+                },
+                ticketAuditAction({
+                    ...input,
+                    actorId: access.principalId,
+                    revision: updated.revision,
+                    occurredAt: now,
+                    action: status === "deleting"
+                        ? supportTicketAuditActions.attachmentDeleting
+                        : status === "deleted"
+                            ? supportTicketAuditActions.attachmentDeleted
+                            : supportTicketAuditActions.attachmentScan,
+                    details: { attachmentId: attachment.id, status },
+                }),
+                {
+                    action: "insert",
+                    value: {
+                        kind: "command",
+                        partition: input.ticketId,
+                        id: `command:${input.commandId}`,
+                        commandId: input.commandId,
+                        commandType: "attachment_state",
+                        requestFingerprint: fingerprint,
+                        completedAt: now,
+                    },
+                },
+            ]);
+            if (result.committed)
+                return;
+        }
+        throw new SupportDeskConflictError();
+    }
+    async function deleteAttachmentWithReceipt(access, input) {
+        requireStaffMutationAccess(access, supportPermissions.manage);
+        const actorId = access.principalId;
+        const authorize = () => {
+            requireStaffMutationAccess(access, supportPermissions.manage);
+            if (access.principalId !== actorId)
+                throw new SupportDeskAuthorizationError(supportPermissions.manage);
+        };
+        const key = commandKey(input.ticketId, input.commandId);
+        const fingerprint = await requestFingerprint({
+            ...input,
+            status: "deleted",
+            digest: null,
+        });
+        const fenceId = `attachment-fence-${await requestFingerprint({ commandId: input.commandId })}`;
+        const fenceEventId = "\u0000support.attachment.fence:" + input.commandId;
+        const fenceFingerprint = await requestFingerprint({
+            ...input,
+            commandId: fenceId,
+            status: "deleting",
+            digest: null,
+        });
+        const matches = (row) => row.kind === "command" &&
+            row.commandType === "attachment_state" &&
+            row.messageId === undefined &&
+            row.requestFingerprint === fingerprint;
+        const requireIdentity = (row) => {
+            const owner = row.attachmentDeletion;
+            if (owner !== undefined &&
+                (owner.actorId !== actorId ||
+                    owner.messageId !== input.messageId ||
+                    owner.attachmentId !== input.attachmentId ||
+                    owner.correlationId !== input.correlationId))
+                throw new SupportDeskConflictError("Attachment deletion belongs to another identity");
+        };
+        let reserved = false;
+        for (let attempt = 0; attempt < maxConflictAttempts; attempt++) {
+            const receipt = await records.getVersioned(key);
+            authorize();
+            if (receipt !== null) {
+                if (!matches(receipt.value))
+                    throw new SupportDeskConflictError("Command ID reused with different input");
+                requireIdentity(receipt.value);
+                if (receipt.value.attachmentDeletion?.phase !== "pending")
+                    return;
+                reserved = true;
+                break;
+            }
+            const [ticket, message] = await Promise.all([
+                records.getVersioned(ticketKey(input.ticketId)),
+                records.getVersioned({
+                    partition: input.ticketId,
+                    id: `message:${input.messageId}`,
+                }),
+            ]);
+            authorize();
+            if (ticket?.value.kind !== "ticket" || message?.value.kind !== "message")
+                throw new SupportDeskNotFoundError();
+            const attachment = message.value.message.attachments?.find((item) => item.id === input.attachmentId);
+            if (attachment === undefined)
+                throw new SupportDeskNotFoundError();
+            if (attachment.scanStatus === "deleted")
+                return;
+            const rows = await records.list(input.ticketId);
+            authorize();
+            const pendingOwner = rows.find((row) => row.kind === "command" &&
+                row.attachmentDeletion?.phase === "pending" &&
+                row.attachmentDeletion.messageId === input.messageId &&
+                row.attachmentDeletion.attachmentId === input.attachmentId);
+            if (pendingOwner !== undefined) {
+                if (pendingOwner.id === key.id) {
+                    if (!matches(pendingOwner))
+                        throw new SupportDeskConflictError("Command ID reused with different input");
+                    requireIdentity(pendingOwner);
+                    continue;
+                }
+                throw new SupportDeskConflictError("Attachment deletion belongs to another identity");
+            }
+            const changing = attachment.scanStatus !== "deleting";
+            if (!changing) {
+                // Legacy deleting metadata has no pending marker. Recover only its
+                // original tuple, backed by the old atomic fence receipt and Audit.
+                const oldReceipt = rows.find((row) => row.id === `command:${fenceId}`);
+                const oldAudit = rows.find((row) => row.id === auditRecordId(fenceId));
+                if (oldReceipt === undefined ||
+                    !duplicateMatches(oldReceipt, "attachment_state", undefined, fenceFingerprint) ||
+                    oldAudit?.kind !== "audit" ||
+                    oldAudit.event.actor.kind !== "principal" ||
+                    oldAudit.event.actor.principalId !== actorId ||
+                    oldAudit.event.action !== supportTicketAuditActions.attachmentDeleting)
+                    throw new SupportDeskConflictError("Original attachment deletion identity is required");
+            }
+            if (!attachmentConfig.blobs)
+                throw new TypeError("Host blob port required");
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket, changing ? 2 : 1);
+            const now = clampTicketTime(clock.now(), ticket.value.ticket.updatedAt);
+            const pending = {
+                kind: "command",
+                partition: input.ticketId,
+                id: key.id,
+                commandId: input.commandId,
+                commandType: "attachment_state",
+                requestFingerprint: fingerprint,
+                completedAt: now,
+                attachmentDeletion: {
+                    phase: "pending",
+                    actorId,
+                    messageId: input.messageId,
+                    attachmentId: input.attachmentId,
+                    correlationId: input.correlationId,
+                },
+            };
+            authorize();
+            const result = await records.transact(input.ticketId, [
+                {
+                    action: "putIfUnchanged",
+                    version: ticket.version,
+                    value: {
+                        ...ticket.value,
+                        ticket: changing
+                            ? {
+                                ...ticket.value.ticket,
+                                revision: ticket.value.ticket.revision + 1,
+                                updatedAt: now,
+                            }
+                            : ticket.value.ticket,
+                    },
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: message.version,
+                    value: {
+                        ...message.value,
+                        message: {
+                            ...message.value.message,
+                            attachments: message.value.message.attachments.map((item) => item.id === input.attachmentId
+                                ? { ...item, scanStatus: "deleting" }
+                                : item),
+                        },
+                    },
+                },
+                { action: "insert", value: pending },
+                ...(changing
+                    ? [
+                        ticketAuditAction({
+                            ...input,
+                            eventId: fenceEventId,
+                            actorId,
+                            revision: ticket.value.ticket.revision + 1,
+                            occurredAt: now,
+                            action: supportTicketAuditActions.attachmentDeleting,
+                            details: {
+                                attachmentId: input.attachmentId,
+                                status: "deleting",
+                            },
+                        }),
+                    ]
+                    : []),
+            ]);
+            if (result.committed) {
+                reserved = true;
+                break;
+            }
+        }
+        if (!reserved)
+            throw new SupportDeskConflictError();
+        // The original identity is now durable. Unknown blob outcomes leave it
+        // pending, so only the same actor and exact command can safely retry.
+        const [currentTicket, message] = await Promise.all([
+            records.get(ticketKey(input.ticketId)),
+            records.get({
+                partition: input.ticketId,
+                id: `message:${input.messageId}`,
+            }),
+        ]);
+        authorize();
+        if (currentTicket?.kind !== "ticket")
+            throw new SupportDeskNotFoundError();
+        const attachment = message?.kind === "message"
+            ? message.message.attachments?.find((item) => item.id === input.attachmentId)
+            : undefined;
+        if (attachment === undefined)
+            throw new SupportDeskNotFoundError();
+        if (attachment.scanStatus !== "deleting" &&
+            attachment.scanStatus !== "deleted")
+            throw new SupportDeskConflictError("Attachment deletion fence changed");
+        if (attachment.scanStatus !== "deleted") {
+            if (!attachmentConfig.blobs)
+                throw new TypeError("Host blob port required");
+            await attachmentConfig.blobs.delete(attachment.blobKey);
+            authorize();
+        }
+        for (let attempt = 0; attempt < maxConflictAttempts; attempt++) {
+            const [receipt, ticket, message] = await Promise.all([
+                records.getVersioned(key),
+                records.getVersioned(ticketKey(input.ticketId)),
+                records.getVersioned({
+                    partition: input.ticketId,
+                    id: `message:${input.messageId}`,
+                }),
+            ]);
+            authorize();
+            if (receipt === null || !matches(receipt.value))
+                throw new SupportDeskConflictError("Attachment deletion receipt changed");
+            requireIdentity(receipt.value);
+            if (receipt.value.attachmentDeletion?.phase !== "pending")
+                return;
+            if (ticket?.value.kind !== "ticket" || message?.value.kind !== "message")
+                throw new SupportDeskNotFoundError();
+            const attachment = message.value.message.attachments?.find((item) => item.id === input.attachmentId);
+            if (attachment === undefined)
+                throw new SupportDeskNotFoundError();
+            if (attachment.scanStatus !== "deleting" &&
+                attachment.scanStatus !== "deleted")
+                throw new SupportDeskConflictError("Attachment deletion fence changed");
+            const changing = attachment.scanStatus !== "deleted";
+            const rows = await records.list(input.ticketId);
+            authorize();
+            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket, changing ? 1 : 0);
+            const now = clampTicketTime(clock.now(), ticket.value.ticket.updatedAt);
+            authorize();
+            const result = await records.transact(input.ticketId, [
+                {
+                    action: "putIfUnchanged",
+                    version: ticket.version,
+                    value: {
+                        ...ticket.value,
+                        ticket: changing
+                            ? {
+                                ...ticket.value.ticket,
+                                revision: ticket.value.ticket.revision + 1,
+                                updatedAt: now,
+                            }
+                            : ticket.value.ticket,
+                    },
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: message.version,
+                    value: {
+                        ...message.value,
+                        message: {
+                            ...message.value.message,
+                            attachments: message.value.message.attachments.map((item) => item.id === input.attachmentId
+                                ? { ...item, scanStatus: "deleted" }
+                                : item),
+                        },
+                    },
+                },
+                {
+                    action: "putIfUnchanged",
+                    version: receipt.version,
+                    value: {
+                        ...receipt.value,
+                        completedAt: now,
+                        attachmentDeletion: {
+                            ...receipt.value.attachmentDeletion,
+                            phase: "complete",
+                        },
+                    },
+                },
+                ...(changing
+                    ? [
+                        ticketAuditAction({
+                            ...input,
+                            actorId,
+                            revision: ticket.value.ticket.revision + 1,
+                            occurredAt: now,
+                            action: supportTicketAuditActions.attachmentDeleted,
+                            details: {
+                                attachmentId: input.attachmentId,
+                                status: "deleted",
+                            },
+                        }),
+                    ]
+                    : []),
+            ]);
+            if (result.committed)
+                return;
+        }
+        throw new SupportDeskConflictError();
+    }
     const resolutionLearning = createResolutionLearningServices({
         records,
         clock,
@@ -2330,14 +3080,15 @@ export function createSupportDeskApplication(options) {
         maxConflictAttempts,
         admission: (ticket, rows, additional) => enforceManagedAdmission(ticket, rows, limits, additional),
         withdrawalAdmission: (ticket, rows, additional) => enforceHandlingControlAdmission(ticket, rows, limits, additional, "learning"),
-        audit: (command, ticket, actorId, now, action) => ticketAuditAction({
+        audit: (command, ticket, actorId, now, action, eventId) => ticketAuditAction({
+            ...(eventId === undefined ? {} : { eventId }),
             commandId: command.commandId,
             correlationId: command.correlationId,
             ticketId: ticket.id,
             revision: ticket.revision,
             actorId,
             occurredAt: now,
-            action: action,
+            action,
         }),
     });
     const engineeringDependencies = {
@@ -2356,7 +3107,7 @@ export function createSupportDeskApplication(options) {
             if (current !== undefined)
                 enforceHandlingControlAdmission(current.ticket, rows, limits, additional, consumption);
             else
-                enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket - derivationReserveRows(rows, consumption), additional);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket - derivationReserveRows(rows, consumption), additional);
         },
         audit: (command, ticket, actorId, now, action) => ticketAuditAction({
             commandId: command.commandId,
@@ -2408,9 +3159,12 @@ export function createSupportDeskApplication(options) {
     };
     const engineeringFollowupSource = createEngineeringFollowupSourceServices(followupDependencies);
     const engineeringFollowupWork = createEngineeringFollowupWorkServices(followupDependencies, engineeringFollowupSource.internal.load);
-    const approveAndPostEngineeringFollowupWebUpdate = async (access, input, guard) => {
+    const approveAndPostEngineeringFollowupWebUpdate = async (access, input, guard, options = {}) => {
         const actorId = access.principalId;
+        const { signal, verifyBeforeCommit } = options;
         const authorize = () => {
+            if (signal?.aborted)
+                throw new SupportDeskConflictError("Follow-up posting cancelled");
             requireIdentifier(access.principalId, "principalId");
             if (access.principalId !== actorId)
                 throw new SupportDeskAuthorizationError(supportPermissions.engineeringFollowupReview);
@@ -2495,7 +3249,7 @@ export function createSupportDeskApplication(options) {
             requireNonempty(body, "body");
             enforceLimit(body, "body", limits.maxMessageCharacters);
             const bodyHash = await requestFingerprint({ body });
-            await guard();
+            const assertProofCurrent = await guard();
             authorize();
             const occurredAt = clampTicketTime(clock.now(), ticket.updatedAt);
             const updated = applyTicketEvent(ticket, {
@@ -2566,8 +3320,22 @@ export function createSupportDeskApplication(options) {
             if (!(await engineeringFollowupVersionsCurrent(followupDependencies, current.loaded, current.work, current.engineeringWork)))
                 continue;
             authorize();
-            if (now() >=
-                Math.min(Date.parse(work.deadline), checked.deadline, Date.parse(current.proof.attestation.validUntil)))
+            const proofDeadline = Math.min(Date.parse(work.deadline), checked.deadline, Date.parse(current.proof.attestation.validUntil));
+            if (now() >= proofDeadline)
+                throw new SupportDeskConflictError("Follow-up posting proof expired");
+            if (verifyBeforeCommit !== undefined) {
+                const authorityDeadline = Math.min(proofDeadline, now() + engineeringFollowupOptions.trustTimeoutMilliseconds);
+                await engineeringFollowupTrusted(followupDependencies, async () => {
+                    authorize();
+                    await verifyBeforeCommit();
+                }, signal);
+                authorize();
+                if (now() >= authorityDeadline)
+                    throw new SupportDeskConflictError("Follow-up posting authority or proof expired");
+            }
+            if (assertProofCurrent !== undefined &&
+                (typeof assertProofCurrent !== "function" ||
+                    assertProofCurrent() !== true))
                 throw new SupportDeskConflictError("Follow-up posting proof expired");
             const outcome = await records.transact(command.ticketId, [
                 ...derivations.actions,
@@ -2663,7 +3431,7 @@ export function createSupportDeskApplication(options) {
                 : { assistantTurnFingerprint: assistantTurnCommit.fingerprint }),
         });
         const completion = assistantTurnCommit;
-        const parallel = completion?.kind === "complete";
+        const parallel = completion?.kind === "complete" || completion?.kind === "finish";
         for (let attempt = 0; attempt < maxConflictAttempts; attempt += 1) {
             const ticketRead = records.getVersioned(ticketKey(command.ticketId));
             const duplicateRead = parallel
@@ -2692,8 +3460,8 @@ export function createSupportDeskApplication(options) {
                     ticket.revision !== command.expectedRevision ||
                     effectiveTicketHandling(ticket).generation !==
                         command.expectedHandlingGeneration)) {
-                // The speculative receipt may predate a concurrent exact completion
-                // that this Ticket observation already contains. Recover its receipt
+                // The speculative receipt may predate a concurrent completion or
+                // finish already reflected in this Ticket. Recover its exact receipt
                 // before rejecting the now-stale live fence; ordinary paired reads
                 // retain their existing cost and original whole-attempt CAS versions.
                 const accepted = await records.get(commandKey(command.ticketId, command.commandId));
@@ -2709,7 +3477,7 @@ export function createSupportDeskApplication(options) {
             if (operation === "assistant_reply" && !assistantHandlingEnabled)
                 throw new SupportDeskConflictError("Assistant handling is disabled");
             const rows = await records.list(command.ticketId);
-            enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket);
+            enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket);
             const latest = latestVisibleRecord(rows);
             if (operation === "assistant_reply" || operation === "assistant_escalate")
                 requireAssistantTurn(ticket, rows, command);
@@ -2780,7 +3548,7 @@ export function createSupportDeskApplication(options) {
                 ? await planMutation()
                 : readValue(await mutationRead);
             const learningConfirmation = operation === "confirm_customer_success"
-                ? await resolutionLearning.customerConfirmation(learningMutation.source, updated, access.principalId, command.lastSeenVisibleMessageId, command.commandId, rows)
+                ? await resolutionLearning.customerConfirmation(learningMutation.source, updated, access.principalId, command.lastSeenVisibleMessageId, command.commandId, rows, partitionSizeWithAttachmentReserve(rows))
                 : { actions: [], additionalRows: 0 };
             const newRows = (operation === "take_over" ? 2 : 3) +
                 learningMutation.additionalRows +
@@ -2942,7 +3710,7 @@ export function createSupportDeskApplication(options) {
         conversation(ticket, rows) {
             return {
                 ticket: toCustomerTicketSummary(ticket),
-                messages: customerMessages(rows),
+                messages: assistantConversationMessages(rows),
                 revision: ticket.revision,
                 handling: { ...effectiveTicketHandling(ticket) },
                 ...(latestVisibleRecord(rows) === undefined
@@ -2953,6 +3721,82 @@ export function createSupportDeskApplication(options) {
         mutateHandling,
     });
     return {
+        async downloadAttachment(access, input) {
+            requireIdentifier(access.principalId, "principalId");
+            const actorId = access.principalId;
+            const staff = hasPermission(access, supportPermissions.queueRead);
+            if (!staff)
+                requirePermission(access, supportPermissions.readOwn);
+            const source = boundaryObject(input, "attachment download");
+            input = Object.freeze({
+                ticketId: boundaryString(ownDataProperty(source, "ticketId", "ticketId"), "ticketId"),
+                messageId: boundaryString(ownDataProperty(source, "messageId", "messageId"), "messageId"),
+                attachmentId: boundaryString(ownDataProperty(source, "attachmentId", "attachmentId"), "attachmentId"),
+            });
+            for (const [field, value] of Object.entries(input))
+                requireIdentifier(value, field);
+            const ticket = await records.getVersioned(ticketKey(input.ticketId));
+            if (ticket?.value.kind !== "ticket" ||
+                (!staff &&
+                    (ticket.value.ticket.requester.association !== "authenticated" ||
+                        ticket.value.ticket.requester.principalId !== actorId)))
+                throw new SupportDeskNotFoundError();
+            const key = {
+                partition: input.ticketId,
+                id: `message:${input.messageId}`,
+            };
+            const row = await records.getVersioned(key);
+            if (row?.value.kind !== "message" ||
+                (!staff && row.value.message.visibility !== "customer"))
+                throw new SupportDeskNotFoundError();
+            const attachment = row.value.message.attachments?.find((item) => item.id === input.attachmentId);
+            if (!attachment ||
+                attachment.scanStatus !== "clean" ||
+                canonicalTimestamp(attachment.expiresAt, "attachment expiresAt") <=
+                    canonicalTimestamp(clock.now(), "attachment download now"))
+                throw new SupportDeskNotFoundError();
+            if (!attachmentConfig.blobs)
+                throw new TypeError("Host blob port required");
+            const bytes = await attachmentConfig.blobs.get(attachment.blobKey, attachment.size);
+            if (bytes.byteLength !== attachment.size ||
+                (await attachmentDigest(bytes)) !== attachment.sha256)
+                throw new SupportDeskConflictError("Stored attachment digest mismatch");
+            const [currentTicket, current] = await Promise.all([
+                records.getVersioned(ticketKey(input.ticketId)),
+                records.getVersioned(key),
+            ]);
+            // Blob I/O and hashing may outlive the original resource or access snapshot.
+            // These final observations withhold bytes; they do not lock either record.
+            requirePermission(access, staff ? supportPermissions.queueRead : supportPermissions.readOwn);
+            if (access.principalId !== actorId)
+                throw new SupportDeskNotFoundError();
+            if (currentTicket?.version !== ticket.version ||
+                current?.version !== row.version ||
+                canonicalTimestamp(attachment.expiresAt, "attachment expiresAt") <=
+                    canonicalTimestamp(clock.now(), "attachment download now"))
+                throw new SupportDeskConflictError("Attachment changed during download");
+            return {
+                bytes,
+                contentType: attachment.contentType,
+                contentDisposition: `attachment; filename="attachment"; filename*=UTF-8''${encodeURIComponent(attachment.filename).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)}`,
+                cacheControl: "private, no-store",
+                xContentTypeOptions: "nosniff",
+            };
+        },
+        async recordAttachmentScanResult(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.manage);
+            const source = boundaryObject(input, "attachment scan");
+            const verdict = ownDataProperty(source, "verdict", "verdict");
+            const sha256 = boundaryString(ownDataProperty(source, "sha256", "sha256"), "sha256");
+            if (verdict !== "clean" && verdict !== "quarantined")
+                throw new TypeError("Invalid scan verdict");
+            const command = snapshotAttachmentStateCommand(input);
+            return changeAttachmentState(access, command, verdict, sha256);
+        },
+        async deleteAttachment(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.manage);
+            return deleteAttachmentWithReceipt(access, snapshotAttachmentStateCommand(input));
+        },
         ...resolutionLearning.application,
         ...engineeringEvidence.application,
         ...engineeringWorkers,
@@ -3006,7 +3850,7 @@ export function createSupportDeskApplication(options) {
             const latest = latestVisibleRecord(rows);
             return {
                 ticket: toCustomerTicketSummary(ticket),
-                messages: customerMessages(rows),
+                messages: assistantConversationMessages(rows),
                 revision: ticket.revision,
                 handling: { ...effectiveTicketHandling(ticket) },
                 ...(latest?.message.authorKind === "customer"
@@ -3106,25 +3950,72 @@ export function createSupportDeskApplication(options) {
                 .sort((a, b) => a.revision - b.revision || a.commandId.localeCompare(b.commandId))
                 .map(({ kind: _kind, partition: _partition, id: _id, ...proof }) => Object.freeze(proof));
         },
-        async createCustomerTicket(access, input) {
+        ...customerCreateMethods(async (access, input, admitted) => {
             requirePermission(access, supportPermissions.create);
             requireIdentifier(access.principalId, "principalId");
+            const actorId = access.principalId;
+            const principal = () => admitted === undefined ? access.principalId : actorId;
+            const signal = admitted?.options?.signal;
+            function authorizeAdmitted(current = access, assistant = false) {
+                if (admitted === undefined)
+                    return;
+                if (signal?.aborted)
+                    throw new SupportDeskConflictError("Admitted create was cancelled");
+                if (current.principalId !== actorId)
+                    throw new SupportDeskAuthorizationError(supportPermissions.create);
+                requirePermission(current, supportPermissions.create);
+                requirePermission(current, supportPermissions.readOwn);
+                if (assistant)
+                    requirePermission(current, supportPermissions.assistantStart);
+            }
+            async function waitForAdmission(check) {
+                authorizeAdmitted();
+                if (signal === undefined)
+                    return check();
+                let onAbort;
+                try {
+                    return await Promise.race([
+                        Promise.resolve().then(() => {
+                            authorizeAdmitted();
+                            return check();
+                        }),
+                        new Promise((_resolve, reject) => {
+                            onAbort = () => reject(new SupportDeskConflictError("Admitted create was cancelled"));
+                            signal.addEventListener("abort", onAbort, { once: true });
+                            if (signal.aborted)
+                                onAbort();
+                        }),
+                    ]);
+                }
+                finally {
+                    if (onAbort !== undefined)
+                        signal.removeEventListener("abort", onAbort);
+                }
+            }
+            authorizeAdmitted();
             const command = snapshotCreateCustomerTicketCommand(input);
-            if (command.initialHandling === "assistant") {
+            let initialHandling = command.initialHandling;
+            if (admitted === undefined && initialHandling === "assistant") {
                 requirePermission(access, supportPermissions.assistantStart);
             }
             requireIdentifier(command.ticketId, "ticketId");
             requireIdentifier(command.messageId, "messageId");
             requireIdentifier(command.commandId, "commandId");
             requireIdentifier(command.correlationId, "correlationId");
-            enforceLimit(command.subject, "subject", limits.maxSubjectCharacters);
-            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            // Admitted replay keeps fixed ceilings when later instance limits shrink.
+            // Fresh admission applies the configured limits after receipt recovery.
+            const inputLimits = admitted === undefined ? limits : supportDeskLimitMaximums;
+            enforceLimit(command.subject, "subject", inputLimits.maxSubjectCharacters);
+            enforceLimit(command.body, "body", inputLimits.maxMessageCharacters);
+            const attachmentInputs = command.attachments ?? [];
+            const descriptors = await attachmentDescriptors(attachmentInputs);
             const fingerprintPayload = {
                 type: "create_customer_ticket",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
                 subject: command.subject,
                 body: command.body,
+                ...(descriptors.length === 0 ? {} : { attachments: descriptors }),
                 // Omit absent category so pre-category receipts still match retries.
                 ...(command.category === undefined
                     ? {}
@@ -3135,7 +4026,20 @@ export function createSupportDeskApplication(options) {
                     ? {}
                     : { initialHandling: command.initialHandling }),
             };
-            const fingerprint = await requestFingerprint(fingerprintPayload);
+            const commandType = admitted === undefined
+                ? "create_customer_ticket"
+                : "create_admitted_customer_ticket";
+            const fingerprint = await requestFingerprint(admitted === undefined
+                ? fingerprintPayload
+                : {
+                    ...fingerprintPayload,
+                    type: commandType,
+                    version: 1,
+                    actorId,
+                    commandId: command.commandId,
+                    preference: admitted.intent.preference,
+                    disclosureVersion: admitted.intent.disclosureVersion ?? null,
+                });
             const createThreading = {
                 ticketNumber: true,
                 ...(command.notification === undefined
@@ -3146,8 +4050,11 @@ export function createSupportDeskApplication(options) {
             // later config change cannot break idempotent retries of the same command.
             // Replay never reserves another instance ticket number.
             const existingCreate = await records.get(commandKey(command.ticketId, command.commandId));
-            let createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, fingerprint);
-            if (!createIsReplay &&
+            authorizeAdmitted();
+            let createIsReplay = duplicateMatches(existingCreate, commandType, command.messageId, fingerprint);
+            if (admitted === undefined &&
+                !createIsReplay &&
+                descriptors.length === 0 &&
                 command.initialHandling === undefined &&
                 existingCreate?.kind === "command" &&
                 existingCreate.commandType === "create_customer_ticket" &&
@@ -3174,19 +4081,30 @@ export function createSupportDeskApplication(options) {
             }
             if (createIsReplay) {
                 const current = await records.get(ticketKey(command.ticketId));
-                if (current?.kind !== "ticket" ||
-                    !owns(current.ticket, access.principalId))
+                authorizeAdmitted();
+                if (current?.kind !== "ticket" || !owns(current.ticket, principal()))
                     throw new SupportDeskNotFoundError();
+                const initialMode = admitted === undefined
+                    ? (initialHandling ?? "human")
+                    : admittedCreateMode(existingCreate);
                 // A crash after ticket commit and before index confirmation must still
                 // converge the principal hint on retry.
                 const fence = await records.get(ticketReservationKey(command.ticketId));
+                authorizeAdmitted();
                 if (fence?.kind === "ticket_reservation" &&
                     fence.state === "committed") {
-                    await confirmCustomerTicket(access.principalId, command.ticketId, fence.token, fence.generation);
+                    await confirmCustomerTicket(principal(), command.ticketId, fence.token, fence.generation);
                 }
-                return customerViewAfterChange(access.principalId, command.ticketId, createThreading);
+                authorizeAdmitted();
+                const view = await customerViewAfterChange(principal(), command.ticketId, createThreading);
+                authorizeAdmitted();
+                return { view, initialMode };
             }
-            if (command.initialHandling === "assistant" && !assistantHandlingEnabled)
+            if (existingCreate !== null)
+                throw new SupportDeskConflictError(admitted === undefined
+                    ? "Command ID reused with different input"
+                    : "Admitted create command changed");
+            if (initialHandling === "assistant" && !assistantHandlingEnabled)
                 throw new SupportDeskConflictError("Assistant handling is disabled");
             if (command.category !== undefined) {
                 if (allowedCategories === undefined ||
@@ -3194,6 +4112,32 @@ export function createSupportDeskApplication(options) {
                     throw new TypeError("create command.category is not configured for this Support Desk instance");
                 }
             }
+            const verifyBeforeCommit = admitted?.options?.verifyBeforeCommit;
+            let assistantAccess;
+            if (admitted !== undefined) {
+                enforceLimit(command.subject, "subject", limits.maxSubjectCharacters);
+                enforceLimit(command.body, "body", limits.maxMessageCharacters);
+                if (typeof verifyBeforeCommit !== "function")
+                    throw new SupportDeskConflictError("Fresh create admission is required");
+                const resolveAssistantStart = admitted.options?.resolveAssistantStart;
+                if (admitted.intent.preference === "assistant_if_available" &&
+                    admitted.intent.disclosureVersion !== undefined &&
+                    assistantHandlingEnabled &&
+                    assistantTurnOptions !== undefined &&
+                    resolveAssistantStart !== undefined) {
+                    const current = await waitForAdmission(resolveAssistantStart);
+                    authorizeAdmitted();
+                    if (current !== null) {
+                        authorizeAdmitted(current, true);
+                        assistantAccess = current;
+                        initialHandling = "assistant";
+                    }
+                }
+            }
+            let initialMode = initialHandling ?? "human";
+            // Exact accepted receipts returned above. Apply current attachment policy
+            // only to fresh intake, before it can consume a number or customer slot.
+            validateNewAttachmentPolicy(attachmentInputs, descriptors);
             // Fail closed before durable number/index reservation so a too-small
             // partition budget cannot exhaust the principal ticket index with
             // reserved-but-never-created tickets.
@@ -3201,18 +4145,18 @@ export function createSupportDeskApplication(options) {
                 (resolutionLearningOptions.enabled ? 1 : 0) +
                 (engineeringOptions.enabled ? 1 : 0) +
                 (command.notification === undefined ? 0 : 1) +
-                (assistantTurnOptions !== undefined &&
-                    command.initialHandling === "assistant"
+                (assistantTurnOptions !== undefined && initialHandling === "assistant"
                     ? 1
                     : 0);
             enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, estimatedCreateRows +
+                attachmentInputs.length * 6 +
                 (resolutionLearningOptions.enabled ? 2 : 0) +
                 (engineeringOptions.enabled ? 2 : 0) +
-                (command.initialHandling === "assistant"
+                (initialHandling === "assistant"
                     ? assistantHumanReserveRows +
                         (resolutionLearningOptions.enabled ? 1 : 0)
                     : 0));
-            if (command.initialHandling === "assistant" &&
+            if (initialHandling === "assistant" &&
                 limits.maxMessagesPerTicket < 1 + assistantHumanReserveMessages)
                 throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
             // Reserve outside the ticket transaction; gaps are accepted if create fails.
@@ -3228,15 +4172,13 @@ export function createSupportDeskApplication(options) {
                 number: ticketNumber,
                 subject: command.subject,
                 channel: "web",
-                ...(command.initialHandling === undefined
-                    ? {}
-                    : { initialHandling: command.initialHandling }),
+                ...(initialHandling === undefined ? {} : { initialHandling }),
                 ...(command.category === undefined
                     ? {}
                     : { category: command.category }),
                 requester: {
                     association: "authenticated",
-                    principalId: access.principalId,
+                    principalId: principal(),
                     ...(command.requesterEmail === undefined
                         ? {}
                         : { email: command.requesterEmail }),
@@ -3247,22 +4189,21 @@ export function createSupportDeskApplication(options) {
                 id: command.messageId,
                 ticketId: command.ticketId,
                 authorKind: "customer",
-                authorPrincipalId: access.principalId,
+                authorPrincipalId: principal(),
                 channel: "web",
                 visibility: "customer",
                 format: "plain_text",
                 body: command.body,
                 createdAt: now,
             };
-            const assistantTurn = assistantTurnOptions !== undefined &&
-                command.initialHandling === "assistant"
+            const assistantTurn = assistantTurnOptions !== undefined && initialHandling === "assistant"
                 ? await createAssistantTurnRecord(ticket, message, command.correlationId, assistantTurnOptions)
                 : undefined;
             const notificationJob = notification === undefined
                 ? undefined
                 : deliveryJobAction(command.ticketId, command.messageId, now, notification);
             const notificationContent = deliveryContent(notification);
-            const reservation = await reserveCustomerTicket(access.principalId, command.ticketId, now);
+            const reservation = await reserveCustomerTicket(principal(), command.ticketId, now);
             const existingReservation = await records.getVersioned(ticketReservationKey(command.ticketId));
             if (existingReservation?.value.kind === "ticket_reservation" &&
                 existingReservation.value.state === "committed" &&
@@ -3332,7 +4273,7 @@ export function createSupportDeskApplication(options) {
                         partition: command.ticketId,
                         id: "quota",
                         messageCount: 1,
-                        ...(command.initialHandling === "assistant"
+                        ...(initialHandling === "assistant"
                             ? { assistantManaged: true }
                             : {}),
                     },
@@ -3356,7 +4297,7 @@ export function createSupportDeskApplication(options) {
                     correlationId: command.correlationId,
                     ticketId: command.ticketId,
                     revision: ticket.revision,
-                    actorId: access.principalId,
+                    actorId: principal(),
                     occurredAt: now,
                     action: supportTicketAuditActions.created,
                 }),
@@ -3367,10 +4308,11 @@ export function createSupportDeskApplication(options) {
                         partition: command.ticketId,
                         id: `command:${command.commandId}`,
                         commandId: command.commandId,
-                        commandType: "create_customer_ticket",
+                        commandType,
                         messageId: command.messageId,
                         requestFingerprint: fingerprint,
                         completedAt: now,
+                        ...(admitted === undefined ? {} : { initialMode }),
                     },
                 },
                 ...(notificationJob === undefined ? [] : [notificationJob]),
@@ -3381,16 +4323,43 @@ export function createSupportDeskApplication(options) {
             // Create starts an empty partition; fail closed if the first write would
             // exceed the configured physical-record budget.
             enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, actions.length);
-            const outcome = await records.transact(command.ticketId, actions);
+            if (attachmentInputs.length > 0) {
+                const initialRows = actions.flatMap((action) => action.action === "insert" ? [action.value] : []);
+                enforceManagedAdmission(ticket, initialRows, limits, attachmentInputs.length * 6);
+            }
+            const beforeAttachmentCommit = async () => {
+                authorizeAdmitted();
+                const assertCurrent = admitted !== undefined && verifyBeforeCommit !== undefined
+                    ? await waitForAdmission(() => verifyBeforeCommit(initialMode))
+                    : undefined;
+                return () => {
+                    authorizeAdmitted();
+                    if (assistantAccess !== undefined)
+                        authorizeAdmitted(assistantAccess, true);
+                    if (admitted !== undefined &&
+                        (typeof assertCurrent !== "function" || assertCurrent() !== true))
+                        throw new SupportDeskConflictError("Admitted create authority changed");
+                    return true;
+                };
+            };
+            const outcome = await transactWithAttachments(command.ticketId, actions, attachmentInputs, descriptors, beforeAttachmentCommit);
             if (!outcome.committed) {
                 const existing = await records.get(commandKey(command.ticketId, command.commandId));
-                if (!duplicateMatches(existing, "create_customer_ticket", command.messageId, fingerprint)) {
+                if (!duplicateMatches(existing, commandType, command.messageId, fingerprint)) {
                     throw new SupportDeskConflictError();
                 }
+                // An exact competing commit recovers the winner's historical mode,
+                // using the same create/read-own authority as the early receipt path.
+                if (admitted !== undefined)
+                    initialMode = admittedCreateMode(existing);
             }
-            await confirmCustomerTicket(access.principalId, command.ticketId, reservation.reservationToken, reservation.reservationGeneration);
-            return customerViewAfterChange(access.principalId, command.ticketId, createThreading);
-        },
+            authorizeAdmitted();
+            await confirmCustomerTicket(principal(), command.ticketId, reservation.reservationToken, reservation.reservationGeneration);
+            authorizeAdmitted();
+            const view = await customerViewAfterChange(principal(), command.ticketId, createThreading);
+            authorizeAdmitted();
+            return { view, initialMode };
+        }),
         async replyToCustomerTicket(access, input) {
             requirePermission(access, supportPermissions.replyOwn);
             requireIdentifier(access.principalId, "principalId");
@@ -3400,11 +4369,17 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.commandId, "commandId");
             requireIdentifier(command.correlationId, "correlationId");
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const attachmentInputs = command.attachments ?? [];
+            const descriptors = await attachmentDescriptors(attachmentInputs);
+            const attachmentFingerprint = descriptors.length
+                ? { attachments: descriptors }
+                : {};
             const fingerprint = await requestFingerprint({
                 type: "reply_customer_ticket",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
                 body: command.body,
+                ...attachmentFingerprint,
                 notification: stableNotification(command.notification),
             });
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
@@ -3412,6 +4387,8 @@ export function createSupportDeskApplication(options) {
                 if (duplicateMatches(duplicate, "reply_customer_ticket", command.messageId, fingerprint)) {
                     return customerViewAfterChange(access.principalId, command.ticketId, notificationThreading(command));
                 }
+                if (duplicate !== null)
+                    throw new SupportDeskConflictError("Command ID reused with different input");
                 const versioned = await records.getVersioned(ticketKey(command.ticketId));
                 if (versioned?.value.kind !== "ticket" ||
                     versioned.value.ticket.requester.association !== "authenticated" ||
@@ -3453,8 +4430,12 @@ export function createSupportDeskApplication(options) {
                     });
                 }
                 const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, true);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedReplyRows + learningMutation.additionalRows);
-                enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, addedReplyRows + learningMutation.additionalRows, true);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, addedReplyRows +
+                    learningMutation.additionalRows +
+                    attachmentInputs.length * 6);
+                enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, addedReplyRows +
+                    learningMutation.additionalRows +
+                    attachmentInputs.length * 6, true);
                 const message = {
                     id: command.messageId,
                     ticketId: command.ticketId,
@@ -3481,7 +4462,7 @@ export function createSupportDeskApplication(options) {
                 const notificationJob = command.notification === undefined
                     ? undefined
                     : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
-                const outcome = await records.transact(command.ticketId, [
+                const outcome = await transactWithAttachments(command.ticketId, [
                     ...learningMutation.actions,
                     {
                         action: "putIfUnchanged",
@@ -3530,7 +4511,7 @@ export function createSupportDeskApplication(options) {
                     ...(assistantIngress === undefined
                         ? []
                         : [{ action: "insert", value: assistantIngress }]),
-                ]);
+                ], attachmentInputs, descriptors);
                 if (outcome.committed) {
                     return customerViewAfterChange(access.principalId, command.ticketId, notificationThreading(command));
                 }
@@ -3716,12 +4697,18 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.commandId, "commandId");
             requireIdentifier(command.correlationId, "correlationId");
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const attachmentInputs = command.attachments ?? [];
+            const descriptors = await attachmentDescriptors(attachmentInputs);
+            const attachmentFingerprint = descriptors.length
+                ? { attachments: descriptors }
+                : {};
             const fingerprint = await requestFingerprint({
                 ...snapshotRevisionHint(command),
                 type: "staff_reply",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
                 body: command.body,
+                ...attachmentFingerprint,
                 notification: stableNotification(command.notification),
             });
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
@@ -3752,10 +4739,12 @@ export function createSupportDeskApplication(options) {
                     occurredAt: now,
                 });
                 const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, true);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, (command.notification === undefined ? 3 : 4) +
-                    learningMutation.additionalRows);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, (command.notification === undefined ? 3 : 4) +
+                    learningMutation.additionalRows +
+                    attachmentInputs.length * 6);
                 enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, (command.notification === undefined ? 3 : 4) +
-                    learningMutation.additionalRows, true, true);
+                    learningMutation.additionalRows +
+                    attachmentInputs.length * 6, true, true);
                 const message = {
                     id: command.messageId,
                     ticketId: command.ticketId,
@@ -3771,7 +4760,7 @@ export function createSupportDeskApplication(options) {
                 const notificationJob = command.notification === undefined
                     ? undefined
                     : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
-                const outcome = await records.transact(command.ticketId, [
+                const outcome = await transactWithAttachments(command.ticketId, [
                     ...learningMutation.actions,
                     {
                         action: "putIfUnchanged",
@@ -3818,7 +4807,7 @@ export function createSupportDeskApplication(options) {
                         },
                     },
                     ...(notificationJob === undefined ? [] : [notificationJob]),
-                ]);
+                ], attachmentInputs, descriptors);
                 if (outcome.committed) {
                     return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 }
@@ -3838,12 +4827,18 @@ export function createSupportDeskApplication(options) {
             requireIdentifier(command.commandId, "commandId");
             requireIdentifier(command.correlationId, "correlationId");
             enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const attachmentInputs = command.attachments ?? [];
+            const descriptors = await attachmentDescriptors(attachmentInputs);
+            const attachmentFingerprint = descriptors.length
+                ? { attachments: descriptors }
+                : {};
             const fingerprint = await requestFingerprint({
                 ...snapshotRevisionHint(command),
                 type: "add_note",
                 ticketId: command.ticketId,
                 messageId: command.messageId,
                 body: command.body,
+                ...attachmentFingerprint,
             });
             for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
                 const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
@@ -3859,8 +4854,8 @@ export function createSupportDeskApplication(options) {
                 if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
                     return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 const partitionRows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 3);
-                enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, 3, true);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, 3);
+                enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, 3 + attachmentInputs.length * 6, true);
                 const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
                 if (quota?.value.kind !== "ticket_quota") {
                     throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
@@ -3892,7 +4887,7 @@ export function createSupportDeskApplication(options) {
                     body: command.body,
                     createdAt: now,
                 };
-                const outcome = await records.transact(command.ticketId, [
+                const outcome = await transactWithAttachments(command.ticketId, [
                     {
                         action: "putIfUnchanged",
                         version: versioned.version,
@@ -3939,7 +4934,7 @@ export function createSupportDeskApplication(options) {
                             resultTicket: updated,
                         },
                     },
-                ]);
+                ], attachmentInputs, descriptors);
                 if (outcome.committed) {
                     return staffCommandResult(command.ticketId, command.commandId);
                 }
@@ -3994,7 +4989,7 @@ export function createSupportDeskApplication(options) {
                 if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
                     return staffCommandResult(command.ticketId, command.commandId, notificationThreading(command));
                 const partitionRows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, addedRecords);
                 enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, addedRecords, command.messageId !== undefined);
                 let quotaVersion = null;
                 if (command.messageId !== undefined) {
@@ -4143,7 +5138,7 @@ export function createSupportDeskApplication(options) {
                 if (await checkStaffRevision(versioned.value.ticket, command, fingerprint))
                     return staffCommandResult(command.ticketId, command.commandId);
                 const partitionRows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 2);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, 2);
                 enforceManagedAdmission(versioned.value.ticket, partitionRows, limits, 2);
                 const statusBefore = versioned.value.ticket.status;
                 const customerUpdatedBefore = versioned.value.ticket.customerUpdatedAt;
@@ -4234,7 +5229,7 @@ export function createSupportDeskApplication(options) {
                 if (command.tags.some((tag) => !allowedTags.has(tag)))
                     throw new TypeError("tags must be on the host allowlist");
                 const rows = await records.list(command.ticketId);
-                enforcePartitionRecordLimit(rows.length, limits.maxRecordsPerTicket, 2);
+                enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(rows), limits.maxRecordsPerTicket, 2);
                 enforceManagedAdmission(versioned.value.ticket, rows, limits, 2);
                 const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
                 const updated = applyTicketEvent(versioned.value.ticket, {
@@ -4374,7 +5369,7 @@ export function createSupportDeskApplication(options) {
                 occurredAt: now,
             });
             const learningMutation = await planTicketDerivationMutation(records, { value: versioned.value, version: versioned.version }, updated, partitionRows, command.messageId !== undefined);
-            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords + learningMutation.additionalRows);
+            enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, addedRecords + learningMutation.additionalRows);
             enforceManagedAdmission(versioned.value.ticket, projectFollowupRows(partitionRows, learningMutation.nextWorkRows), limits, addedRecords + learningMutation.additionalRows, command.messageId !== undefined);
             // Optional system message + mail commit with the lifecycle change so a
             // resolution notification cannot be lost after the ticket is resolved.
@@ -5868,7 +6863,7 @@ export function createInboundMailProcessor(options) {
                 throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
             }
             const partitionRows = await records.list(input.ticketId);
-            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 1);
+            enforcePartitionRecordLimit(partitionSizeWithAttachmentReserve(partitionRows), limits.maxRecordsPerTicket, 1);
             enforceManagedAdmission(ticket.value.ticket, partitionRows, limits, 1);
             const outcome = await records.transact(input.ticketId, [
                 {