@pegma/support-desk-application 0.2.6 → 0.2.8

package/dist/engineering-followup-work.js

@@ -1,7 +1,9 @@
+import { engineeringMutationBoundary, } from "./engineering-mutation-guard.js";
 import { SupportDeskConflictError, SupportDeskNotFoundError, supportPermissions, supportTicketAuditActions, } from "./index.js";
 import { canonical, fields, fingerprint, integer, text, timestamp, } from "./assistant-turn-records.js";
 import { safeEngineeringFollowupSnapshot as snapshot, checkEngineeringFollowupRecordCapacity, reserveEngineeringFollowupReachable, engineeringFollowupWorkKey, engineeringFollowupCommandKey, validateEngineeringFollowupCandidate, validateEngineeringFollowupBundle, validateEngineeringFollowupModelBinding, engineeringFollowupModelManifestHash, engineeringFollowupContextHash, engineeringFollowupPublicFactsHash, engineeringFollowupChecksBinding, engineeringFollowupRetestProductBinding, engineeringFollowupRetestRequestHash, engineeringFollowupRetestRequestId, engineeringFollowupRetestSummary, engineeringFollowupModelAttemptCount, } from "./engineering-followup-records.js";
-import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
+import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupObservation, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
+import { engineeringSourceKey } from "./engineering-records.js";
 function validateFence(command) {
     for (const value of [
         command.ticketId,
@@ -71,11 +73,17 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             throw new SupportDeskNotFoundError();
         return { value: work.value, version: work.version };
     }
-    async function save(loaded, work, next, extra = [], nextHead = loaded.head?.value) {
+    async function save(loaded, work, next, extra = [], nextHead = loaded.head?.value, mutation, beforeCommit) {
         if (loaded.head === null || nextHead === undefined)
             throw new SupportDeskConflictError("Follow-up head disappeared");
         checkEngineeringFollowupRecordCapacity(next);
         checkEngineeringFollowupRecordCapacity(nextHead);
+        if (mutation !== undefined) {
+            const assertHostCurrent = await mutation.verify();
+            assertHostCurrent();
+            beforeCommit?.();
+            mutation.ensure();
+        }
         return (await records.transact(next.ticketId, [
             {
                 action: "putIfUnchanged",
@@ -188,6 +196,177 @@ export function createEngineeringFollowupWorkServices(deps, load) {
         text(checked.verifierVersion, "verifierVersion");
         return { binding, deadline: timestamp(checked.validUntil, "validUntil") };
     }
+    class ReassessmentRetry extends Error {
+    }
+    async function prepareBundle(access, input, guard, control, initial) {
+        const actorId = access.principalId;
+        const command = snapshot(fields(input, "prepare follow-up bundle", [
+            "ticketId",
+            "workId",
+            "commandId",
+            "correlationId",
+            "mode",
+            "expectedWorkGeneration",
+            "candidateHash",
+            "exactBundle",
+            "checksReceipt",
+            "checkPolicyVersion",
+        ], ["recoveryIntentHash"]));
+        if (command.mode !== "prepare" && command.mode !== "staff_reassessment")
+            throw new TypeError("Invalid follow-up preparation mode");
+        const staff = command.mode === "staff_reassessment";
+        const authorize = () => {
+            initial?.authorize();
+            permission(access, staff
+                ? supportPermissions.engineeringFollowupReview
+                : supportPermissions.engineeringFollowupProcess, actorId, staff);
+        };
+        authorize();
+        const mutation = initial?.mutation ?? engineeringMutationBoundary(control);
+        for (const entry of [
+            command.ticketId,
+            command.workId,
+            command.commandId,
+            command.correlationId,
+            command.candidateHash,
+            command.checksReceipt,
+            command.checkPolicyVersion,
+        ])
+            text(entry, "bundle preparation identity");
+        integer(command.expectedWorkGeneration, "expectedWorkGeneration", 1);
+        validateEngineeringFollowupBundle(command.exactBundle);
+        if (command.recoveryIntentHash !== undefined &&
+            (!staff || !/^[a-f0-9]{64}$/.test(command.recoveryIntentHash)))
+            throw new TypeError("Invalid preparation recovery intent");
+        const hash = await fingerprint({ actorId, command });
+        const recoveryFingerprint = command.recoveryIntentHash === undefined
+            ? undefined
+            : await fingerprint({
+                actorId,
+                intentHash: command.recoveryIntentHash,
+            });
+        const now = engineeringFollowupNow(deps);
+        for (let attempt = 0; attempt < (initial === undefined ? deps.maxConflictAttempts : 1); attempt += 1) {
+            const previous = await replay(command, hash);
+            authorize();
+            if (previous !== null) {
+                if (!("status" in previous))
+                    throw new SupportDeskConflictError("Wrong follow-up receipt kind");
+                return previous;
+            }
+            if (typeof guard !== "function")
+                throw new TypeError("Follow-up bundle preparation needs a current read-only guard");
+            mutation?.ensure();
+            const loaded = initial?.current.loaded ?? (await load(command.ticketId));
+            const stored = initial?.current.work ?? (await workAt(command));
+            const work = stored.value;
+            if (work.workGeneration !== command.expectedWorkGeneration ||
+                work.candidateHash !== command.candidateHash ||
+                work.withdrawn ||
+                work.status === "delivered" ||
+                work.security !== "ordinary")
+                throw new SupportDeskConflictError("Follow-up bundle source, candidate or generation changed");
+            if (!staff && timestamp(work.deadline, "deadline") <= now())
+                throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+            if (work.bundleRevision >= options.maxBundleRevisions)
+                throw new SupportDeskConflictError("Follow-up bundle preparation bound reached");
+            const rearm = staff
+                ? await sourceServices.internal.reassessment(command, now, "bundle", initial?.current, initial === undefined ? undefined : () => initial.authorize())
+                : null;
+            const current = staff
+                ? null
+                : await engineeringFollowupCurrent(deps, loaded, stored, now);
+            if (!staff &&
+                (work.stage !== "bundle" ||
+                    work.candidate === undefined ||
+                    work.completionRows !== 5 ||
+                    work.messageSlots !== 1))
+                throw new SupportDeskConflictError("Follow-up bundle preparation needs its current model candidate");
+            if (rearm !== null &&
+                (rearm.work.version !== stored.version ||
+                    rearm.loaded.ticket.version !== loaded.ticket.version ||
+                    rearm.loaded.source.version !== loaded.source.version ||
+                    rearm.loaded.head?.version !== loaded.head?.version)) {
+                if (initial !== undefined)
+                    throw new ReassessmentRetry();
+                continue;
+            }
+            const base = rearm === null
+                ? work
+                : {
+                    ...work,
+                    ...rearm.prospective,
+                    workBindingHash: rearm.prospectiveWorkBindingHash,
+                };
+            const checked = await verifyBundle(base, command.exactBundle, command.candidateHash, command.checkPolicyVersion, command.checksReceipt, now);
+            const { candidate: _candidate, ...retained } = withoutLease(base);
+            const next = {
+                ...retained,
+                stage: "bundle",
+                status: "bundle_prepared",
+                completionRows: 3,
+                messageSlots: 1,
+                deadline: staff
+                    ? new Date(now() + options.maxWorkMilliseconds).toISOString()
+                    : work.deadline,
+                workGeneration: work.workGeneration + 1,
+                bundleRevision: work.bundleRevision + 1,
+                preparedBundle: {
+                    bundle: command.exactBundle,
+                    bundleHash: checked.binding.bundleHash,
+                    candidateHash: command.candidateHash,
+                    binding: checked.binding,
+                    checksReceipt: command.checksReceipt,
+                },
+            };
+            reserveEngineeringFollowupReachable(next);
+            const cohort = rearm === null
+                ? { actions: [], nextWorkRows: [] }
+                : await planEngineeringFollowupContextChange(records, {
+                    rows: loaded.rows,
+                    context: rearm.proof.context,
+                    previousHead: loaded.head.value,
+                    nextHead: rearm.nextHead,
+                    excludedWorkId: work.workId,
+                });
+            deps.admission(loaded.ticket.value.ticket, loaded.rows, [next, ...cohort.nextWorkRows], 2);
+            await guard();
+            const proof = rearm?.proof ?? current.proof;
+            const associationWork = rearm?.engineeringWork ?? current.engineeringWork;
+            if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associationWork))) {
+                if (initial !== undefined)
+                    throw new ReassessmentRetry();
+                continue;
+            }
+            authorize();
+            if (!staff && timestamp(work.deadline, "deadline") <= now())
+                throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+            if (now() >=
+                Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                throw new SupportDeskConflictError("Follow-up bundle proof expired");
+            const outcome = result(next);
+            if (await save(loaded, stored, next, [
+                ...cohort.actions,
+                deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), staff
+                    ? supportTicketAuditActions.engineeringFollowupReassessed
+                    : supportTicketAuditActions.engineeringFollowupBundlePrepared),
+                receipt(command, hash, outcome, recoveryFingerprint),
+            ], rearm?.nextHead ?? loaded.head.value, mutation, () => {
+                authorize();
+                if (!staff && timestamp(work.deadline, "deadline") <= now())
+                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+                if (now() >=
+                    Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                    throw new SupportDeskConflictError("Follow-up bundle proof expired");
+            })) {
+                authorize();
+                return outcome;
+            }
+        }
+        if (initial !== undefined)
+            throw new ReassessmentRetry();
+        throw new SupportDeskConflictError();
+    }
     const application = {
         async claimEngineeringFollowupWork(access, input) {
             const actorId = access.principalId;
@@ -649,159 +828,155 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 throw new SupportDeskConflictError("Follow-up recovery identity does not match accepted preparation");
             return snapshot(prior.result);
         },
-        async prepareEngineeringFollowupBundle(access, input, guard) {
+        async prepareEngineeringFollowupBundle(access, input, guard, control) {
+            return prepareBundle(access, input, guard, control);
+        },
+        async reassessEngineeringFollowupBundle(access, input, planner, control) {
             const actorId = access.principalId;
-            const command = snapshot(fields(input, "prepare follow-up bundle", [
+            const authorize = (reader = access) => {
+                permission(reader, supportPermissions.engineeringFollowupReview, actorId, true);
+                permission(reader, supportPermissions.engineeringFollowupRead, actorId, true);
+            };
+            permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
+            const command = snapshot(fields(input, "reassess follow-up bundle", [
                 "ticketId",
                 "workId",
                 "commandId",
                 "correlationId",
-                "mode",
                 "expectedWorkGeneration",
-                "candidateHash",
-                "exactBundle",
-                "checksReceipt",
-                "checkPolicyVersion",
-            ], ["recoveryIntentHash"]));
-            if (command.mode !== "prepare" && command.mode !== "staff_reassessment")
-                throw new TypeError("Invalid follow-up preparation mode");
-            const staff = command.mode === "staff_reassessment";
-            const authorize = () => permission(access, staff
-                ? supportPermissions.engineeringFollowupReview
-                : supportPermissions.engineeringFollowupProcess, actorId, staff);
-            authorize();
+                "recoveryIntentHash",
+            ]));
             for (const entry of [
                 command.ticketId,
                 command.workId,
                 command.commandId,
                 command.correlationId,
-                command.candidateHash,
-                command.checksReceipt,
-                command.checkPolicyVersion,
             ])
-                text(entry, "bundle preparation identity");
+                text(entry, "reassessment identity");
             integer(command.expectedWorkGeneration, "expectedWorkGeneration", 1);
-            validateEngineeringFollowupBundle(command.exactBundle);
-            if (command.recoveryIntentHash !== undefined &&
-                (!staff || !/^[a-f0-9]{64}$/.test(command.recoveryIntentHash)))
-                throw new TypeError("Invalid preparation recovery intent");
-            const hash = await fingerprint({ actorId, command });
-            const recoveryFingerprint = command.recoveryIntentHash === undefined
-                ? undefined
-                : await fingerprint({
-                    actorId,
-                    intentHash: command.recoveryIntentHash,
-                });
+            if (!/^[a-f0-9]{64}$/.test(command.recoveryIntentHash))
+                throw new TypeError("Invalid reassessment recovery intent");
+            const recovery = {
+                ticketId: command.ticketId,
+                workId: command.workId,
+                commandId: command.commandId,
+                recoveryIntentHash: command.recoveryIntentHash,
+            };
+            const recover = () => application.recoverEngineeringFollowupPreparation(access, recovery);
+            const mutation = engineeringMutationBoundary(control);
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const previous = await replay(command, hash);
+                const accepted = await recover();
+                if (accepted !== null)
+                    return accepted;
+                mutation?.ensure();
                 authorize();
-                if (previous !== null) {
-                    if (!("status" in previous))
-                        throw new SupportDeskConflictError("Wrong follow-up receipt kind");
-                    return previous;
-                }
-                if (typeof guard !== "function")
-                    throw new TypeError("Follow-up bundle preparation needs a current read-only guard");
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
-                const work = stored.value;
-                if (work.workGeneration !== command.expectedWorkGeneration ||
-                    work.candidateHash !== command.candidateHash ||
-                    work.withdrawn ||
-                    work.status === "delivered" ||
-                    work.security !== "ordinary")
-                    throw new SupportDeskConflictError("Follow-up bundle source, candidate or generation changed");
-                if (!staff && timestamp(work.deadline, "deadline") <= now())
-                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
-                if (work.bundleRevision >= options.maxBundleRevisions)
-                    throw new SupportDeskConflictError("Follow-up bundle preparation bound reached");
-                const rearm = staff
-                    ? await sourceServices.internal.reassessment(command, now)
-                    : null;
-                const current = staff
-                    ? null
-                    : await engineeringFollowupCurrent(deps, loaded, stored, now);
-                if (!staff &&
-                    (work.stage !== "bundle" ||
-                        work.candidate === undefined ||
-                        work.completionRows !== 5 ||
-                        work.messageSlots !== 1))
-                    throw new SupportDeskConflictError("Follow-up bundle preparation needs its current model candidate");
-                if (rearm !== null &&
-                    (rearm.work.version !== stored.version ||
-                        rearm.loaded.ticket.version !== loaded.ticket.version ||
-                        rearm.loaded.source.version !== loaded.source.version ||
-                        rearm.loaded.head?.version !== loaded.head?.version))
-                    continue;
-                const base = rearm === null
-                    ? work
-                    : {
-                        ...work,
-                        ...rearm.prospective,
-                        workBindingHash: rearm.prospectiveWorkBindingHash,
-                    };
-                const checked = await verifyBundle(base, command.exactBundle, command.candidateHash, command.checkPolicyVersion, command.checksReceipt, now);
-                const { candidate: _candidate, ...retained } = withoutLease(base);
-                const next = {
-                    ...retained,
-                    stage: "bundle",
-                    status: "bundle_prepared",
-                    completionRows: 3,
-                    messageSlots: 1,
-                    deadline: staff
-                        ? new Date(now() + options.maxWorkMilliseconds).toISOString()
-                        : work.deadline,
-                    workGeneration: work.workGeneration + 1,
-                    bundleRevision: work.bundleRevision + 1,
-                    preparedBundle: {
-                        bundle: command.exactBundle,
-                        bundleHash: checked.binding.bundleHash,
-                        candidateHash: command.candidateHash,
-                        binding: checked.binding,
-                        checksReceipt: command.checksReceipt,
-                    },
-                };
-                reserveEngineeringFollowupReachable(next);
-                const cohort = rearm === null
-                    ? { actions: [], nextWorkRows: [] }
-                    : await planEngineeringFollowupContextChange(records, {
-                        rows: loaded.rows,
-                        context: rearm.proof.context,
-                        previousHead: loaded.head.value,
-                        nextHead: rearm.nextHead,
-                        excludedWorkId: work.workId,
-                    });
-                deps.admission(loaded.ticket.value.ticket, loaded.rows, [next, ...cohort.nextWorkRows], 2);
-                await guard();
-                const proof = rearm?.proof ?? current.proof;
-                const associationWork = rearm?.engineeringWork ?? current.engineeringWork;
-                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associationWork)))
-                    continue;
+                // Eligibility and private Source authority precede any protected hydration.
+                const source = await records.getVersioned(engineeringSourceKey(command.ticketId));
                 authorize();
-                if (!staff && timestamp(work.deadline, "deadline") <= now())
-                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
-                if (now() >=
-                    Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
-                    throw new SupportDeskConflictError("Follow-up bundle proof expired");
-                const outcome = result(next);
-                if (await save(loaded, stored, next, [
-                    ...cohort.actions,
-                    deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), staff
-                        ? supportTicketAuditActions.engineeringFollowupReassessed
-                        : supportTicketAuditActions.engineeringFollowupBundlePrepared),
-                    receipt(command, hash, outcome, recoveryFingerprint),
-                ], rearm?.nextHead ?? loaded.head.value)) {
+                if (source?.value.kind !== "engineering_source")
+                    throw new SupportDeskNotFoundError();
+                if (source.value.security !== "ordinary")
+                    permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                if (source.value.security !== "ordinary" ||
+                    source.value.state === "withdrawn")
+                    throw new SupportDeskConflictError("Follow-up Source is ineligible");
+                try {
+                    const current = await sourceServices.internal.reassessment(command, now, "bundle", undefined, (source) => {
+                        authorize();
+                        if (source !== undefined) {
+                            if (source.security !== "ordinary")
+                                permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                            if (source.security !== "ordinary" ||
+                                source.state === "withdrawn")
+                                throw new SupportDeskConflictError("Follow-up Source is ineligible");
+                        }
+                    }, { value: source.value, version: source.version });
+                    // The initial external release proof cannot make the original Source current.
+                    const confirmedSource = await records.getVersioned(engineeringSourceKey(command.ticketId));
                     authorize();
-                    return outcome;
+                    if (confirmedSource?.value.kind !== "engineering_source")
+                        throw new SupportDeskNotFoundError();
+                    if (confirmedSource.value.security !== "ordinary")
+                        permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                    if (confirmedSource.version !== source.version)
+                        throw new SupportDeskConflictError("Follow-up Source changed during release verification");
+                    if (current.work.value.workGeneration !== command.expectedWorkGeneration)
+                        throw new SupportDeskConflictError("Follow-up reassessment generation changed");
+                    const scope = engineeringFollowupObservation(deps, current, actorId, authorize);
+                    const observation = Object.freeze({
+                        read(reader) {
+                            scope.check(reader);
+                            if (now() >=
+                                timestamp(current.proof.attestation.validUntil, "validUntil"))
+                                throw new SupportDeskConflictError("Follow-up reassessment expired");
+                            return snapshot({
+                                work: current.work.value,
+                                proofContext: current.proofContext,
+                                proof: current.proof,
+                                prospectiveWorkBindingHash: current.prospectiveWorkBindingHash,
+                                workGeneration: current.work.value.workGeneration,
+                            });
+                        },
+                        confirm: scope.confirm,
+                    });
+                    try {
+                        if (typeof planner !== "function")
+                            throw new TypeError("Follow-up reassessment needs a read-only planner");
+                        const planned = await planner(observation);
+                        authorize();
+                        const checkedPlan = fields(planned, "follow-up reassessment plan", [
+                            "candidateHash",
+                            "exactBundle",
+                            "checksReceipt",
+                            "checkPolicyVersion",
+                            "guard",
+                        ]);
+                        const guard = checkedPlan.guard;
+                        if (typeof guard !== "function")
+                            throw new TypeError("Follow-up reassessment guard must be callable");
+                        const plan = snapshot({
+                            candidateHash: checkedPlan.candidateHash,
+                            exactBundle: checkedPlan.exactBundle,
+                            checksReceipt: checkedPlan.checksReceipt,
+                            checkPolicyVersion: checkedPlan.checkPolicyVersion,
+                        });
+                        // Functions never enter the immutable command or an accepted receipt.
+                        return await prepareBundle(access, {
+                            ...command,
+                            mode: "staff_reassessment",
+                            candidateHash: plan.candidateHash,
+                            exactBundle: plan.exactBundle,
+                            checksReceipt: plan.checksReceipt,
+                            checkPolicyVersion: plan.checkPolicyVersion,
+                        }, async () => {
+                            try {
+                                return await guard();
+                            }
+                            finally {
+                                scope.close();
+                            }
+                        }, undefined, { current, mutation, authorize });
+                    }
+                    finally {
+                        scope.close();
+                    }
+                }
+                catch (error) {
+                    const accepted = await recover();
+                    if (accepted !== null)
+                        return accepted;
+                    if (!(error instanceof ReassessmentRetry))
+                        throw error;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async retryEngineeringFollowupWork(access, input) {
+        async retryEngineeringFollowupWork(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const now = engineeringFollowupNow(deps);
             const command = snapshot(fields(input, "retry follow-up work", [
                 "ticketId",
@@ -827,6 +1002,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const current = await sourceServices.internal.reassessment(command, now, "model_retry");
                 const { loaded, work: stored } = current;
                 const work = stored.value;
@@ -865,17 +1041,23 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     ...cohort.actions,
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRetried),
                     receipt(command, hash, outcome),
-                ], current.nextHead)) {
+                ], current.nextHead, mutation, () => {
+                    authorize();
+                    if (now() >=
+                        Math.min(timestamp(current.proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                        throw new SupportDeskConflictError("Follow-up recovery proof expired");
+                })) {
                     authorize();
                     return outcome;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async abandonEngineeringFollowupWork(access, input) {
+        async abandonEngineeringFollowupWork(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "abandon follow-up work", [
                 "ticketId",
                 "workId",
@@ -902,6 +1084,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const loaded = await load(command.ticketId);
                 const stored = await workAt(command);
                 const work = stored.value;
@@ -916,17 +1099,18 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next, [
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupAbandoned),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, authorize)) {
                     authorize();
                     return outcome;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async rejectEngineeringFollowupBundle(access, input) {
+        async rejectEngineeringFollowupBundle(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "reject follow-up bundle", [
                 "ticketId",
                 "workId",
@@ -955,6 +1139,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const loaded = await load(command.ticketId);
                 const stored = await workAt(command);
                 const work = stored.value;
@@ -970,7 +1155,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next, [
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRejected),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, authorize)) {
                     authorize();
                     return outcome;
                 }