@pegma/support-desk-application 0.2.7 → 0.2.9

package/dist/engineering-followup-work.js

@@ -1,7 +1,9 @@
+import { engineeringMutationBoundary, } from "./engineering-mutation-guard.js";
 import { SupportDeskConflictError, SupportDeskNotFoundError, supportPermissions, supportTicketAuditActions, } from "./index.js";
 import { canonical, fields, fingerprint, integer, text, timestamp, } from "./assistant-turn-records.js";
 import { safeEngineeringFollowupSnapshot as snapshot, checkEngineeringFollowupRecordCapacity, reserveEngineeringFollowupReachable, engineeringFollowupWorkKey, engineeringFollowupCommandKey, validateEngineeringFollowupCandidate, validateEngineeringFollowupBundle, validateEngineeringFollowupModelBinding, engineeringFollowupModelManifestHash, engineeringFollowupContextHash, engineeringFollowupPublicFactsHash, engineeringFollowupChecksBinding, engineeringFollowupRetestProductBinding, engineeringFollowupRetestRequestHash, engineeringFollowupRetestRequestId, engineeringFollowupRetestSummary, engineeringFollowupModelAttemptCount, } from "./engineering-followup-records.js";
-import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
+import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupObservation, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupActive, engineeringFollowupLoadMutation, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
+import { engineeringSourceKey } from "./engineering-records.js";
 function validateFence(command) {
     for (const value of [
         command.ticketId,
@@ -71,11 +73,17 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             throw new SupportDeskNotFoundError();
         return { value: work.value, version: work.version };
     }
-    async function save(loaded, work, next, extra = [], nextHead = loaded.head?.value) {
+    async function save(loaded, work, next, extra = [], nextHead = loaded.head?.value, mutation, beforeCommit) {
         if (loaded.head === null || nextHead === undefined)
             throw new SupportDeskConflictError("Follow-up head disappeared");
         checkEngineeringFollowupRecordCapacity(next);
         checkEngineeringFollowupRecordCapacity(nextHead);
+        if (mutation !== undefined) {
+            const assertHostCurrent = await mutation.verify();
+            assertHostCurrent();
+        }
+        beforeCommit?.();
+        mutation?.ensure();
         return (await records.transact(next.ticketId, [
             {
                 action: "putIfUnchanged",
@@ -188,6 +196,395 @@ export function createEngineeringFollowupWorkServices(deps, load) {
         text(checked.verifierVersion, "verifierVersion");
         return { binding, deadline: timestamp(checked.validUntil, "validUntil") };
     }
+    class ReassessmentRetry extends Error {
+    }
+    async function prepareBundle(access, input, guard, control, initial) {
+        const actorId = access.principalId;
+        const command = snapshot(fields(input, "prepare follow-up bundle", [
+            "ticketId",
+            "workId",
+            "commandId",
+            "correlationId",
+            "mode",
+            "expectedWorkGeneration",
+            "candidateHash",
+            "exactBundle",
+            "checksReceipt",
+            "checkPolicyVersion",
+        ], ["recoveryIntentHash"]));
+        if (command.mode !== "prepare" && command.mode !== "staff_reassessment")
+            throw new TypeError("Invalid follow-up preparation mode");
+        const staff = command.mode === "staff_reassessment";
+        const authorize = () => {
+            initial?.authorize();
+            permission(access, staff
+                ? supportPermissions.engineeringFollowupReview
+                : supportPermissions.engineeringFollowupProcess, actorId, staff);
+        };
+        authorize();
+        const mutation = initial?.mutation ?? engineeringMutationBoundary(control);
+        for (const entry of [
+            command.ticketId,
+            command.workId,
+            command.commandId,
+            command.correlationId,
+            command.candidateHash,
+            command.checksReceipt,
+            command.checkPolicyVersion,
+        ])
+            text(entry, "bundle preparation identity");
+        integer(command.expectedWorkGeneration, "expectedWorkGeneration", 1);
+        validateEngineeringFollowupBundle(command.exactBundle);
+        if (command.recoveryIntentHash !== undefined &&
+            (!staff || !/^[a-f0-9]{64}$/.test(command.recoveryIntentHash)))
+            throw new TypeError("Invalid preparation recovery intent");
+        const hash = await fingerprint({ actorId, command });
+        const recoveryFingerprint = command.recoveryIntentHash === undefined
+            ? undefined
+            : await fingerprint({
+                actorId,
+                intentHash: command.recoveryIntentHash,
+            });
+        const now = engineeringFollowupNow(deps);
+        for (let attempt = 0; attempt < (initial === undefined ? deps.maxConflictAttempts : 1); attempt += 1) {
+            const previous = await replay(command, hash);
+            authorize();
+            if (previous !== null) {
+                if (!("status" in previous))
+                    throw new SupportDeskConflictError("Wrong follow-up receipt kind");
+                return previous;
+            }
+            if (typeof guard !== "function")
+                throw new TypeError("Follow-up bundle preparation needs a current read-only guard");
+            mutation?.ensure();
+            const { loaded, stored } = initial !== undefined
+                ? { loaded: initial.current.loaded, stored: initial.current.work }
+                : staff
+                    ? {
+                        loaded: await load(command.ticketId),
+                        stored: await workAt(command),
+                    }
+                    : await engineeringFollowupLoadMutation(deps, command);
+            const work = stored.value;
+            if (work.workGeneration !== command.expectedWorkGeneration ||
+                work.candidateHash !== command.candidateHash ||
+                work.withdrawn ||
+                work.status === "delivered" ||
+                work.security !== "ordinary")
+                throw new SupportDeskConflictError("Follow-up bundle source, candidate or generation changed");
+            if (!staff && timestamp(work.deadline, "deadline") <= now())
+                throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+            if (work.bundleRevision >= options.maxBundleRevisions)
+                throw new SupportDeskConflictError("Follow-up bundle preparation bound reached");
+            const rearm = staff
+                ? await sourceServices.internal.reassessment(command, now, "bundle", initial?.current, initial === undefined ? undefined : () => initial.authorize())
+                : null;
+            const current = staff
+                ? null
+                : await engineeringFollowupActive(deps, loaded, stored, now);
+            if (!staff &&
+                (work.stage !== "bundle" ||
+                    work.candidate === undefined ||
+                    work.completionRows !== 5 ||
+                    work.messageSlots !== 1))
+                throw new SupportDeskConflictError("Follow-up bundle preparation needs its current model candidate");
+            if (rearm !== null &&
+                (rearm.work.version !== stored.version ||
+                    rearm.loaded.ticket.version !== loaded.ticket.version ||
+                    rearm.loaded.source.version !== loaded.source.version ||
+                    rearm.loaded.head?.version !== loaded.head?.version)) {
+                if (initial !== undefined)
+                    throw new ReassessmentRetry();
+                continue;
+            }
+            const base = rearm === null
+                ? work
+                : {
+                    ...work,
+                    ...rearm.prospective,
+                    workBindingHash: rearm.prospectiveWorkBindingHash,
+                };
+            const checked = await verifyBundle(base, command.exactBundle, command.candidateHash, command.checkPolicyVersion, command.checksReceipt, now);
+            const { candidate: _candidate, ...retained } = withoutLease(base);
+            const next = {
+                ...retained,
+                stage: "bundle",
+                status: "bundle_prepared",
+                completionRows: 3,
+                messageSlots: 1,
+                deadline: staff
+                    ? new Date(now() + options.maxWorkMilliseconds).toISOString()
+                    : work.deadline,
+                workGeneration: work.workGeneration + 1,
+                bundleRevision: work.bundleRevision + 1,
+                preparedBundle: {
+                    bundle: command.exactBundle,
+                    bundleHash: checked.binding.bundleHash,
+                    candidateHash: command.candidateHash,
+                    binding: checked.binding,
+                    checksReceipt: command.checksReceipt,
+                },
+            };
+            reserveEngineeringFollowupReachable(next);
+            const cohort = rearm === null
+                ? { actions: [], nextWorkRows: [] }
+                : await planEngineeringFollowupContextChange(records, {
+                    rows: loaded.rows,
+                    context: rearm.proof.context,
+                    previousHead: loaded.head.value,
+                    nextHead: rearm.nextHead,
+                    excludedWorkId: work.workId,
+                });
+            deps.admission(loaded.ticket.value.ticket, loaded.rows, [next, ...cohort.nextWorkRows], 2);
+            // Source/association admission precedes receipt callbacks. The release
+            // proof is deliberately fresh AFTER verifyBundle, at the late guard's
+            // original release-observation boundary rather than reused across it.
+            const proof = rearm?.proof ?? (await lateBundleProof(stored, current, now));
+            if (staff)
+                await guard();
+            else
+                await bundleGuard(access, work, proof, guard, authorize, now);
+            const associationWork = rearm?.engineeringWork ?? current.engineeringWork;
+            if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associationWork))) {
+                if (initial !== undefined)
+                    throw new ReassessmentRetry();
+                continue;
+            }
+            authorize();
+            if (!staff && timestamp(work.deadline, "deadline") <= now())
+                throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+            if (now() >=
+                Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                throw new SupportDeskConflictError("Follow-up bundle proof expired");
+            const outcome = result(next);
+            if (await save(loaded, stored, next, [
+                ...cohort.actions,
+                deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), staff
+                    ? supportTicketAuditActions.engineeringFollowupReassessed
+                    : supportTicketAuditActions.engineeringFollowupBundlePrepared),
+                receipt(command, hash, outcome, recoveryFingerprint),
+            ], rearm?.nextHead ?? loaded.head.value, mutation, () => {
+                authorize();
+                if (!staff && timestamp(work.deadline, "deadline") <= now())
+                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
+                if (now() >=
+                    Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                    throw new SupportDeskConflictError("Follow-up bundle proof expired");
+            })) {
+                authorize();
+                return outcome;
+            }
+        }
+        if (initial !== undefined)
+            throw new ReassessmentRetry();
+        throw new SupportDeskConflictError();
+    }
+    async function lateBundleProof(stored, current, now) {
+        if (options.releaseEvidence === undefined)
+            throw new SupportDeskConflictError("Follow-up release verification unavailable");
+        const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(stored.value.context, current.proofContext, signal)));
+        engineeringFollowupValidateProof(proof, current.proofContext, current.engineeringWork.value.product, now);
+        if (canonical(proof.context) !== canonical(stored.value.context) ||
+            proof.context.mapping === undefined ||
+            proof.context.deploymentHead.state !== "deployed" ||
+            timestamp(stored.value.deadline, "deadline") <= now())
+            throw new SupportDeskConflictError("Follow-up deployment changed");
+        return proof;
+    }
+    async function bundleGuard(access, work, proof, guard, authorize, now) {
+        const actorId = access.principalId;
+        let active = true;
+        const check = (reader) => {
+            if (!active)
+                throw new SupportDeskConflictError("Follow-up observation expired");
+            authorize();
+            permission(reader, supportPermissions.engineeringFollowupRead, actorId, true);
+            if (now() >=
+                Math.min(timestamp(proof.attestation.validUntil, "validUntil"), timestamp(work.deadline, "deadline")))
+                throw new SupportDeskConflictError("Follow-up bundle observation expired");
+        };
+        function detached(value) {
+            const copy = snapshot(value);
+            function freeze(item) {
+                if (item === null || typeof item !== "object")
+                    return;
+                for (const child of Object.values(item))
+                    freeze(child);
+                Object.freeze(item);
+            }
+            freeze(copy);
+            return copy;
+        }
+        const observation = Object.freeze({
+            readWork(reader) {
+                check(reader);
+                return detached(work);
+            },
+            readProof(reader) {
+                check(reader);
+                return detached(proof);
+            },
+        });
+        try {
+            await guard(observation);
+        }
+        finally {
+            active = false;
+        }
+    }
+    async function modelGuard(access, work, proof, guard) {
+        if (typeof guard !== "function")
+            throw new TypeError("Follow-up invocation needs a current guard");
+        const actorId = access.principalId;
+        let active = true;
+        const check = (current) => {
+            if (!active)
+                throw new SupportDeskConflictError("Follow-up observation expired");
+            permission(current, supportPermissions.engineeringFollowupRead, actorId);
+            permission(current, supportPermissions.queueRead, actorId);
+        };
+        function freeze(value) {
+            if (value === null || typeof value !== "object")
+                return;
+            for (const item of Object.values(value))
+                freeze(item);
+            Object.freeze(value);
+        }
+        try {
+            await guard(Object.freeze({
+                readWork(current) {
+                    check(current);
+                    return snapshot(work);
+                },
+                readProof(current) {
+                    check(current);
+                    const detached = snapshot(proof);
+                    freeze(detached);
+                    return detached;
+                },
+            }));
+        }
+        finally {
+            active = false;
+        }
+    }
+    async function prepareModel(access, input, staged = false, guard) {
+        const actorId = access.principalId;
+        const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
+        authorize();
+        const command = snapshot(fields(input, "prepare follow-up model", [
+            "ticketId",
+            "workId",
+            "workerId",
+            "claimId",
+            "claimGeneration",
+            "binding",
+        ]));
+        validateFence(command);
+        validateEngineeringFollowupModelBinding(command.binding);
+        if ((command.binding.staged !== undefined) !== staged)
+            throw new TypeError("Follow-up preparation mode differs from binding");
+        const now = engineeringFollowupNow(deps);
+        if (!options.enabled)
+            throw new SupportDeskConflictError("Follow-up model processing disabled");
+        for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
+            const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
+            const work = stored.value;
+            live(work, command, now());
+            const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
+            const binding = command.binding;
+            const manifest = binding.inputManifest;
+            if (work.stage !== "model" ||
+                work.candidate !== undefined ||
+                work.preparedBundle !== undefined ||
+                work.completionRows !== 5 ||
+                work.messageSlots !== 1 ||
+                manifest.workBindingHash !== work.workBindingHash ||
+                manifest.contextHash !==
+                    (await engineeringFollowupContextHash(work.context)) ||
+                manifest.publicFactsHash !==
+                    (await engineeringFollowupPublicFactsHash(current.proof.publicFacts)) ||
+                binding.inputManifestHash !==
+                    (await engineeringFollowupModelManifestHash(manifest)) ||
+                manifest.messages.some((reference) => !loaded.rows.some((row) => row.kind === "message" &&
+                    row.message.visibility === "customer" &&
+                    row.message.id === reference.messageId &&
+                    row.ordinal === reference.ordinal &&
+                    row.ordinal <= work.acceptedTicketRevision)))
+                throw new SupportDeskConflictError("Follow-up model manifest differs from current facts");
+            const deadline = timestamp(binding.deadline, "model.deadline");
+            if (deadline <= now() ||
+                deadline > timestamp(work.deadline, "deadline") ||
+                (!staged && deadline > timestamp(work.leaseUntil, "leaseUntil")))
+                throw new SupportDeskConflictError("Follow-up model deadline exceeds live claim");
+            const existing = work.modelAttempts.find((entry) => canonical(entry.binding) === canonical(binding));
+            if (existing !== undefined) {
+                if (existing.preparedClaimGeneration !== command.claimGeneration ||
+                    existing.stepId !== work.stepId)
+                    throw new SupportDeskConflictError("Follow-up preparation belongs to another physical invocation");
+                if (staged)
+                    await modelGuard(access, work, current.proof, guard);
+                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                    continue;
+                authorize();
+                live(work, command, now());
+                if (now() >=
+                    Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model proof expired");
+                if (await save(loaded, stored, work)) {
+                    authorize();
+                    return {
+                        stepId: existing.stepId,
+                        requestHash: existing.requestHash,
+                        maxCandidateBytes: 16_000,
+                    };
+                }
+                continue;
+            }
+            if (engineeringFollowupModelAttemptCount(work) >=
+                options.maxModelAttempts ||
+                work.modelAttempts.some((entry) => entry.preparedClaimGeneration === command.claimGeneration))
+                throw new SupportDeskConflictError("Follow-up paid attempt bound reached");
+            const requestHash = await fingerprint(binding);
+            const stepId = await fingerprint({
+                workId: work.workId,
+                claimGeneration: command.claimGeneration,
+                binding,
+            });
+            const next = {
+                ...compactModelAttempts(staged ? withoutLease(work) : work),
+                status: staged ? "retry" : "model_prepared",
+                stepId,
+                requestHash,
+                workGeneration: work.workGeneration + 1,
+                modelAttempts: [
+                    {
+                        preparedClaimGeneration: command.claimGeneration,
+                        stepId,
+                        requestHash,
+                        binding,
+                        accounting: staged ? "not_called" : "unknown",
+                        ...(staged ? { callState: "not_called" } : {}),
+                    },
+                ],
+            };
+            reserveEngineeringFollowupReachable(next);
+            if (staged)
+                await modelGuard(access, work, current.proof, guard);
+            if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                continue;
+            authorize();
+            live(work, command, now());
+            if (now() >=
+                Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
+                throw new SupportDeskConflictError("Follow-up model proof expired");
+            if (await save(loaded, stored, next)) {
+                authorize();
+                return { stepId, requestHash, maxCandidateBytes: 16_000 };
+            }
+        }
+        throw new SupportDeskConflictError();
+    }
     const application = {
         async claimEngineeringFollowupWork(access, input) {
             const actorId = access.principalId;
@@ -212,8 +609,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 return null;
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if ([
                     "held",
@@ -271,6 +667,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next)) {
                     authorize();
                     return {
+                        bundleObservation: true,
                         fence: snapshot(next.claim),
                         sourceFence: {
                             ticketId: work.ticketId,
@@ -288,113 +685,173 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             }
             throw new SupportDeskConflictError();
         },
-        async prepareEngineeringFollowupModel(access, input) {
+        prepareEngineeringFollowupModel(access, input) {
+            return prepareModel(access, input);
+        },
+        planEngineeringFollowupModel(access, input, guard) {
+            return prepareModel(access, input, true, guard);
+        },
+        async beginEngineeringFollowupModel(access, input, guard) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
             authorize();
-            const command = snapshot(fields(input, "prepare follow-up model", [
+            const command = snapshot(fields(input, "begin follow-up model", [
                 "ticketId",
                 "workId",
                 "workerId",
                 "claimId",
                 "claimGeneration",
-                "binding",
+                "stepId",
+                "requestHash",
             ]));
             validateFence(command);
-            validateEngineeringFollowupModelBinding(command.binding);
-            const now = engineeringFollowupNow(deps);
+            text(command.stepId, "stepId");
+            text(command.requestHash, "requestHash");
             if (!options.enabled)
                 throw new SupportDeskConflictError("Follow-up model processing disabled");
+            const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 live(work, command, now());
                 const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
-                const binding = command.binding;
-                const manifest = binding.inputManifest;
-                if (work.stage !== "model" ||
-                    work.candidate !== undefined ||
-                    work.preparedBundle !== undefined ||
-                    work.completionRows !== 5 ||
-                    work.messageSlots !== 1 ||
-                    manifest.workBindingHash !== work.workBindingHash ||
-                    manifest.contextHash !==
-                        (await engineeringFollowupContextHash(work.context)) ||
-                    manifest.publicFactsHash !==
-                        (await engineeringFollowupPublicFactsHash(current.proof.publicFacts)) ||
-                    binding.inputManifestHash !==
-                        (await engineeringFollowupModelManifestHash(manifest)) ||
-                    manifest.messages.some((reference) => !loaded.rows.some((row) => row.kind === "message" &&
-                        row.message.visibility === "customer" &&
-                        row.message.id === reference.messageId &&
-                        row.ordinal === reference.ordinal &&
-                        row.ordinal <= work.acceptedTicketRevision)))
-                    throw new SupportDeskConflictError("Follow-up model manifest differs from current facts");
-                const deadline = timestamp(binding.deadline, "model.deadline");
-                if (deadline <= now() ||
-                    deadline > timestamp(work.deadline, "deadline") ||
-                    deadline > timestamp(work.leaseUntil, "leaseUntil"))
-                    throw new SupportDeskConflictError("Follow-up model deadline exceeds live claim");
-                const existing = work.modelAttempts.find((entry) => canonical(entry.binding) === canonical(binding));
-                if (existing !== undefined) {
-                    if (existing.preparedClaimGeneration !== command.claimGeneration ||
-                        existing.stepId !== work.stepId)
-                        throw new SupportDeskConflictError("Follow-up preparation belongs to another physical invocation");
-                    if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
-                        continue;
+                const model = work.modelAttempts.find((entry) => entry.stepId === command.stepId &&
+                    entry.requestHash === command.requestHash);
+                if (model?.binding.staged === undefined ||
+                    work.stepId !== command.stepId ||
+                    work.requestHash !== command.requestHash ||
+                    work.stage !== "model" ||
+                    work.pendingModelCompletion !== undefined)
+                    throw new SupportDeskConflictError("Follow-up model plan changed");
+                if (model.callState !== "not_called" ||
+                    model.accounting !== "not_called") {
                     authorize();
-                    live(work, command, now());
-                    if (now() >=
-                        Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
-                        throw new SupportDeskConflictError("Follow-up model proof expired");
-                    if (await save(loaded, stored, work)) {
-                        authorize();
-                        return {
-                            stepId: existing.stepId,
-                            requestHash: existing.requestHash,
-                            maxCandidateBytes: 16_000,
-                        };
-                    }
-                    continue;
+                    return {
+                        stepId: model.stepId,
+                        requestHash: model.requestHash,
+                        maxCandidateBytes: 16_000,
+                        callPermit: false,
+                    };
                 }
-                if (engineeringFollowupModelAttemptCount(work) >=
-                    options.maxModelAttempts ||
-                    work.modelAttempts.some((entry) => entry.preparedClaimGeneration === command.claimGeneration))
-                    throw new SupportDeskConflictError("Follow-up paid attempt bound reached");
-                const requestHash = await fingerprint(binding);
-                const stepId = await fingerprint({
-                    workId: work.workId,
-                    claimGeneration: command.claimGeneration,
-                    binding,
-                });
                 const next = {
-                    ...compactModelAttempts(work),
+                    ...work,
                     status: "model_prepared",
-                    stepId,
-                    requestHash,
                     workGeneration: work.workGeneration + 1,
-                    modelAttempts: [
-                        {
+                    modelAttempts: work.modelAttempts.map((entry) => entry !== model
+                        ? entry
+                        : {
+                            ...entry,
                             preparedClaimGeneration: command.claimGeneration,
-                            stepId,
-                            requestHash,
-                            binding,
+                            callState: "possibly_called",
                             accounting: "unknown",
-                        },
-                    ],
+                        }),
                 };
-                reserveEngineeringFollowupReachable(next);
+                checkEngineeringFollowupRecordCapacity(next);
+                await modelGuard(access, work, current.proof, guard);
                 if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
                     continue;
                 authorize();
                 live(work, command, now());
                 if (now() >=
-                    Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
-                    throw new SupportDeskConflictError("Follow-up model proof expired");
+                    Math.min(timestamp(model.binding.deadline, "model.deadline"), timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model plan expired");
                 if (await save(loaded, stored, next)) {
                     authorize();
-                    return { stepId, requestHash, maxCandidateBytes: 16_000 };
+                    return {
+                        stepId: model.stepId,
+                        requestHash: model.requestHash,
+                        maxCandidateBytes: 16_000,
+                        callPermit: true,
+                    };
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async recordEngineeringFollowupModel(access, input, guard) {
+            const actorId = access.principalId;
+            const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
+            authorize();
+            const command = snapshot(fields(input, "record follow-up model", [
+                "ticketId",
+                "workId",
+                "workerId",
+                "claimId",
+                "claimGeneration",
+                "stepId",
+                "requestHash",
+                "candidate",
+                "accounting",
+            ], ["processing"]));
+            validateFence(command);
+            text(command.stepId, "stepId");
+            text(command.requestHash, "requestHash");
+            validateEngineeringFollowupCandidate(command.candidate);
+            processing(command.processing);
+            if (!["accounted", "unknown"].includes(command.accounting))
+                throw new TypeError("Invalid follow-up accounting");
+            const hash = await fingerprint({ actorId, command });
+            const now = engineeringFollowupNow(deps);
+            for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
+                const work = stored.value;
+                if (work.lastModelRecord?.fingerprint === hash) {
+                    authorize();
+                    return snapshot(work.lastModelRecord.result);
+                }
+                if (!options.enabled)
+                    throw new SupportDeskConflictError("Follow-up model processing disabled");
+                live(work, command, now());
+                const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
+                const model = work.modelAttempts.find((entry) => entry.stepId === command.stepId &&
+                    entry.requestHash === command.requestHash);
+                if (model?.binding.staged === undefined ||
+                    model.callState !== "possibly_called" ||
+                    model.preparedClaimGeneration !== command.claimGeneration ||
+                    work.stepId !== command.stepId ||
+                    work.requestHash !== command.requestHash ||
+                    work.stage !== "model" ||
+                    work.pendingModelCompletion !== undefined)
+                    throw new SupportDeskConflictError("Follow-up model invocation changed");
+                const next = {
+                    ...withoutLease(work),
+                    status: "retry",
+                    workGeneration: work.workGeneration + 1,
+                    pendingModelCompletion: {
+                        stepId: command.stepId,
+                        requestHash: command.requestHash,
+                        candidate: command.candidate,
+                        accounting: command.accounting,
+                        ...(command.processing === undefined
+                            ? {}
+                            : { processing: command.processing }),
+                    },
+                    modelAttempts: work.modelAttempts.map((entry) => entry !== model
+                        ? entry
+                        : {
+                            ...entry,
+                            callState: "recorded",
+                            accounting: command.accounting,
+                            ...(command.processing === undefined
+                                ? {}
+                                : { processing: command.processing }),
+                        }),
+                };
+                const accepted = {
+                    ...next,
+                    lastModelRecord: { fingerprint: hash, result: result(next) },
+                };
+                checkEngineeringFollowupRecordCapacity(accepted);
+                await modelGuard(access, work, current.proof, guard);
+                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                    continue;
+                authorize();
+                live(work, command, now());
+                if (now() >=
+                    Math.min(timestamp(model.binding.deadline, "model.deadline"), timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model result expired");
+                if (await save(loaded, stored, accepted)) {
+                    authorize();
+                    return result(next);
                 }
             }
             throw new SupportDeskConflictError();
@@ -424,8 +881,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             const hash = await fingerprint({ actorId, command });
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.lastCompletion?.fingerprint === hash) {
                     authorize();
@@ -437,12 +893,27 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     entry.requestHash === command.requestHash);
                 if (work.stage !== "model" ||
                     model === undefined ||
-                    model.preparedClaimGeneration !== command.claimGeneration ||
+                    (model.preparedClaimGeneration !== command.claimGeneration &&
+                        work.pendingModelCompletion === undefined) ||
                     work.stepId !== command.stepId ||
                     work.requestHash !== command.requestHash)
                     throw new SupportDeskConflictError("Follow-up prepared model owner changed");
+                if (model.binding.staged !== undefined &&
+                    (model.callState !== "recorded" ||
+                        canonical(work.pendingModelCompletion) !==
+                            canonical({
+                                stepId: command.stepId,
+                                requestHash: command.requestHash,
+                                candidate: command.candidate,
+                                accounting: command.accounting,
+                                ...(command.processing === undefined
+                                    ? {}
+                                    : { processing: command.processing }),
+                            })))
+                    throw new SupportDeskConflictError("Follow-up recorded model result changed");
+                const { pendingModelCompletion: _pendingCompletion, ...retained } = withoutLease(work);
                 const next = compactModelAttempts({
-                    ...withoutLease(work),
+                    ...retained,
                     status: "candidate",
                     stage: "bundle",
                     candidate: command.candidate,
@@ -463,7 +934,10 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     lastCompletion: { fingerprint: hash, result: result(next) },
                 };
                 checkEngineeringFollowupRecordCapacity(accepted);
-                await guard();
+                if (model.binding.staged === undefined)
+                    await guard();
+                else
+                    await modelGuard(access, work, current.proof, guard);
                 if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
                     continue;
                 authorize();
@@ -524,8 +998,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 throw new TypeError("Historical restriction cannot change accounting");
             const hash = await fingerprint({ actorId, command });
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.lastFinish?.fingerprint === hash) {
                     authorize();
@@ -590,6 +1063,10 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                                     throw new SupportDeskConflictError("Cannot rewrite another follow-up invocation's accounting");
                                 return entry;
                             }
+                            if (entry.callState !== undefined &&
+                                entry.callState !== "not_called" &&
+                                command.accounting === "not_called")
+                                throw new SupportDeskConflictError("A possibly called follow-up cannot become not-called");
                             if (entry.accounting !== "unknown" &&
                                 command.accounting !== undefined &&
                                 entry.accounting !== command.accounting)
@@ -649,159 +1126,155 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 throw new SupportDeskConflictError("Follow-up recovery identity does not match accepted preparation");
             return snapshot(prior.result);
         },
-        async prepareEngineeringFollowupBundle(access, input, guard) {
+        async prepareEngineeringFollowupBundle(access, input, guard, control) {
+            return prepareBundle(access, input, guard, control);
+        },
+        async reassessEngineeringFollowupBundle(access, input, planner, control) {
             const actorId = access.principalId;
-            const command = snapshot(fields(input, "prepare follow-up bundle", [
+            const authorize = (reader = access) => {
+                permission(reader, supportPermissions.engineeringFollowupReview, actorId, true);
+                permission(reader, supportPermissions.engineeringFollowupRead, actorId, true);
+            };
+            permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
+            const command = snapshot(fields(input, "reassess follow-up bundle", [
                 "ticketId",
                 "workId",
                 "commandId",
                 "correlationId",
-                "mode",
                 "expectedWorkGeneration",
-                "candidateHash",
-                "exactBundle",
-                "checksReceipt",
-                "checkPolicyVersion",
-            ], ["recoveryIntentHash"]));
-            if (command.mode !== "prepare" && command.mode !== "staff_reassessment")
-                throw new TypeError("Invalid follow-up preparation mode");
-            const staff = command.mode === "staff_reassessment";
-            const authorize = () => permission(access, staff
-                ? supportPermissions.engineeringFollowupReview
-                : supportPermissions.engineeringFollowupProcess, actorId, staff);
-            authorize();
+                "recoveryIntentHash",
+            ]));
             for (const entry of [
                 command.ticketId,
                 command.workId,
                 command.commandId,
                 command.correlationId,
-                command.candidateHash,
-                command.checksReceipt,
-                command.checkPolicyVersion,
             ])
-                text(entry, "bundle preparation identity");
+                text(entry, "reassessment identity");
             integer(command.expectedWorkGeneration, "expectedWorkGeneration", 1);
-            validateEngineeringFollowupBundle(command.exactBundle);
-            if (command.recoveryIntentHash !== undefined &&
-                (!staff || !/^[a-f0-9]{64}$/.test(command.recoveryIntentHash)))
-                throw new TypeError("Invalid preparation recovery intent");
-            const hash = await fingerprint({ actorId, command });
-            const recoveryFingerprint = command.recoveryIntentHash === undefined
-                ? undefined
-                : await fingerprint({
-                    actorId,
-                    intentHash: command.recoveryIntentHash,
-                });
+            if (!/^[a-f0-9]{64}$/.test(command.recoveryIntentHash))
+                throw new TypeError("Invalid reassessment recovery intent");
+            const recovery = {
+                ticketId: command.ticketId,
+                workId: command.workId,
+                commandId: command.commandId,
+                recoveryIntentHash: command.recoveryIntentHash,
+            };
+            const recover = () => application.recoverEngineeringFollowupPreparation(access, recovery);
+            const mutation = engineeringMutationBoundary(control);
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const previous = await replay(command, hash);
+                const accepted = await recover();
+                if (accepted !== null)
+                    return accepted;
+                mutation?.ensure();
                 authorize();
-                if (previous !== null) {
-                    if (!("status" in previous))
-                        throw new SupportDeskConflictError("Wrong follow-up receipt kind");
-                    return previous;
-                }
-                if (typeof guard !== "function")
-                    throw new TypeError("Follow-up bundle preparation needs a current read-only guard");
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
-                const work = stored.value;
-                if (work.workGeneration !== command.expectedWorkGeneration ||
-                    work.candidateHash !== command.candidateHash ||
-                    work.withdrawn ||
-                    work.status === "delivered" ||
-                    work.security !== "ordinary")
-                    throw new SupportDeskConflictError("Follow-up bundle source, candidate or generation changed");
-                if (!staff && timestamp(work.deadline, "deadline") <= now())
-                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
-                if (work.bundleRevision >= options.maxBundleRevisions)
-                    throw new SupportDeskConflictError("Follow-up bundle preparation bound reached");
-                const rearm = staff
-                    ? await sourceServices.internal.reassessment(command, now)
-                    : null;
-                const current = staff
-                    ? null
-                    : await engineeringFollowupCurrent(deps, loaded, stored, now);
-                if (!staff &&
-                    (work.stage !== "bundle" ||
-                        work.candidate === undefined ||
-                        work.completionRows !== 5 ||
-                        work.messageSlots !== 1))
-                    throw new SupportDeskConflictError("Follow-up bundle preparation needs its current model candidate");
-                if (rearm !== null &&
-                    (rearm.work.version !== stored.version ||
-                        rearm.loaded.ticket.version !== loaded.ticket.version ||
-                        rearm.loaded.source.version !== loaded.source.version ||
-                        rearm.loaded.head?.version !== loaded.head?.version))
-                    continue;
-                const base = rearm === null
-                    ? work
-                    : {
-                        ...work,
-                        ...rearm.prospective,
-                        workBindingHash: rearm.prospectiveWorkBindingHash,
-                    };
-                const checked = await verifyBundle(base, command.exactBundle, command.candidateHash, command.checkPolicyVersion, command.checksReceipt, now);
-                const { candidate: _candidate, ...retained } = withoutLease(base);
-                const next = {
-                    ...retained,
-                    stage: "bundle",
-                    status: "bundle_prepared",
-                    completionRows: 3,
-                    messageSlots: 1,
-                    deadline: staff
-                        ? new Date(now() + options.maxWorkMilliseconds).toISOString()
-                        : work.deadline,
-                    workGeneration: work.workGeneration + 1,
-                    bundleRevision: work.bundleRevision + 1,
-                    preparedBundle: {
-                        bundle: command.exactBundle,
-                        bundleHash: checked.binding.bundleHash,
-                        candidateHash: command.candidateHash,
-                        binding: checked.binding,
-                        checksReceipt: command.checksReceipt,
-                    },
-                };
-                reserveEngineeringFollowupReachable(next);
-                const cohort = rearm === null
-                    ? { actions: [], nextWorkRows: [] }
-                    : await planEngineeringFollowupContextChange(records, {
-                        rows: loaded.rows,
-                        context: rearm.proof.context,
-                        previousHead: loaded.head.value,
-                        nextHead: rearm.nextHead,
-                        excludedWorkId: work.workId,
-                    });
-                deps.admission(loaded.ticket.value.ticket, loaded.rows, [next, ...cohort.nextWorkRows], 2);
-                await guard();
-                const proof = rearm?.proof ?? current.proof;
-                const associationWork = rearm?.engineeringWork ?? current.engineeringWork;
-                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associationWork)))
-                    continue;
+                // Eligibility and private Source authority precede any protected hydration.
+                const source = await records.getVersioned(engineeringSourceKey(command.ticketId));
                 authorize();
-                if (!staff && timestamp(work.deadline, "deadline") <= now())
-                    throw new SupportDeskConflictError("Expired follow-up requires explicit staff reassessment");
-                if (now() >=
-                    Math.min(checked.deadline, timestamp(proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
-                    throw new SupportDeskConflictError("Follow-up bundle proof expired");
-                const outcome = result(next);
-                if (await save(loaded, stored, next, [
-                    ...cohort.actions,
-                    deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), staff
-                        ? supportTicketAuditActions.engineeringFollowupReassessed
-                        : supportTicketAuditActions.engineeringFollowupBundlePrepared),
-                    receipt(command, hash, outcome, recoveryFingerprint),
-                ], rearm?.nextHead ?? loaded.head.value)) {
+                if (source?.value.kind !== "engineering_source")
+                    throw new SupportDeskNotFoundError();
+                if (source.value.security !== "ordinary")
+                    permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                if (source.value.security !== "ordinary" ||
+                    source.value.state === "withdrawn")
+                    throw new SupportDeskConflictError("Follow-up Source is ineligible");
+                try {
+                    const current = await sourceServices.internal.reassessment(command, now, "bundle", undefined, (source) => {
+                        authorize();
+                        if (source !== undefined) {
+                            if (source.security !== "ordinary")
+                                permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                            if (source.security !== "ordinary" ||
+                                source.state === "withdrawn")
+                                throw new SupportDeskConflictError("Follow-up Source is ineligible");
+                        }
+                    }, { value: source.value, version: source.version });
+                    // The initial external release proof cannot make the original Source current.
+                    const confirmedSource = await records.getVersioned(engineeringSourceKey(command.ticketId));
                     authorize();
-                    return outcome;
+                    if (confirmedSource?.value.kind !== "engineering_source")
+                        throw new SupportDeskNotFoundError();
+                    if (confirmedSource.value.security !== "ordinary")
+                        permission(access, supportPermissions.engineeringRestrictedRead, actorId, true);
+                    if (confirmedSource.version !== source.version)
+                        throw new SupportDeskConflictError("Follow-up Source changed during release verification");
+                    if (current.work.value.workGeneration !== command.expectedWorkGeneration)
+                        throw new SupportDeskConflictError("Follow-up reassessment generation changed");
+                    const scope = engineeringFollowupObservation(deps, current, actorId, authorize);
+                    const observation = Object.freeze({
+                        read(reader) {
+                            scope.check(reader);
+                            if (now() >=
+                                timestamp(current.proof.attestation.validUntil, "validUntil"))
+                                throw new SupportDeskConflictError("Follow-up reassessment expired");
+                            return snapshot({
+                                work: current.work.value,
+                                proofContext: current.proofContext,
+                                proof: current.proof,
+                                prospectiveWorkBindingHash: current.prospectiveWorkBindingHash,
+                                workGeneration: current.work.value.workGeneration,
+                            });
+                        },
+                        confirm: scope.confirm,
+                    });
+                    try {
+                        if (typeof planner !== "function")
+                            throw new TypeError("Follow-up reassessment needs a read-only planner");
+                        const planned = await planner(observation);
+                        authorize();
+                        const checkedPlan = fields(planned, "follow-up reassessment plan", [
+                            "candidateHash",
+                            "exactBundle",
+                            "checksReceipt",
+                            "checkPolicyVersion",
+                            "guard",
+                        ]);
+                        const guard = checkedPlan.guard;
+                        if (typeof guard !== "function")
+                            throw new TypeError("Follow-up reassessment guard must be callable");
+                        const plan = snapshot({
+                            candidateHash: checkedPlan.candidateHash,
+                            exactBundle: checkedPlan.exactBundle,
+                            checksReceipt: checkedPlan.checksReceipt,
+                            checkPolicyVersion: checkedPlan.checkPolicyVersion,
+                        });
+                        // Functions never enter the immutable command or an accepted receipt.
+                        return await prepareBundle(access, {
+                            ...command,
+                            mode: "staff_reassessment",
+                            candidateHash: plan.candidateHash,
+                            exactBundle: plan.exactBundle,
+                            checksReceipt: plan.checksReceipt,
+                            checkPolicyVersion: plan.checkPolicyVersion,
+                        }, async () => {
+                            try {
+                                return await guard();
+                            }
+                            finally {
+                                scope.close();
+                            }
+                        }, undefined, { current, mutation, authorize });
+                    }
+                    finally {
+                        scope.close();
+                    }
+                }
+                catch (error) {
+                    const accepted = await recover();
+                    if (accepted !== null)
+                        return accepted;
+                    if (!(error instanceof ReassessmentRetry))
+                        throw error;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async retryEngineeringFollowupWork(access, input) {
+        async retryEngineeringFollowupWork(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const now = engineeringFollowupNow(deps);
             const command = snapshot(fields(input, "retry follow-up work", [
                 "ticketId",
@@ -827,13 +1300,14 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const current = await sourceServices.internal.reassessment(command, now, "model_retry");
                 const { loaded, work: stored } = current;
                 const work = stored.value;
                 if (work.workGeneration !== command.expectedWorkGeneration ||
                     engineeringFollowupModelAttemptCount(work) >= options.maxModelAttempts)
                     throw new SupportDeskConflictError("Follow-up recovery generation or lifetime model budget changed");
-                const { stepId: _step, requestHash: _request, heldReason: _reason, ...retained } = withoutLease(compactModelAttempts(work));
+                const { stepId: _step, requestHash: _request, pendingModelCompletion: _pendingCompletion, heldReason: _reason, ...retained } = withoutLease(compactModelAttempts(work));
                 const next = {
                     ...retained,
                     ...current.prospective,
@@ -865,17 +1339,23 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     ...cohort.actions,
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRetried),
                     receipt(command, hash, outcome),
-                ], current.nextHead)) {
+                ], current.nextHead, mutation, () => {
+                    authorize();
+                    if (now() >=
+                        Math.min(timestamp(current.proof.attestation.validUntil, "validUntil"), timestamp(next.deadline, "deadline")))
+                        throw new SupportDeskConflictError("Follow-up recovery proof expired");
+                })) {
                     authorize();
                     return outcome;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async abandonEngineeringFollowupWork(access, input) {
+        async abandonEngineeringFollowupWork(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "abandon follow-up work", [
                 "ticketId",
                 "workId",
@@ -902,6 +1382,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const loaded = await load(command.ticketId);
                 const stored = await workAt(command);
                 const work = stored.value;
@@ -916,17 +1397,18 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next, [
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupAbandoned),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, authorize)) {
                     authorize();
                     return outcome;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async rejectEngineeringFollowupBundle(access, input) {
+        async rejectEngineeringFollowupBundle(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupReview, actorId, true);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "reject follow-up bundle", [
                 "ticketId",
                 "workId",
@@ -955,6 +1437,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong follow-up receipt kind");
                     return previous;
                 }
+                mutation?.ensure();
                 const loaded = await load(command.ticketId);
                 const stored = await workAt(command);
                 const work = stored.value;
@@ -970,17 +1453,18 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next, [
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRejected),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, authorize)) {
                     authorize();
                     return outcome;
                 }
             }
             throw new SupportDeskConflictError();
         },
-        async submitEngineeringFollowupRetestResult(access, input) {
+        async submitEngineeringFollowupRetestResult(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupEvidenceSubmit, actorId);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "submit follow-up retest", [
                 "ticketId",
                 "workId",
@@ -1008,8 +1492,8 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong retest receipt kind");
                     return previous;
                 }
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                mutation?.ensure();
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.withdrawn ||
                     work.security !== "ordinary" ||
@@ -1024,12 +1508,17 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (options.releaseEvidence === undefined)
                     throw new SupportDeskConflictError("Follow-up release verification unavailable");
                 authorize();
-                const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(work.context, proofContext, signal)));
-                engineeringFollowupValidateProof(proof, proofContext, associated.engineeringWork.value.product, now);
-                if (canonical(proof.context) !== canonical(work.context) ||
-                    proof.context.mapping === undefined ||
-                    proof.context.deploymentHead.state !== "deployed")
-                    throw new SupportDeskConflictError("Follow-up retest deployment changed");
+                const observer = options.retestReceipts.observe;
+                const currentReleaseProof = async () => {
+                    const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(work.context, proofContext, signal)));
+                    engineeringFollowupValidateProof(proof, proofContext, associated.engineeringWork.value.product, now);
+                    if (canonical(proof.context) !== canonical(work.context) ||
+                        proof.context.mapping === undefined ||
+                        proof.context.deploymentHead.state !== "deployed")
+                        throw new SupportDeskConflictError("Follow-up retest deployment changed");
+                    return proof;
+                };
+                const legacyProof = observer === undefined ? await currentReleaseProof() : undefined;
                 const requests = work.preparedBundle?.bundle.retestRequests ??
                     work.handoff?.retestRequests;
                 const request = requests?.find((entry) => entry.requestId === command.retestRequestId);
@@ -1046,7 +1535,60 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     productBinding: request.productBinding,
                 };
                 authorize();
-                const verified = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.retestReceipts.verify(command.receiptReference, binding, signal)));
+                const opened = await Promise.allSettled([
+                    legacyProof === undefined
+                        ? currentReleaseProof()
+                        : Promise.resolve(legacyProof),
+                    engineeringFollowupTrusted(deps, async (signal) => {
+                        if (observer === undefined)
+                            return {
+                                verified: snapshot(await options.retestReceipts.verify(command.receiptReference, binding, signal)),
+                                confirm: undefined,
+                            };
+                        const observed = await observer.call(options.retestReceipts, command.receiptReference, binding, signal);
+                        if (observed === null)
+                            return { verified: null, confirm: undefined };
+                        // Snapshot immediately, before any later awaited work or confirmation.
+                        const verified = snapshot(observed.verified);
+                        if (typeof observed.confirm !== "function")
+                            throw new TypeError("Follow-up retest observation lacks confirmation");
+                        return { verified, confirm: observed.confirm.bind(observed) };
+                    }),
+                ]);
+                if (opened[0].status === "rejected")
+                    throw opened[0].reason;
+                const proof = snapshot(opened[0].value);
+                if (opened[1].status === "rejected")
+                    throw opened[1].reason;
+                const observation = opened[1].value;
+                const verified = observation.verified;
+                let assertRetest;
+                let confirmed = observer === undefined;
+                const confirmCurrent = async () => {
+                    const closing = await Promise.allSettled([
+                        engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork),
+                        observation.confirm === undefined
+                            ? Promise.resolve(undefined)
+                            : engineeringFollowupTrusted(deps, (signal) => observation.confirm(signal)),
+                    ]);
+                    if (closing[0].status === "rejected")
+                        throw closing[0].reason;
+                    if (closing[1].status === "rejected")
+                        throw closing[1].reason;
+                    const assertion = closing[1].value;
+                    if (assertion !== undefined && typeof assertion !== "function")
+                        throw new TypeError("Invalid closing retest assertion");
+                    assertRetest =
+                        typeof assertion === "function" ? assertion : undefined;
+                    confirmed =
+                        observer === undefined || observation.confirm !== undefined;
+                    return closing[0].value;
+                };
+                const assertConfirmed = () => {
+                    if (!confirmed ||
+                        (assertRetest !== undefined && assertRetest() !== true))
+                        throw new SupportDeskConflictError("Follow-up retest confirmation changed");
+                };
                 if (verified === null ||
                     canonical(verified.binding) !== canonical(binding) ||
                     !["passed", "failed"].includes(verified.result) ||
@@ -1063,12 +1605,13 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 const summary = await engineeringFollowupRetestSummary(verified, command.receiptReference);
                 const prior = work.retestResults.find((entry) => entry.requestId === request.requestId);
                 if (prior?.verificationHash === summary.verificationHash) {
-                    if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork)))
+                    if (!(await confirmCurrent()))
                         continue;
                     authorize();
                     if (now() >=
                         Math.min(timestamp(verified.validUntil, "validUntil"), timestamp(proof.attestation.validUntil, "validUntil")))
                         throw new SupportDeskConflictError("Follow-up retest proof expired");
+                    assertConfirmed();
                     return {
                         ticketId: work.ticketId,
                         workId: work.workId,
@@ -1115,7 +1658,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         : "recorded",
                     result: verified.result,
                 };
-                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork)))
+                if (!(await confirmCurrent()))
                     continue;
                 authorize();
                 if (now() >=
@@ -1129,7 +1672,13 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     })),
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRetestRecorded),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, () => {
+                    authorize();
+                    assertConfirmed();
+                    if (now() >=
+                        Math.min(timestamp(verified.validUntil, "validUntil"), timestamp(proof.attestation.validUntil, "validUntil")))
+                        throw new SupportDeskConflictError("Follow-up retest proof expired");
+                })) {
                     authorize();
                     return outcome;
                 }