@pegma/support-desk-application 0.2.8 → 0.2.9

package/dist/engineering-followup-work.js

@@ -2,7 +2,7 @@ import { engineeringMutationBoundary, } from "./engineering-mutation-guard.js";
 import { SupportDeskConflictError, SupportDeskNotFoundError, supportPermissions, supportTicketAuditActions, } from "./index.js";
 import { canonical, fields, fingerprint, integer, text, timestamp, } from "./assistant-turn-records.js";
 import { safeEngineeringFollowupSnapshot as snapshot, checkEngineeringFollowupRecordCapacity, reserveEngineeringFollowupReachable, engineeringFollowupWorkKey, engineeringFollowupCommandKey, validateEngineeringFollowupCandidate, validateEngineeringFollowupBundle, validateEngineeringFollowupModelBinding, engineeringFollowupModelManifestHash, engineeringFollowupContextHash, engineeringFollowupPublicFactsHash, engineeringFollowupChecksBinding, engineeringFollowupRetestProductBinding, engineeringFollowupRetestRequestHash, engineeringFollowupRetestRequestId, engineeringFollowupRetestSummary, engineeringFollowupModelAttemptCount, } from "./engineering-followup-records.js";
-import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupObservation, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
+import { createEngineeringFollowupSourceServices, engineeringFollowupPermission as permission, engineeringFollowupObservation, engineeringFollowupNow, engineeringFollowupTrusted, engineeringFollowupResult as result, engineeringFollowupWithoutLease as withoutLease, engineeringFollowupCurrent, engineeringFollowupActive, engineeringFollowupLoadMutation, engineeringFollowupVersionsCurrent, holdEngineeringFollowupWork, engineeringFollowupAssociation, engineeringFollowupProofContext, engineeringFollowupValidateProof, planEngineeringFollowupContextChange, } from "./engineering-followup-source.js";
 import { engineeringSourceKey } from "./engineering-records.js";
 function validateFence(command) {
     for (const value of [
@@ -81,9 +81,9 @@ export function createEngineeringFollowupWorkServices(deps, load) {
         if (mutation !== undefined) {
             const assertHostCurrent = await mutation.verify();
             assertHostCurrent();
-            beforeCommit?.();
-            mutation.ensure();
         }
+        beforeCommit?.();
+        mutation?.ensure();
         return (await records.transact(next.ticketId, [
             {
                 action: "putIfUnchanged",
@@ -257,8 +257,14 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             if (typeof guard !== "function")
                 throw new TypeError("Follow-up bundle preparation needs a current read-only guard");
             mutation?.ensure();
-            const loaded = initial?.current.loaded ?? (await load(command.ticketId));
-            const stored = initial?.current.work ?? (await workAt(command));
+            const { loaded, stored } = initial !== undefined
+                ? { loaded: initial.current.loaded, stored: initial.current.work }
+                : staff
+                    ? {
+                        loaded: await load(command.ticketId),
+                        stored: await workAt(command),
+                    }
+                    : await engineeringFollowupLoadMutation(deps, command);
             const work = stored.value;
             if (work.workGeneration !== command.expectedWorkGeneration ||
                 work.candidateHash !== command.candidateHash ||
@@ -275,7 +281,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 : null;
             const current = staff
                 ? null
-                : await engineeringFollowupCurrent(deps, loaded, stored, now);
+                : await engineeringFollowupActive(deps, loaded, stored, now);
             if (!staff &&
                 (work.stage !== "bundle" ||
                     work.candidate === undefined ||
@@ -330,8 +336,14 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     excludedWorkId: work.workId,
                 });
             deps.admission(loaded.ticket.value.ticket, loaded.rows, [next, ...cohort.nextWorkRows], 2);
-            await guard();
-            const proof = rearm?.proof ?? current.proof;
+            // Source/association admission precedes receipt callbacks. The release
+            // proof is deliberately fresh AFTER verifyBundle, at the late guard's
+            // original release-observation boundary rather than reused across it.
+            const proof = rearm?.proof ?? (await lateBundleProof(stored, current, now));
+            if (staff)
+                await guard();
+            else
+                await bundleGuard(access, work, proof, guard, authorize, now);
             const associationWork = rearm?.engineeringWork ?? current.engineeringWork;
             if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associationWork))) {
                 if (initial !== undefined)
@@ -367,6 +379,212 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             throw new ReassessmentRetry();
         throw new SupportDeskConflictError();
     }
+    async function lateBundleProof(stored, current, now) {
+        if (options.releaseEvidence === undefined)
+            throw new SupportDeskConflictError("Follow-up release verification unavailable");
+        const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(stored.value.context, current.proofContext, signal)));
+        engineeringFollowupValidateProof(proof, current.proofContext, current.engineeringWork.value.product, now);
+        if (canonical(proof.context) !== canonical(stored.value.context) ||
+            proof.context.mapping === undefined ||
+            proof.context.deploymentHead.state !== "deployed" ||
+            timestamp(stored.value.deadline, "deadline") <= now())
+            throw new SupportDeskConflictError("Follow-up deployment changed");
+        return proof;
+    }
+    async function bundleGuard(access, work, proof, guard, authorize, now) {
+        const actorId = access.principalId;
+        let active = true;
+        const check = (reader) => {
+            if (!active)
+                throw new SupportDeskConflictError("Follow-up observation expired");
+            authorize();
+            permission(reader, supportPermissions.engineeringFollowupRead, actorId, true);
+            if (now() >=
+                Math.min(timestamp(proof.attestation.validUntil, "validUntil"), timestamp(work.deadline, "deadline")))
+                throw new SupportDeskConflictError("Follow-up bundle observation expired");
+        };
+        function detached(value) {
+            const copy = snapshot(value);
+            function freeze(item) {
+                if (item === null || typeof item !== "object")
+                    return;
+                for (const child of Object.values(item))
+                    freeze(child);
+                Object.freeze(item);
+            }
+            freeze(copy);
+            return copy;
+        }
+        const observation = Object.freeze({
+            readWork(reader) {
+                check(reader);
+                return detached(work);
+            },
+            readProof(reader) {
+                check(reader);
+                return detached(proof);
+            },
+        });
+        try {
+            await guard(observation);
+        }
+        finally {
+            active = false;
+        }
+    }
+    async function modelGuard(access, work, proof, guard) {
+        if (typeof guard !== "function")
+            throw new TypeError("Follow-up invocation needs a current guard");
+        const actorId = access.principalId;
+        let active = true;
+        const check = (current) => {
+            if (!active)
+                throw new SupportDeskConflictError("Follow-up observation expired");
+            permission(current, supportPermissions.engineeringFollowupRead, actorId);
+            permission(current, supportPermissions.queueRead, actorId);
+        };
+        function freeze(value) {
+            if (value === null || typeof value !== "object")
+                return;
+            for (const item of Object.values(value))
+                freeze(item);
+            Object.freeze(value);
+        }
+        try {
+            await guard(Object.freeze({
+                readWork(current) {
+                    check(current);
+                    return snapshot(work);
+                },
+                readProof(current) {
+                    check(current);
+                    const detached = snapshot(proof);
+                    freeze(detached);
+                    return detached;
+                },
+            }));
+        }
+        finally {
+            active = false;
+        }
+    }
+    async function prepareModel(access, input, staged = false, guard) {
+        const actorId = access.principalId;
+        const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
+        authorize();
+        const command = snapshot(fields(input, "prepare follow-up model", [
+            "ticketId",
+            "workId",
+            "workerId",
+            "claimId",
+            "claimGeneration",
+            "binding",
+        ]));
+        validateFence(command);
+        validateEngineeringFollowupModelBinding(command.binding);
+        if ((command.binding.staged !== undefined) !== staged)
+            throw new TypeError("Follow-up preparation mode differs from binding");
+        const now = engineeringFollowupNow(deps);
+        if (!options.enabled)
+            throw new SupportDeskConflictError("Follow-up model processing disabled");
+        for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
+            const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
+            const work = stored.value;
+            live(work, command, now());
+            const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
+            const binding = command.binding;
+            const manifest = binding.inputManifest;
+            if (work.stage !== "model" ||
+                work.candidate !== undefined ||
+                work.preparedBundle !== undefined ||
+                work.completionRows !== 5 ||
+                work.messageSlots !== 1 ||
+                manifest.workBindingHash !== work.workBindingHash ||
+                manifest.contextHash !==
+                    (await engineeringFollowupContextHash(work.context)) ||
+                manifest.publicFactsHash !==
+                    (await engineeringFollowupPublicFactsHash(current.proof.publicFacts)) ||
+                binding.inputManifestHash !==
+                    (await engineeringFollowupModelManifestHash(manifest)) ||
+                manifest.messages.some((reference) => !loaded.rows.some((row) => row.kind === "message" &&
+                    row.message.visibility === "customer" &&
+                    row.message.id === reference.messageId &&
+                    row.ordinal === reference.ordinal &&
+                    row.ordinal <= work.acceptedTicketRevision)))
+                throw new SupportDeskConflictError("Follow-up model manifest differs from current facts");
+            const deadline = timestamp(binding.deadline, "model.deadline");
+            if (deadline <= now() ||
+                deadline > timestamp(work.deadline, "deadline") ||
+                (!staged && deadline > timestamp(work.leaseUntil, "leaseUntil")))
+                throw new SupportDeskConflictError("Follow-up model deadline exceeds live claim");
+            const existing = work.modelAttempts.find((entry) => canonical(entry.binding) === canonical(binding));
+            if (existing !== undefined) {
+                if (existing.preparedClaimGeneration !== command.claimGeneration ||
+                    existing.stepId !== work.stepId)
+                    throw new SupportDeskConflictError("Follow-up preparation belongs to another physical invocation");
+                if (staged)
+                    await modelGuard(access, work, current.proof, guard);
+                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                    continue;
+                authorize();
+                live(work, command, now());
+                if (now() >=
+                    Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model proof expired");
+                if (await save(loaded, stored, work)) {
+                    authorize();
+                    return {
+                        stepId: existing.stepId,
+                        requestHash: existing.requestHash,
+                        maxCandidateBytes: 16_000,
+                    };
+                }
+                continue;
+            }
+            if (engineeringFollowupModelAttemptCount(work) >=
+                options.maxModelAttempts ||
+                work.modelAttempts.some((entry) => entry.preparedClaimGeneration === command.claimGeneration))
+                throw new SupportDeskConflictError("Follow-up paid attempt bound reached");
+            const requestHash = await fingerprint(binding);
+            const stepId = await fingerprint({
+                workId: work.workId,
+                claimGeneration: command.claimGeneration,
+                binding,
+            });
+            const next = {
+                ...compactModelAttempts(staged ? withoutLease(work) : work),
+                status: staged ? "retry" : "model_prepared",
+                stepId,
+                requestHash,
+                workGeneration: work.workGeneration + 1,
+                modelAttempts: [
+                    {
+                        preparedClaimGeneration: command.claimGeneration,
+                        stepId,
+                        requestHash,
+                        binding,
+                        accounting: staged ? "not_called" : "unknown",
+                        ...(staged ? { callState: "not_called" } : {}),
+                    },
+                ],
+            };
+            reserveEngineeringFollowupReachable(next);
+            if (staged)
+                await modelGuard(access, work, current.proof, guard);
+            if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                continue;
+            authorize();
+            live(work, command, now());
+            if (now() >=
+                Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
+                throw new SupportDeskConflictError("Follow-up model proof expired");
+            if (await save(loaded, stored, next)) {
+                authorize();
+                return { stepId, requestHash, maxCandidateBytes: 16_000 };
+            }
+        }
+        throw new SupportDeskConflictError();
+    }
     const application = {
         async claimEngineeringFollowupWork(access, input) {
             const actorId = access.principalId;
@@ -391,8 +609,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 return null;
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if ([
                     "held",
@@ -450,6 +667,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (await save(loaded, stored, next)) {
                     authorize();
                     return {
+                        bundleObservation: true,
                         fence: snapshot(next.claim),
                         sourceFence: {
                             ticketId: work.ticketId,
@@ -467,113 +685,173 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             }
             throw new SupportDeskConflictError();
         },
-        async prepareEngineeringFollowupModel(access, input) {
+        prepareEngineeringFollowupModel(access, input) {
+            return prepareModel(access, input);
+        },
+        planEngineeringFollowupModel(access, input, guard) {
+            return prepareModel(access, input, true, guard);
+        },
+        async beginEngineeringFollowupModel(access, input, guard) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
             authorize();
-            const command = snapshot(fields(input, "prepare follow-up model", [
+            const command = snapshot(fields(input, "begin follow-up model", [
                 "ticketId",
                 "workId",
                 "workerId",
                 "claimId",
                 "claimGeneration",
-                "binding",
+                "stepId",
+                "requestHash",
             ]));
             validateFence(command);
-            validateEngineeringFollowupModelBinding(command.binding);
-            const now = engineeringFollowupNow(deps);
+            text(command.stepId, "stepId");
+            text(command.requestHash, "requestHash");
             if (!options.enabled)
                 throw new SupportDeskConflictError("Follow-up model processing disabled");
+            const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 live(work, command, now());
                 const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
-                const binding = command.binding;
-                const manifest = binding.inputManifest;
-                if (work.stage !== "model" ||
-                    work.candidate !== undefined ||
-                    work.preparedBundle !== undefined ||
-                    work.completionRows !== 5 ||
-                    work.messageSlots !== 1 ||
-                    manifest.workBindingHash !== work.workBindingHash ||
-                    manifest.contextHash !==
-                        (await engineeringFollowupContextHash(work.context)) ||
-                    manifest.publicFactsHash !==
-                        (await engineeringFollowupPublicFactsHash(current.proof.publicFacts)) ||
-                    binding.inputManifestHash !==
-                        (await engineeringFollowupModelManifestHash(manifest)) ||
-                    manifest.messages.some((reference) => !loaded.rows.some((row) => row.kind === "message" &&
-                        row.message.visibility === "customer" &&
-                        row.message.id === reference.messageId &&
-                        row.ordinal === reference.ordinal &&
-                        row.ordinal <= work.acceptedTicketRevision)))
-                    throw new SupportDeskConflictError("Follow-up model manifest differs from current facts");
-                const deadline = timestamp(binding.deadline, "model.deadline");
-                if (deadline <= now() ||
-                    deadline > timestamp(work.deadline, "deadline") ||
-                    deadline > timestamp(work.leaseUntil, "leaseUntil"))
-                    throw new SupportDeskConflictError("Follow-up model deadline exceeds live claim");
-                const existing = work.modelAttempts.find((entry) => canonical(entry.binding) === canonical(binding));
-                if (existing !== undefined) {
-                    if (existing.preparedClaimGeneration !== command.claimGeneration ||
-                        existing.stepId !== work.stepId)
-                        throw new SupportDeskConflictError("Follow-up preparation belongs to another physical invocation");
-                    if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
-                        continue;
+                const model = work.modelAttempts.find((entry) => entry.stepId === command.stepId &&
+                    entry.requestHash === command.requestHash);
+                if (model?.binding.staged === undefined ||
+                    work.stepId !== command.stepId ||
+                    work.requestHash !== command.requestHash ||
+                    work.stage !== "model" ||
+                    work.pendingModelCompletion !== undefined)
+                    throw new SupportDeskConflictError("Follow-up model plan changed");
+                if (model.callState !== "not_called" ||
+                    model.accounting !== "not_called") {
                     authorize();
-                    live(work, command, now());
-                    if (now() >=
-                        Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
-                        throw new SupportDeskConflictError("Follow-up model proof expired");
-                    if (await save(loaded, stored, work)) {
-                        authorize();
-                        return {
-                            stepId: existing.stepId,
-                            requestHash: existing.requestHash,
-                            maxCandidateBytes: 16_000,
-                        };
-                    }
-                    continue;
+                    return {
+                        stepId: model.stepId,
+                        requestHash: model.requestHash,
+                        maxCandidateBytes: 16_000,
+                        callPermit: false,
+                    };
                 }
-                if (engineeringFollowupModelAttemptCount(work) >=
-                    options.maxModelAttempts ||
-                    work.modelAttempts.some((entry) => entry.preparedClaimGeneration === command.claimGeneration))
-                    throw new SupportDeskConflictError("Follow-up paid attempt bound reached");
-                const requestHash = await fingerprint(binding);
-                const stepId = await fingerprint({
-                    workId: work.workId,
-                    claimGeneration: command.claimGeneration,
-                    binding,
-                });
                 const next = {
-                    ...compactModelAttempts(work),
+                    ...work,
                     status: "model_prepared",
-                    stepId,
-                    requestHash,
                     workGeneration: work.workGeneration + 1,
-                    modelAttempts: [
-                        {
+                    modelAttempts: work.modelAttempts.map((entry) => entry !== model
+                        ? entry
+                        : {
+                            ...entry,
                             preparedClaimGeneration: command.claimGeneration,
-                            stepId,
-                            requestHash,
-                            binding,
+                            callState: "possibly_called",
                             accounting: "unknown",
-                        },
-                    ],
+                        }),
                 };
-                reserveEngineeringFollowupReachable(next);
+                checkEngineeringFollowupRecordCapacity(next);
+                await modelGuard(access, work, current.proof, guard);
                 if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
                     continue;
                 authorize();
                 live(work, command, now());
                 if (now() >=
-                    Math.min(deadline, timestamp(current.proof.attestation.validUntil, "validUntil")))
-                    throw new SupportDeskConflictError("Follow-up model proof expired");
+                    Math.min(timestamp(model.binding.deadline, "model.deadline"), timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model plan expired");
                 if (await save(loaded, stored, next)) {
                     authorize();
-                    return { stepId, requestHash, maxCandidateBytes: 16_000 };
+                    return {
+                        stepId: model.stepId,
+                        requestHash: model.requestHash,
+                        maxCandidateBytes: 16_000,
+                        callPermit: true,
+                    };
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async recordEngineeringFollowupModel(access, input, guard) {
+            const actorId = access.principalId;
+            const authorize = () => permission(access, supportPermissions.engineeringFollowupProcess, actorId);
+            authorize();
+            const command = snapshot(fields(input, "record follow-up model", [
+                "ticketId",
+                "workId",
+                "workerId",
+                "claimId",
+                "claimGeneration",
+                "stepId",
+                "requestHash",
+                "candidate",
+                "accounting",
+            ], ["processing"]));
+            validateFence(command);
+            text(command.stepId, "stepId");
+            text(command.requestHash, "requestHash");
+            validateEngineeringFollowupCandidate(command.candidate);
+            processing(command.processing);
+            if (!["accounted", "unknown"].includes(command.accounting))
+                throw new TypeError("Invalid follow-up accounting");
+            const hash = await fingerprint({ actorId, command });
+            const now = engineeringFollowupNow(deps);
+            for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
+                const work = stored.value;
+                if (work.lastModelRecord?.fingerprint === hash) {
+                    authorize();
+                    return snapshot(work.lastModelRecord.result);
+                }
+                if (!options.enabled)
+                    throw new SupportDeskConflictError("Follow-up model processing disabled");
+                live(work, command, now());
+                const current = await engineeringFollowupCurrent(deps, loaded, stored, now);
+                const model = work.modelAttempts.find((entry) => entry.stepId === command.stepId &&
+                    entry.requestHash === command.requestHash);
+                if (model?.binding.staged === undefined ||
+                    model.callState !== "possibly_called" ||
+                    model.preparedClaimGeneration !== command.claimGeneration ||
+                    work.stepId !== command.stepId ||
+                    work.requestHash !== command.requestHash ||
+                    work.stage !== "model" ||
+                    work.pendingModelCompletion !== undefined)
+                    throw new SupportDeskConflictError("Follow-up model invocation changed");
+                const next = {
+                    ...withoutLease(work),
+                    status: "retry",
+                    workGeneration: work.workGeneration + 1,
+                    pendingModelCompletion: {
+                        stepId: command.stepId,
+                        requestHash: command.requestHash,
+                        candidate: command.candidate,
+                        accounting: command.accounting,
+                        ...(command.processing === undefined
+                            ? {}
+                            : { processing: command.processing }),
+                    },
+                    modelAttempts: work.modelAttempts.map((entry) => entry !== model
+                        ? entry
+                        : {
+                            ...entry,
+                            callState: "recorded",
+                            accounting: command.accounting,
+                            ...(command.processing === undefined
+                                ? {}
+                                : { processing: command.processing }),
+                        }),
+                };
+                const accepted = {
+                    ...next,
+                    lastModelRecord: { fingerprint: hash, result: result(next) },
+                };
+                checkEngineeringFollowupRecordCapacity(accepted);
+                await modelGuard(access, work, current.proof, guard);
+                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
+                    continue;
+                authorize();
+                live(work, command, now());
+                if (now() >=
+                    Math.min(timestamp(model.binding.deadline, "model.deadline"), timestamp(current.proof.attestation.validUntil, "validUntil")))
+                    throw new SupportDeskConflictError("Follow-up model result expired");
+                if (await save(loaded, stored, accepted)) {
+                    authorize();
+                    return result(next);
                 }
             }
             throw new SupportDeskConflictError();
@@ -603,8 +881,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             const hash = await fingerprint({ actorId, command });
             const now = engineeringFollowupNow(deps);
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.lastCompletion?.fingerprint === hash) {
                     authorize();
@@ -616,12 +893,27 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     entry.requestHash === command.requestHash);
                 if (work.stage !== "model" ||
                     model === undefined ||
-                    model.preparedClaimGeneration !== command.claimGeneration ||
+                    (model.preparedClaimGeneration !== command.claimGeneration &&
+                        work.pendingModelCompletion === undefined) ||
                     work.stepId !== command.stepId ||
                     work.requestHash !== command.requestHash)
                     throw new SupportDeskConflictError("Follow-up prepared model owner changed");
+                if (model.binding.staged !== undefined &&
+                    (model.callState !== "recorded" ||
+                        canonical(work.pendingModelCompletion) !==
+                            canonical({
+                                stepId: command.stepId,
+                                requestHash: command.requestHash,
+                                candidate: command.candidate,
+                                accounting: command.accounting,
+                                ...(command.processing === undefined
+                                    ? {}
+                                    : { processing: command.processing }),
+                            })))
+                    throw new SupportDeskConflictError("Follow-up recorded model result changed");
+                const { pendingModelCompletion: _pendingCompletion, ...retained } = withoutLease(work);
                 const next = compactModelAttempts({
-                    ...withoutLease(work),
+                    ...retained,
                     status: "candidate",
                     stage: "bundle",
                     candidate: command.candidate,
@@ -642,7 +934,10 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     lastCompletion: { fingerprint: hash, result: result(next) },
                 };
                 checkEngineeringFollowupRecordCapacity(accepted);
-                await guard();
+                if (model.binding.staged === undefined)
+                    await guard();
+                else
+                    await modelGuard(access, work, current.proof, guard);
                 if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, current.engineeringWork)))
                     continue;
                 authorize();
@@ -703,8 +998,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 throw new TypeError("Historical restriction cannot change accounting");
             const hash = await fingerprint({ actorId, command });
             for (let attempt = 0; attempt < deps.maxConflictAttempts; attempt += 1) {
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.lastFinish?.fingerprint === hash) {
                     authorize();
@@ -769,6 +1063,10 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                                     throw new SupportDeskConflictError("Cannot rewrite another follow-up invocation's accounting");
                                 return entry;
                             }
+                            if (entry.callState !== undefined &&
+                                entry.callState !== "not_called" &&
+                                command.accounting === "not_called")
+                                throw new SupportDeskConflictError("A possibly called follow-up cannot become not-called");
                             if (entry.accounting !== "unknown" &&
                                 command.accounting !== undefined &&
                                 entry.accounting !== command.accounting)
@@ -1009,7 +1307,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (work.workGeneration !== command.expectedWorkGeneration ||
                     engineeringFollowupModelAttemptCount(work) >= options.maxModelAttempts)
                     throw new SupportDeskConflictError("Follow-up recovery generation or lifetime model budget changed");
-                const { stepId: _step, requestHash: _request, heldReason: _reason, ...retained } = withoutLease(compactModelAttempts(work));
+                const { stepId: _step, requestHash: _request, pendingModelCompletion: _pendingCompletion, heldReason: _reason, ...retained } = withoutLease(compactModelAttempts(work));
                 const next = {
                     ...retained,
                     ...current.prospective,
@@ -1162,10 +1460,11 @@ export function createEngineeringFollowupWorkServices(deps, load) {
             }
             throw new SupportDeskConflictError();
         },
-        async submitEngineeringFollowupRetestResult(access, input) {
+        async submitEngineeringFollowupRetestResult(access, input, control) {
             const actorId = access.principalId;
             const authorize = () => permission(access, supportPermissions.engineeringFollowupEvidenceSubmit, actorId);
             authorize();
+            const mutation = engineeringMutationBoundary(control);
             const command = snapshot(fields(input, "submit follow-up retest", [
                 "ticketId",
                 "workId",
@@ -1193,8 +1492,8 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         throw new SupportDeskConflictError("Wrong retest receipt kind");
                     return previous;
                 }
-                const loaded = await load(command.ticketId);
-                const stored = await workAt(command);
+                mutation?.ensure();
+                const { loaded, stored } = await engineeringFollowupLoadMutation(deps, command);
                 const work = stored.value;
                 if (work.withdrawn ||
                     work.security !== "ordinary" ||
@@ -1209,12 +1508,17 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 if (options.releaseEvidence === undefined)
                     throw new SupportDeskConflictError("Follow-up release verification unavailable");
                 authorize();
-                const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(work.context, proofContext, signal)));
-                engineeringFollowupValidateProof(proof, proofContext, associated.engineeringWork.value.product, now);
-                if (canonical(proof.context) !== canonical(work.context) ||
-                    proof.context.mapping === undefined ||
-                    proof.context.deploymentHead.state !== "deployed")
-                    throw new SupportDeskConflictError("Follow-up retest deployment changed");
+                const observer = options.retestReceipts.observe;
+                const currentReleaseProof = async () => {
+                    const proof = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.releaseEvidence.confirm(work.context, proofContext, signal)));
+                    engineeringFollowupValidateProof(proof, proofContext, associated.engineeringWork.value.product, now);
+                    if (canonical(proof.context) !== canonical(work.context) ||
+                        proof.context.mapping === undefined ||
+                        proof.context.deploymentHead.state !== "deployed")
+                        throw new SupportDeskConflictError("Follow-up retest deployment changed");
+                    return proof;
+                };
+                const legacyProof = observer === undefined ? await currentReleaseProof() : undefined;
                 const requests = work.preparedBundle?.bundle.retestRequests ??
                     work.handoff?.retestRequests;
                 const request = requests?.find((entry) => entry.requestId === command.retestRequestId);
@@ -1231,7 +1535,60 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     productBinding: request.productBinding,
                 };
                 authorize();
-                const verified = snapshot(await engineeringFollowupTrusted(deps, (signal) => options.retestReceipts.verify(command.receiptReference, binding, signal)));
+                const opened = await Promise.allSettled([
+                    legacyProof === undefined
+                        ? currentReleaseProof()
+                        : Promise.resolve(legacyProof),
+                    engineeringFollowupTrusted(deps, async (signal) => {
+                        if (observer === undefined)
+                            return {
+                                verified: snapshot(await options.retestReceipts.verify(command.receiptReference, binding, signal)),
+                                confirm: undefined,
+                            };
+                        const observed = await observer.call(options.retestReceipts, command.receiptReference, binding, signal);
+                        if (observed === null)
+                            return { verified: null, confirm: undefined };
+                        // Snapshot immediately, before any later awaited work or confirmation.
+                        const verified = snapshot(observed.verified);
+                        if (typeof observed.confirm !== "function")
+                            throw new TypeError("Follow-up retest observation lacks confirmation");
+                        return { verified, confirm: observed.confirm.bind(observed) };
+                    }),
+                ]);
+                if (opened[0].status === "rejected")
+                    throw opened[0].reason;
+                const proof = snapshot(opened[0].value);
+                if (opened[1].status === "rejected")
+                    throw opened[1].reason;
+                const observation = opened[1].value;
+                const verified = observation.verified;
+                let assertRetest;
+                let confirmed = observer === undefined;
+                const confirmCurrent = async () => {
+                    const closing = await Promise.allSettled([
+                        engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork),
+                        observation.confirm === undefined
+                            ? Promise.resolve(undefined)
+                            : engineeringFollowupTrusted(deps, (signal) => observation.confirm(signal)),
+                    ]);
+                    if (closing[0].status === "rejected")
+                        throw closing[0].reason;
+                    if (closing[1].status === "rejected")
+                        throw closing[1].reason;
+                    const assertion = closing[1].value;
+                    if (assertion !== undefined && typeof assertion !== "function")
+                        throw new TypeError("Invalid closing retest assertion");
+                    assertRetest =
+                        typeof assertion === "function" ? assertion : undefined;
+                    confirmed =
+                        observer === undefined || observation.confirm !== undefined;
+                    return closing[0].value;
+                };
+                const assertConfirmed = () => {
+                    if (!confirmed ||
+                        (assertRetest !== undefined && assertRetest() !== true))
+                        throw new SupportDeskConflictError("Follow-up retest confirmation changed");
+                };
                 if (verified === null ||
                     canonical(verified.binding) !== canonical(binding) ||
                     !["passed", "failed"].includes(verified.result) ||
@@ -1248,12 +1605,13 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                 const summary = await engineeringFollowupRetestSummary(verified, command.receiptReference);
                 const prior = work.retestResults.find((entry) => entry.requestId === request.requestId);
                 if (prior?.verificationHash === summary.verificationHash) {
-                    if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork)))
+                    if (!(await confirmCurrent()))
                         continue;
                     authorize();
                     if (now() >=
                         Math.min(timestamp(verified.validUntil, "validUntil"), timestamp(proof.attestation.validUntil, "validUntil")))
                         throw new SupportDeskConflictError("Follow-up retest proof expired");
+                    assertConfirmed();
                     return {
                         ticketId: work.ticketId,
                         workId: work.workId,
@@ -1300,7 +1658,7 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                         : "recorded",
                     result: verified.result,
                 };
-                if (!(await engineeringFollowupVersionsCurrent(deps, loaded, stored, associated.engineeringWork)))
+                if (!(await confirmCurrent()))
                     continue;
                 authorize();
                 if (now() >=
@@ -1314,7 +1672,13 @@ export function createEngineeringFollowupWorkServices(deps, load) {
                     })),
                     deps.audit(command, loaded.ticket.value.ticket, actorId, clock.now(), supportTicketAuditActions.engineeringFollowupRetestRecorded),
                     receipt(command, hash, outcome),
-                ])) {
+                ], loaded.head?.value, mutation, () => {
+                    authorize();
+                    assertConfirmed();
+                    if (now() >=
+                        Math.min(timestamp(verified.validUntil, "validUntil"), timestamp(proof.attestation.validUntil, "validUntil")))
+                        throw new SupportDeskConflictError("Follow-up retest proof expired");
+                })) {
                     authorize();
                     return outcome;
                 }