fix(housekeeping): harden people account workflows

src/features/housekeeping/domains/people/commands/community-commands.ts

@@ -43,8 +43,8 @@ function communityCommand<I>(
 		execute: (context, input) =>
 			service.execute(
 				{
-					capability: context.capability,
 					correlationId: context.correlationId,
+					expectedActorId: context.capability.actor.id,
 				},
 				options.operation,
 				input,

src/features/housekeeping/domains/people/commands/user-commands.test.ts

@@ -165,12 +165,11 @@ describe("People user commands", () => {
 describe("People mutation service boundary", () => {
 	it("fails closed before the adapter when the exact capability is absent", async () => {
 		const execute = vi.fn(async () => ({ before: null, after: null }));
-		const service = createPeopleMutationService({ execute });
+		const service = createPeopleMutationService({ execute }, async () =>
+			capabilityContext([PERMS.USERS_EDIT]),
+		);
 		const result = await service.execute(
-			{
-				capability: capabilityContext([PERMS.USERS_EDIT]),
-				correlationId: "denied-people",
-			},
+			{ expectedActorId: 42, correlationId: "denied-people" },
 			"user.ban",
 			{ userId: 7, reason: "abuse", duration: 0, type: "account" },
 		);
@@ -190,11 +189,11 @@ describe("People mutation service boundary", () => {
 				after: { rank: 3 },
 			}),
 		};
-		const success = await createPeopleMutationService(snapshotAdapter).execute(
-			{
-				capability: capabilityContext([PERMS.USERS_EDIT]),
-				correlationId: "snapshot-people",
-			},
+		const success = await createPeopleMutationService(
+			snapshotAdapter,
+			async () => capabilityContext([PERMS.USERS_EDIT]),
+		).execute(
+			{ expectedActorId: 42, correlationId: "snapshot-people" },
 			"user.update",
 			{ userId: 7, fields: { rank: 3 } },
 		);
@@ -208,11 +207,11 @@ describe("People mutation service boundary", () => {
 				throw new Error("database password=secret");
 			},
 		};
-		const failure = await createPeopleMutationService(failureAdapter).execute(
-			{
-				capability: capabilityContext([PERMS.USERS_EDIT]),
-				correlationId: "failed-people",
-			},
+		const failure = await createPeopleMutationService(
+			failureAdapter,
+			async () => capabilityContext([PERMS.USERS_EDIT]),
+		).execute(
+			{ expectedActorId: 42, correlationId: "failed-people" },
 			"user.update",
 			{ userId: 7, fields: { motto: "Ready" } },
 		);

src/features/housekeeping/domains/people/commands/user-commands.ts

@@ -53,8 +53,8 @@ function userCommand<I>(
 		execute: (context, input) =>
 			service.execute(
 				{
-					capability: context.capability,
 					correlationId: context.correlationId,
+					expectedActorId: context.capability.actor.id,
 				},
 				options.operation,
 				input,