# Metered current reads and contained work transport — September 12, 2026 State: implementation and bounded verification; production work publication and the full intake/usefulness/memory/deployment/testing goal remain incomplete. The immediately preceding rollback explanation was status-only, not goal progress. This continuation rechecked instructions, current worktree, live state and actual agent handles before implementing the next autonomous-client gaps. ## Implemented behavior and ownership - `scripts/concresca_work_client.py`: `read_once` performs one existing-client GET, validates the actual response and returns allowlisted current public terms and applicable delivery/decision/history plus a body-free checkpoint. Unknown envelope/object diagnostics are excluded; nested terms/artifacts/history use exact-field checks. No artifact URL is fetched, instruction executed or memory promoted. Checkpoints describe observations, not proof of truth or consumption. - `scripts/concresca_work_controller.py`: `read_work` uses the existing sealed task ledger. It reserves/marks unknown and saves both copies before I/O, then saves conservative spent accounting and checkpoint before releasing selected content. Every explicit GET costs another attempt. Failed reads retain unknown exposure. A page keeps ordered IDs/count/hasMore/exact nextCursor together within8192bytes; detail checkpoints fit4096. Admission reserves10240bytes for read completion, retaining the existing64KiB work cap and32KiB lifecycle allocation. - Optional `reads` state preserves legacy custody loading without changing its MAC on inspection. Every global ledger operation has exactly one mutation/read owner and ordering; reads can interleave with pending mutation/resolution but never change its body/key/mode/retry timing or clear its unknown charges. Read-wide Retry-After survives changed paths and restart. Active same-identity credentials remain required; no refresh, enrollment or lifecycle call is hidden. - Cleanup GETs require the exact typed known resource of a retained mutation intent, including a successful original returned by resolution. A proposal-create parent opportunity, prevented creation, listing or arbitrary ID is ineligible. Cleanup can pass the ordinary task deadline, not authentication, retry or halt. - `scripts/concresca_autonomous_agent.py`: default work mutation/resolution/read dispatch now enters `_work_transport` after saved unknown accounting. Existing native directory and exclusive lock handles are lent only during their guard; expired sessions clear the ephemeral handle tuple. No new persisted authority, lock store, identity, journal or credential manager was introduced. - `scripts/concresca_deadline_transport.py` and `concresca_deadline_worker.py`: inert construction; one short-lived Windows CPython worker with restrictive kill-on-close Job Object before request release. Zero-access inherited copies of existing guard handles retain exclusion through parent death. Verified direct canonical HTTPS only; no proxy discovery, redirect or automatic retry. Credentials/body/keys cross bounded private pipes, not arguments, environment or credential files; stderr is discarded. Parent bounds8KiB metadata/1MiB body. An18-second absolute abort deadline leaves2seconds of the charged20seconds for teardown. Another worker attempt requires confirmed child and pipe-thread exit; unconfirmed teardown retains quarantine. Explicit injected client factories own their separate transport guarantees. Ordinary lifecycle transport is unchanged. This is an enforced abort/confirmed-exit boundary under operating-system liveness, not an unconditional exact20-second return guarantee. OS scheduling, process creation or cancellation may exceed allocation; observed overruns halt work. Termination cannot undo transmitted bytes or prove remote nonexecution. Unknown charges and exact pending mutation remain, with separate exact-intent resolution. The returned selected-read envelope explicitly identifies that it contains public payload (`containsSelectedPublicPayload:true`, `rawPayloadExposed:true`, `valuesRedacted:false`); credentials remain excluded. Normal status is body-free. No saved checkpoint is an automatic next-page instruction: a crash can occur after save but before the caller receives content. A repeated GET incurs a fresh charge. Listing order does not reveal corrections behind its cursor. ## Source intake and typed memory The16 commissioned work-exchange reports remain one source family. Startup sync observed16active/718981bytes,16reviewed,0unreviewed,67closed/83total, integrityPASS, not intake completion. The full prior operations/protocol/boundaries/strategy reviews remain separate from implementation proof. The resource-cost source and its repository custody copy were rehashed and both match `9ddb921b835eaa872914eebc28f26e2766a341231a04312b04797e2b1cb887ef`. No source was removed or published; the exact originals remain repository-only. This implements selected persistent-cost, bounded-readback and interruption recommendations from `v049-work-exchange-operations-review-20260912.md`, without invented prices, public identity-cost telemetry or participant ranking. Typed architecture, decisions008/009, constraints, memory, test plan, progress and next prompt now record these distinctions. Source-specific lifecycle/task-retirement and actual public-doc workflow work remains active, not parked for human approval. Generated public source owners are the work and autonomous guides/contracts and eight downloadable Python sources. The work guide retains explicit source-only, pending-deployment status. Schema/HTML examples remain17fictional requests, not fake demand, performed work or service receipts. NO JUDGMENT WHATSOEVER. ## Direct evidence and repaired failures - Main wire suite:74PASS (62existing+12selected-read tests),1.616seconds. The first new delivery test called its existing fixture with the wrong signature and errored; correcting the test invocation, not runtime semantics, made it pass. - Main existing identity/custody suite:39PASS,12.104seconds after guard-lending changes. No production custody was opened or altered. - Main protected controller/read/owned-handler suites:150PASS,56.021seconds (81controller+40new reads+29owned integration). These use actual owned WSGI and explicitly synthetic SQLite/AES transport where stated; existing native DPAPI cases remain separately labeled. No native MySQL claim follows from SQLite. - Six default-client composition tests first returned4PASS/2errors because the controller did not yet call the new transport hook. A fixture guard prevented real HTTP, so no fixture credentials or writes reached production. Wiring the read/mutation/resolution calls fixed the failures:6PASS,1.322seconds. These use actual owned handlers/native Windows custody and an injected opener, not child containment or a real network fault. - Native transport reviewer:43PASS,21.555seconds, plus62existing wire testsPASS. Actual child/process/Job/handle behavior is tested, including parent death before containment, before GO and after GO; confirmed child exit and lock readback; zero-access child lease after original handle closure; descendant denial; malformed/oversized IPC; blocked input/body/EOF; secret exclusion; no overlap and quarantine. DNS/connect/TLS/head/body stalls use fake network phases inside the real worker function, not actual phase-specific outages. Initial pre-GO job-assignment failure left an unassigned inert child quarantined; exact-owned-process termination repaired availability without weakening the exclusion. Unstarted pipe-thread cleanup and strict request parsing were also regression-tested. No production credentials/network were used by that suite. - Main generated-public-contract checks:11PASS after eight-download/read/transport parity additions. Separate read-only review found no actionable integration defect; this is review evidence, not independent live-agent acceptance. ## Read-only live evidence At2026-09-13T01:12:52.5835846Z, public readiness/capabilities still reported operationalAvailable=true,productionReady=false,Commons available=true,backend=mysql, workExchange=null. No work deployment or production rollback occurred. At2026-09-13T01:32:39.222806Z, main exercised the actual new contained HTTPS worker through the existing CommonsClient against anonymous public capabilities. Normal certificate/hostname verification succeeded, response validation reported available=true/backend=mysql/workExchange=null, and child/IPC exit was confirmed with no active attempt or retry block. Measured elapsed602milliseconds. This used two disposable empty native guard directories, no credentials and no production writes; fixtures were removed. It proves one real public HTTPS roundtrip, not authenticated work, network outage recovery, service publication or adoption. ## Remaining full-goal gates and release evidence Safe subsequent-task retirement without erasing unknown exposure; metered credential lifecycle and its transport integration; arbitrary recovery-chain headroom; source-rights/correction-dependency workflow; fallback work retention; actual Passenger release/restart; responsive visual QA; authorized publication, unfamiliar public-doc useful-work pilot and cleanup remain. Actual ChatGPT connector acceptance and outside participation remain distinct. Do not close functionality by labeling it unavailable or promote fixtures/operator checks into acceptance. Main final combined suite: **576PASS**,101.586seconds, zero failures/errors/skips. It includes the43native/offline transport tests and every owner listed above plus existing budgets, records, root, resolution, discovery, UAIX and native-harness model tests. It is not a fresh native MySQL run: prior exact SQL baseline/restart evidence remains in `v049-work-resolution-native-20260912.json`; SQL owners are unchanged, while the public wire helper has changed and was retested here. Current discovery check passed. Final sync retained16active reviewed sources, integrityPASS and no new records. Whole-queue completion remains unsatisfied. Commit/push and exact repository/root WIP package/extraction evidence follow in the detached artifact validation record when actually completed. The goal remains active; no deployed work functionality is claimed.