# Work-exchange restart and resource-budget continuation

Date: September 12, 2026. Scope: Concresca-owned repository and disposable local
MySQL fixtures only. No production deployment, rollback, credential lifecycle,
or database mutation was performed for this continuation.

## Intake and source application

Startup rescan: integrity PASS, 16 active files, 718,981 bytes, all 16 fully
reviewed, 67 closed records and 83 ledger records. These originals remain active
because accepted implementation is unfinished. Exact source custody remains
`reports/input/v049-work-exchange-20260912/`; no original was deleted or published.

The operations review's G4/G5/G8 requirements own the selected work: resource
exposure through interruption, separately reserved cleanup, and actual process
restart rather than a new application object. Protocol and boundary review
requirements still independently own consent, rights, correction and retention.

## Local resource accounting

`scripts/concresca_work_budget.py` implements pure, body-free transformations for
the existing protected custody session: exact integer requests and runtime
milliseconds; spent plus reserved plus unknown exposure; distinct ordinary and
cleanup pools and operation slots; exact intent/reservation binding; idempotent
transitions; strict bounded JSON; nonmutation on failure; retained completed IDs.
An unknown response, deadline or restart releases no exposure. Every additional
physical attempt requires capacity even if the logical remote mutation is replayed.
No-effect does not imply zero transport cost. Usage above a reservation fails
without refunding the uncertain exposure.

Main reviewed the module and reran all 48 tests successfully. Tests use fake
session persistence to specify integration behavior; they do not prove native
custody durability or concurrency. The checksum is not authentication. A caller's
`verified` field is not external evidence verification. Component limits are 64
operations and 48 KiB; the complete existing custody envelope has its own limit.
No bodies, credentials, URLs, price invention or public participant cost profile
are introduced by the ledger.

The actual controller integration remains mandatory. Use one bounded work-intent
container inside `SealedFileCustody.transaction`, not a second writable journal.
Keep immutable actor/workspace/project/origin, method/path/body/idempotency key,
expected response/receipt binding and pending physical attempts in sealed state.
Reserve, mark unknown and successfully save both protected copies before dispatch.
Verify the exact response and measured usage before reconciling one attempt.
Charge capability/authentication checks, pages and readback as well as writes.
Rotation must preserve actor binding; revocation cannot erase pending evidence or
authorize replay. Do not send through the escaped client returned after the
controller's custody lock ends. The existing two-copy generation checks cannot
independently detect restoration of both copies to the same older valid generation.

## Native restart/fallback probe

The harness now retains exact identity, withdrawn delivery/current agreement and
original receipt before requesting a database restart over a bounded private pipe.
The runner must attest a changed, exclusively owned database process using the
same data directory, port and server version, without reusing initialization SQL.
After restart, a cold runtime authenticates the same identity, rejects the revoked
credential, reads exact current state, replays the original receipt and continues
the same agreement with a new authorized delivery.

The fallback probe verifies the entire pinned extracted archive before importing
its actual runtime in an isolated Python process. Its only credential input is
the private stdin capsule for the marked, restricted loopback test database.
Existing work tables, agents, credentials and migration ledger are compared
exactly before/after authenticated readback. Existing room/policy seed upserts are
allowed and not misrepresented as byte-identical whole-database preservation.
No work write, work-retention maintenance or Passenger fallback acceptance is
claimed by this probe.

The new offline probe/handshake suite passed 14 checks, including archive tamper,
extra import hooks, scope expansion, duplicate fields, wrong nonce and timeout.
Existing work SQL/transport tests passed 58 checks and root-work integration
passed 20. Existing runner tests passed 41 before the Windows launcher repair.
These are bounded local checks, not independently operated agents.

### First actual rehearsal: failure preserved

Fixture `concresca-owned-mysql-smxgkdfv` failed the first restart check with
`restart_pid_identity_mismatch`. The Windows MySQL launcher had a separate
database child. The old cleanup incorrectly inferred that the database stopped
from the launcher exit and removed generated plaintext credentials. Follow-up
process inspection contradicted that claim: child PID25624 remained, with the
exact disposable data directory, port63799, executable, creation time and parent
PID22748. Main verified those values and stopped only that child; the two
preexisting MySQL processes4732/6240 remained untouched. The fixture's original
summary is retained as failure evidence, not a passing shutdown receipt.

Installed MySQL's own `--no-defaults --verbose --help` documents `--no-monitor`
as disabling this monitor process. Repair requires this explicit Windows setting,
PID-file/owned-handle parity before testing, and failure-safe stop verification.
The failed fixture's remaining test data is retained privately, not claimed cleaned.

### Second actual rehearsal: fixture expectation corrected

Fixture `concresca-owned-mysql-q7ovw2zn` verified Windows monitor suppression,
owned PID parity, and the first actual graceful restart into the same database.
It then failed with `wsgi_409_work_terminal`: the harness incorrectly tried to
redeliver a terminally withdrawn agreement. This was correct runtime rejection,
not a service defect. All 78 tracked fixture rows were removed, the owned server
exited0, and generated plaintext credentials were removed. Process readback
showed only the preexisting MySQL processes remained.

The scenario now preserves the terminal-withdrawal rejection and unchanged
readback, while separately resuming an agreement already committed before the
restart. No runtime transition or terminal-state rule was weakened to pass a test.

### Third actual rehearsal: PASS within the stated scope

Fixture `concresca-owned-mysql-woolfyud` passed both historical baseline paths,
the original ten native gates, two actual graceful MySQL process restarts, and
both archived fallback readbacks. Post-restart checks proved same identity,
revoked-authority rejection, current withdrawn state/original receipt preservation
and continuation of an already committed nonterminal agreement. The fallback
accepted schema3, preserved work/identity/credential/ledger rows and advertised no
work API. Exact fixture cleanup removed 89 and 90 rows respectively. The server
exited0, generated plaintext credentials were removed, and readback showed only
the two preexisting MySQL processes. No broad data-directory removal occurred.

The exact redacted results, failed attempts and scope qualifications are preserved
in `reports/v049-work-restart-budget-20260912.json`. The tested runner SHA-256
was `6659da6d8a6e87b568dccb62720fe4ce685921d0d4520181460ca4c216f24410`,
unchanged before and after execution. Per-file runtime/harness/probe hashes are
inside the result. The pinned fallback archive SHA-256 is
`ac57466463bd5617575847f65ee53daec3aed7d595fb6738073cc026249c30b7`.
This closes the isolated database restart and fallback authentication/readback
checks only, not work-retention maintenance or production/Passenger fallback.

Final runner safeguards passed the 41 existing tests plus 27 extension tests
after repair, rerun by main. These include surviving monitor children,
unconfirmed process liveness, retained credentials on uncertain shutdown,
no-monitor launch/restart guards and content-free exception reporting. The
final runner bytes still match the successful native run.

## Public observation and remaining gates

Read-only GETs at 22:49:35Z: `/api/concresca/readiness` reported
operationalAvailable=true and productionReady=false; Commons capabilities
reported available=true, backend=mysql and no workExchange. An initial mistaken
`/api/readiness` probe returned the normal unknown-route404; it was corrected
using the canonical route registry and is not a service availability failure.

Protected work-intent/client-budget integration, rights/dependency work,
fallback retention maintenance, actual Passenger restart, responsive browser QA,
tested publication, public-documentation-only acceptance and the separate
ChatGPT/independent-agent gates remain open. No acceptance receipt was renewed.
Whole-goal completion and whole-queue closure are not claimed.