Qualify settled Study recovery across stopped restore

docs/plans/lab-workflow-reliability/execution-ledger.md

@@ -1,5 +1,38 @@
 # Lab workflow reliability execution ledger
 
+## 2026-10-21 — Populated Study/recovered-result transfer admission
+
+The lead selects one composed T2/T6/T8 acceptance gap after the current-version
+interrupted-transfer witness. The original Study case already executes one
+neutral attempt, retains its publication copy fault, settles the original
+conservative reservation and recovers the same Run. Its extension carries that
+populated state through stopped backup, a separate database/directory restore,
+raw preactivation snapshots and cold current SDK/CLI result collection.
+
+The source branch is `test/study-publication-restore-20261021` from main
+`8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`; normally compose the reviewed
+interrupted-transfer source/evidence before the one affected qualification.
+No production, schema, cache, runtime installation, old-version compatibility,
+automatic migration or new long benchmark is admitted. PUB-1/SCI-1 remain blocked
+on their genuine missing lab inputs.
+
+The normal source composition `55fe1c6` passed only the affected Study case once:
+15.550 seconds unittest / 15.582514518 seconds wrapper, zero failures/errors/skips.
+One actual neutral attempt launch and zero restore/consumer replay calls were
+observed. Raw 43-table/sequences/file/mode transfer, one settled reservation and
+the original charge, exact cold SDK/CLI result collection and source/backup
+preservation passed. Exact owned schema/database cleanup was queried and the
+task PostgreSQL container stopped afterward. Raw source/environment/result/domain
+receipts are sealed under `reports/study-recovered-result-transfer-20261021/`.
+Root independently passed that exact frozen source from a detached worktree:
+one test in 15.924 seconds unittest / 15.951664041 seconds wrapper, zero
+failures/errors/skips, independently absent exact owned resources and unchanged
+database inventory. Source/reproduction review is clear; the same test bytes
+remain sealed. Final report/source review and published-head hosted checks
+remain gates. This is one clean current-version transfer with Project roots
+available; no duplicate interruption matrix, new performance or science proof
+is implied.
+
 ## 2026-10-21 — Current-version interrupted restore admission
 
 PR115 and PR116 are merged; main is

docs/plans/lab-workflow-reliability/plan.md

@@ -429,6 +429,34 @@ arguments are not substituted for old source execution. No production, schema,
 workflow or README change is admitted. Actual qualification and independent
 review remain gates; this does not complete unrelated T8 or lab acceptance.
 
+### Populated Study and recovered-result transfer admission — 2026-10-21
+
+The integration lead admits the remaining composed T2/T6/T8 boundary on isolated
+branch `test/study-publication-restore-20261021`, based on exact main
+`8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`. Its write set is the existing
+`tests/test_run_publication_recovery.py` Study accounting case, this plan,
+execution ledger and scoped `reports/study-recovered-result-transfer-20261021/`.
+Normally compose the separately reviewed interrupted-transfer slice before
+qualification, preserving both source/evidence histories.
+
+Existing tests separately prove live Study settlement through same-Run recovery,
+queued Study restore, and direct-Run recovered Ref restore. Extend the actual
+Study case to carry its one settled reservation/conservative charge, original
+interrupted Run/fault/events, Model/Trial/material and exact recovered Ref through
+stopped backup and an independent database/directory restore. Compare raw tables,
+sequences, file bytes and POSIX modes before activation, preserve the original
+source/backup, and use current authenticated SDK and separate CLI collection.
+Repeated reconciliation and same-key recovery must retain exactly one Run,
+execution grant/consumption and reservation, without a second charge or launch.
+
+Only the affected focused case and independent serial reproduction are needed
+locally; no long benchmark or duplicate generic interruption matrix is admitted.
+Published-head hosted checks and independent source/evidence review remain gates.
+No production change is admitted absent an observed correctness failure. This
+does not add backward adapters or automatic migration, qualify installed-runtime
+mutation/preparation reuse, complete all M1–M6/T1–T8, or supply missing PUB-1/SCI-1
+lab inputs. Their real provenance/criterion requirements remain explicit.
+
 ### Current-version interrupted-transfer acceptance admission — 2026-10-21
 
 After PR116 merged as `8b1f78eb06c17e3dba2a73dc0acc9568e53ccc7e`, the

docs/plans/lab-workflow-reliability/reports/study-recovered-result-transfer-20261021/acceptance.md

@@ -0,0 +1,102 @@
+# Settled Study and recovered result through stopped restore
+
+This extends the existing real Study publication-recovery case through one clean
+current-version stopped transfer and cold public consumers. No production repair
+or new feature implementation was needed. The existing T2/T6/T8 plan admission
+owns the scope; this is not a new product plan.
+
+## Exact source and execution
+
+The source checkpoint is `55fe1c6e6c214f71b00d00ea3cdd80030a6751da`, tree
+`96672fb93f5b2bf3f8ca6e8cbf1e537d2fa4da68`. It normally composes the Study
+source `79fcbe6a84ca4d22b9a3d1039fa16d7f237fe6a4` and the reviewed interruption
+candidate `a28034e06772d337200f4529e3545bf96bdc524c`; both complete plan/ledger
+admissions were retained when their adjacent insertions conflicted. The inherited
+interruption test and its sealed reports are unchanged.
+
+The only affected case,
+`PublicationRecoveryTests.test_existing_study_reservation_and_conservative_charge_survive_recovery`,
+passed once in 15.550 seconds unittest / 15.582514518 seconds wrapper, with zero
+failures, errors or skips. Its test file SHA256 is
+`e08eb764056b209aead37b6491cbced9f9adb9cea7813ec05ccc4ea3c147c8f3`.
+These are test execution durations, not a performance comparison.
+
+The serial author run used Python 3.12.14, psycopg 3.3.6 and PostgreSQL 17.11.
+The [manifest](evidence-manifest.json) seals the exact raw runners, logs,
+environment, source, result/domain receipts and resource inventories under
+`author/` and `independent/`. Root independently reproduced the same frozen
+source from a separate detached worktree: one test in 15.924 seconds unittest /
+15.951664041 seconds wrapper, with zero failures, errors or skips. Its
+source/reproduction review is clear, receipt SHA256
+`4e98c56e3a90b4129acb653ef93f1dbafe516b889db7ff6df29bdc4b271eef54`.
+Final report/source review and published-head hosted checks remain required;
+neither local result is relabeled as a run of an unexecuted publication SHA.
+
+## Composed integrity boundary
+
+The existing neutral fixture creates one captured Model, Study, Trial and exact
+execution grant. It admits and launches the actual external byte-copy attempt
+once. Only original publication copying is faulted after valid process drainage.
+The original Run remains interrupted with its recorded `unavailable` publication
+fault. Explicit accounting reconciliation settles the original reservation, then
+owner-authorized recovery attaches the exact same-Run publication-result Ref.
+
+The four observed business counts remain one each: Run, execution grant,
+consumption and Study reservation. The reservation document and original events
+are unchanged by recovery. Its conservative charge equals the original admitted
+envelope: one attempt slot, 37 admitted wall seconds, 2,802,248 retained bytes and
+3,210,449 peak staging bytes. These are the existing reservation policy bounds,
+not measured execution time or physical disk usage.
+
+After all source writers stop, ordinary backup retains raw schema 10 tables and
+file inventories. Restore targets a new directory and a separately created owned
+PostgreSQL database, leaving the original source intact. Before application
+activation, all 43 raw tables, all identity sequences, ordinary file bytes and
+POSIX permission modes match the stopped source. This includes a populated
+Study/Trial, its settled reservation and captured material alongside the exact
+recovered publication Ref, rather than the zero-Study direct-Run fixture.
+
+Cold activation then verifies the exact Trial/material, full post-recovery Run
+document and result Ref. Repeated explicit Study reconciliation returns the same
+reservation and charge; same-key publication recovery returns the same result.
+The ordinary interrupted-Run artifact reader still refuses without substituting
+the attached result. No new execution request key, Run, grant, consumption,
+reservation or charge is introduced.
+
+An inspect-only current client reads the actual Study, Trial and recipe material
+through authenticated HTTP and collects the exact recovered Ref through the SDK.
+A separate CLI process reads Study state and the publication result, exports the
+same collection manifest and collects identical complete artifact bytes. The SDK
+also exercises seven-byte segment reads; both consumers publish mode 0600 files.
+After all calls, every raw table and sequence still equals the source snapshot,
+including the exact serialized reservation and complete post-recovery Run.
+
+The original source and backup retain all bytes and POSIX modes, and the source
+raw tables/sequences remain unchanged. The execution observer records one real
+attempt launch; the restore/activation/consumer launch tripwire records zero.
+Both runs have empty before/after schema inventories and matching complete
+database-name inventories. Exact emitted source-schema and restored-database
+names were separately queried and confirmed absent after each cleanup. Each
+serial author/independent window stopped the task-owned PostgreSQL container
+after completion; no additional affected-case run was performed.
+
+## Preserved limits
+
+This is one clean current-version Study transfer. The separately qualified three
+controlled restore interruptions remain attributed to their own source/reports;
+they were not rerun here. Original Project roots remain available. This case does
+not qualify root removal, new corruption seams, host crash/power loss, device/fsync
+durability, ACL/ownership/xattr/timestamp preservation or arbitrary job-sequence
+rollback. It does not add a new no-recopy I/O measurement.
+
+No new benchmark, preparation cache, runtime installation/mutation, classifier
+training, scientific selection or E4 qualification was run. Existing paired
+collection evidence retains its original subjects and scoped retention decision;
+no broad workflow speedup or full M1–M6/T1–T8 acceptance follows from this case.
+
+Owners migrate older projects themselves once; no backward adapter or automatic
+migration system is introduced. Current schema validation, honest version errors,
+accounting, original failure evidence and no compute replay remain required.
+PUB-1 still lacks the original real failed Run/custody/profile/output inventory.
+SCI-1 still lacks a real comparison pair, criterion authority and environment.
+This neutral byte-custody result cannot supply either missing lab input.