Reviewed source 67dc0d4896dd6c5206b72c72ad8269c6c32eee6d passed the complete worker-host candidate 4140; its finalize, integration and TEST deployment tasks actually succeeded. Configured production promotion 4142 succeeded for main d176ce1b7d3e116e666d502287aa3a4d791a853e, whose tree matches that source.
TEST and production deployment annotations identify candidate 67dc0d4896dd6c5206b72c72ad8269c6c32eee6d-4140-1. Both are ready and use backend digest sha256:857e5289d3a18d4def0676ec2fc505150c8c66e5922c1a8e2134c76bff1a5735. Authenticated health and static build-revision reads both return that source. DEV remains stopped; no stop was lifted.
Instruction digest remains 8a7099fa2c9ba56acd3e12332c62ebb7299c2aafcf02b81ca9e5fcce3dc72a12; prepared configuration remains 135c1e6a7a389f1aa7eaa39720644ba26ac7fe5fa807f850eb3b865f42e007e1. Effective default reasoning effort is high. Global, implementation and requirements automation remain paused; the existing operator-chat route remains enabled.
The original outcome retains its identity across planning, implementation, retries, account changes and typed handoffs. Active parent and child intervals add independently, including overlapping agents; typed waits and idle intervals are excluded. Missing historical intervals remain explicit accounting gaps, never fabricated time or zero-cost evidence.
Automatic progress review occurs at each six accumulated active agent-hour checkpoint. Malformed review output does not introduce a task failure, human gate or repeated finished-turn loop. At 48 accumulated active agent-hours without completion, the owned execution is stopped, work and cumulative accounting are checkpointed, and the existing authenticated human validation route handles remaining work and a positive additional-hours extension. Extension does not reset the clock.
Preservation covers actual dirty/untracked workspace content, nongit SuperProject roots and members/proposals, unusual filenames and symlink identity, thread and bounded diagnostics, existing auth provenance and nullable observed usage. Generation fencing rejects stale-worker overwrites.
Active native Goal new/resume/repair requests set tokenBudget:null. The raw builder and legacy BudgetLimited decoder remain for protocol/testing compatibility; they do not set a new task ceiling. Existing provider/account capacity, financial scope controls, disabled routes and manual reserve remain unchanged. Token counts remain technical telemetry. This change adds no monetary cap or routine approval/login requirement.
The SuperProject recurring token controls, exhaustion warnings, cycle refresh/charges and operator aggregate-token gate are retired. Old database values remain read-only history. Existing false settings and automation stops survive queued workspace JSON and overview updates; the distinct existing nested and request capacity wire keys are preserved.
Candidate4140 passed 480 library tests, 967 main tests, 24 Gitea MCP tests and one Kubernetes MCP test, alongside configured checks and all four isolated database shards. All four actual REQ0144 database tests executed and passed:
The REQ0166 board-scale database test also passed. These are isolated simulated-boundary tests, not 48 real production agent-hours or a real billed model call. A real pod replacement/account-switch/app-server thread handshake and the unfiltered large issue-board browser remain unexercised; scoped normal cost-card browser acceptance is separately recorded in the financial receipt.
Reviewed follow-ups fixed the shared isolated fixture cleanup to retain task history through schema teardown, PostgreSQL cached-usage parameter inference with explicit bigint casts, queued workspace capacity serialization, and obsolete token-charge test expectations. Failed candidates4126/4128/4131/4138 did not deploy; their logs/results remain retained. Candidate4128's separate intake failure lacked original detail and did not reproduce; no specific transient cause is asserted.
The application is deployed. Exact full worker publication 4143 for source67dc is registered as watch32, with expected workflow/main SHA d176ce1b7d3e116e666d502287aa3a4d791a853e. It is running at this receipt. The prior selected worker digest 053112704014e9d1615bbee847c71feab7630de1a17cf5f88865120b4f841085 does not contain this final runtime source. Selection and actual worker/drain effects must be recorded after terminal evidence. No busy worker is force-killed.
Read-only normal Planning Overview browser acceptance is in progress on the designated worker. Pre-deployment observed project flags were capacity=true and project automation=true, while global/implementation/requirements flags were paused. The test compares those actual values; it does not impose fixture values or write settings.
After full candidate acceptance, the three exact labeled temporary PostgreSQL fixtures (runtime-policy, checkpoint repro and intake repro) were removed and read back absent. No unrelated container, cache, database or user checkout was removed.
Rollback must preserve additive ledgers, work, thread history, totals and stops. This receipt does not authorize reverting token ceilings or resetting an outcome.
Worker publication4143 succeeded for main d176ce1b7d3e116e666d502287aa3a4d791a853e, with the explicit deployed-source input67dc and matching tree. Its actual log records selection at22:31:24 UTC of gitea.app.lan/autocoder/autocoder-engine@sha256:b007f8db6907eba646c98bdb4e3db00383c460d09f8aa15e081b6ebe4b8f2750. Live deployment selection matches that digest; all five running operator-chat workers are ready on drg-k8s-worker-01.auth.home.lan with that image. No running/pending worker with the previous0531 image remains in the observed inventory. All retain the persistent /mnt/runner-storage/autocoder-engine mount at /workspace/repos-rwx. Selection followed the repository workflow and existing serialization Lease; no ad-hoc runtime flag or forced busy-worker termination was performed.
The read-only Planning Overview browser acceptance passed against exact application source67dc. Actual project capacity and automation values remained true, and all three global pauses remained paused before/after reload. Seven financial controls rendered; old token controls and exhaustion warnings were absent. There were31 successful API reads, no failed reads, no blocked mutations and no JavaScript errors. The project detail, requirements, releases, architecture and usage requests used the real backend. Repository-discovery and chat-session initialization responses were stubbed locally in the browser because those handlers can write; their side effects are outside this scoped read-only acceptance. The temporary browser pod was read back absent.
A prior UI attempt exposed a test-locator scope error, then another saw503 during deployment rotation. The locator was corrected and healthy200 application/static reads were re-established before the successful run; neither result was treated as an accepted UI check or used to change product behavior.
Final readonly checks confirm local root/user and effective engine default effort high, canonical/prepared instruction digests retained, production/TEST health and served source67dc, DEV still stopped, operator chat enabled, and background/implementation/requirements automation paused.
The scoped runtime/instruction/settings/continuation repair is delivered with the above evidence. Historical issue monetary amounts remain Unknown where provider receipts/subscription invoices are absent; tokens do not establish billed money. No new cost limits, account reserves, routine human validation/login gates, OpenAI documentation lookup or memory access were added. Runtime historical accounting gaps remain explicit; this record does not invent prior active hours.
Follow-ups retain their existing bounded scope: actual per-request charge attribution and subscription invoice/allocation evidence; unfiltered large-board browser diagnosis; real pod replacement/account switch/app-server thread-resume integration coverage; the original nonreproduced candidate4128 intake failure without its missing diagnostic. They are not new task-admission gates. The original dirty/conflicted administrator checkout, durable user work, branch history and canonical operational evidence remain preserved.