Chapter 40 worked answers

These answers use baseline cbfc94ade5b57e449d6b73bf1485b1c5b1647022 and the chapter's linked execution records. Procedures remain scoped to disposable resources.

1. Preserve separate coverage lanes

The ungated baseline and race runs passed with explicit live integration skips. The original PostgreSQL fixture failed two store tests because it stopped at migration14. The full-schema extension applied16and verified owned store/restore behavior. The guarded Docker harness executed real handler/Runner/engine deploy,logs,scale/delete with bounded ownership. These are complementary records; none erases another lane's skips or failures. A passing inventory check only joins evidence.

2. Configuration does not compose missing behavior

Restart=always restarts a process but does not persist its maps. DATABASE_URL does not replace the default MemoryService. Mounted certificates/TLS environment placeholders do not make the current public listener consume native TLS; documented termination needs an actual proxy and verified configuration. Docker group/socket authority remains powerful despite a non-root service identity and filesystem hardening. No systemd units or production Compose deployment were installed in this chapter.

3. Restore the owner that actually persisted data

Use new exact owned source/target databases, verify their absence before creation, apply pinned migrations, insert synthetic canary and selected records, dump, restore into the separate target, compare expected values and reject a wrong key. Preserve actual command/UTC/IDs and clean only those databases/containers. Back up the envelope key/configuration separately through secure owner procedures. The actual full-schema drill passed these package-level checks. It cannot restore prior default MemoryService records, Docker volumes, running containers, JWT keys or TLS materials that were absent from the dump.

4. A dossier is not deployment approval

Run verify_dossier.py. The corrected record passed its source/status/output-presence inventory and explicitly returned production_decision not approved. A sensible next guarantee is durable fresh-server recovery: implement transactional server composition, inject a partial-write failure, restart a real process, compare service/task/version/credential/event identities and clean owned runtime objects. Reject if any invariant or recovery evidence fails. Do not promote readiness because the JSON inventory exists; acceptance must observe the new behavior and retain leadership/resource/trust/network gaps until independently resolved.

See the corresponding chapter claim ledger for exact immutable source anchors and limitations.

Return to Chapter 40.