test(workers): prove clock and restart safety

docs/verification/bg-001-tenant-workers.md

@@ -1,6 +1,6 @@
 # BG-001 tenant-safe worker foundation verification
 
-Updated: 2026-08-02
+Updated: 2026-08-15
 
 Status: `IMPLEMENTED — NOT VERIFIED`. The owner-scoping foundation and default-off activation contract pass local tests. Browser, production canary, durable notification/idempotency and multi-replica gates remain.
 
@@ -16,12 +16,12 @@ The four repaired workers are deny-by-default through new switches. Old email/ex
 
 | Check | Result |
 |---|---|
-| `dotnet test ... --filter "FullyQualifiedName~BackgroundWorkerTenantTests|FullyQualifiedName~CurrentUserIdLiveEvaluationTests|FullyQualifiedName~RulesEngineTests"` | PASS — 9/9 after final trust-boundary test |
+| `dotnet test ... --filter "FullyQualifiedName~BackgroundWorkerTenantTests"` | PASS — 9/9, including fixed-clock boundary and restart cases |
 | `dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-restore` | PASS — 532/532 after the final trust-boundary test |
 | `docker compose config --quiet` | PASS; only unset optional/local environment warnings |
 | `git diff --check` | PASS — no whitespace errors; repository line-ending notices only |
 
-Real SQLite tests prove two-owner/no-HTTP filtering, owner-failure isolation, per-owner rules with an idempotent second pass, atomic per-owner daily exports with hashed filenames, fake-AI enrichment for both owners, fake-email reminders for both confirmed owners, default-off behavior for all four workers and HTTP-context override refusal.
+Real SQLite tests prove two-owner/no-HTTP filtering, owner-failure isolation, per-owner rules at an exact fixed-clock threshold with an idempotent post-restart pass, atomic per-owner daily exports that overwrite the same date file after restart, fake-AI enrichment for both owners, fake-email reminders that do not resend after restart, default-off behavior for all four workers and HTTP-context override refusal. All four worker loops and business-date decisions now use the injected `TimeProvider` rather than hidden system clocks.
 
 ## Runtime evidence
 
@@ -32,5 +32,5 @@ An isolated app using disposable data under `docs/audits/evidence/bg-001-runtime
 - Reminder delivery is not exactly-once across an email-success/database-failure boundary. Keep it off until OPS-001 supplies a persistent notification/outbox operation.
 - AI enrichment must remain off until POL-001/POL-002 and durable AI operations are enforced server-side.
 - Rules and export remain off pending notification/audit and retention/operator rollout respectively.
-- No lease, heartbeat, distributed scheduler, restart/clock-boundary suite, browser surface or production canary was added here.
+- No lease, heartbeat, distributed scheduler, browser surface or production canary was added here. Local restart and clock-boundary coverage is complete; multi-replica coordination remains an activation concern rather than default-off foundation work.
 - Rollback is setting all four worker switches false, then reverting the runner/service changes. Do not delete export files or undo user-visible mutations without a separate reviewed procedure. No schema migration was introduced.

docs/work-programmes/master-work-plan.md

@@ -324,9 +324,9 @@ This queue records the highest-value work that can proceed without production cr
 - **Required production verification:** one-worker canary and owner-safe metrics.
 - **Status:** `IMPLEMENTED — NOT VERIFIED`.
 - **Blocker:** activation blocked until policy/notification prerequisites; foundation code is not blocked.
-- **Evidence:** audit JT-005 service inspection; `docs/verification/bg-001-tenant-workers.md`; real-SQLite two-owner worker suite with fake email/AI; full backend 532/532; Compose validation; isolated default-off startup/health/no-export check.
+- **Evidence:** audit JT-005 service inspection; `docs/verification/bg-001-tenant-workers.md`; real-SQLite two-owner worker suite with fake email/AI, exact fixed-clock threshold, fresh-instance restart idempotency and reminder/export deduplication; Compose validation; isolated default-off startup/health/no-export check.
 - **Commit:** none.
-- **Remaining work:** OPS-001B persistent notification/idempotency before reminders/rules; POL-001/002 and durable AI queue before enrichment; restart/clock tests; browser result surfaces; monitored single-worker production canary. Keep all four switches false.
+- **Remaining work:** activation policy prerequisites, browser result surfaces and a monitored single-worker production canary. Local restart/clock coverage is complete. Keep all four switches false.
 
 ### OPS-001A — Durable operation record and lease state machine