# Routed buyer continuity — local results

The fixed batch and final R2 privacy and claim review are complete.
Disposition: **ROUTED_BUYER_CONTINUITY_DEMONSTRATED**.
This is real inference over synthetic scheduling inputs, not production work.

## What happened

A buyer requested 24 schedules through OpenRouter, using two pinned routes
for the same advertised model. Its requirements and all requests were frozen
before the first call. The first process completed twelve purchases and
exited; a second process recovered its retained state and completed the other
twelve. The acceptance code did not change.

| Requested route | Usable | Rejected | Unresolved |
|---|---:|---:|---:|
| deepinfra/turbo | 4 | 7 | 1 |
| akashml/fp8 | 7 | 5 | 0 |
| Total | 11 | 12 | 1 |

The local simulator consumed eleven schedules. There were no duplicate
consumptions. These counts describe this fixed small batch, not a provider
ranking. Routing and model metadata are service-reported, not cryptographic
proof of upstream identity or execution.

Seven answers failed the frozen output/response schema; five failed schedule
constraints (overlap or timing). The remaining unresolved purchase, P01,
returned HTTP 429. No answer was repaired, retried or replaced, and no
acceptance requirement was relaxed.

## A short walkthrough

The first problem requires eight jobs to fit on three eligible machines within
32 time units, respecting release times, deadlines and precedence. P02's
returned schedule passed every check. Its retained record binds that purchase
to the installed requirements and exact request and response bytes. P05 and
P06 provide paired usable deliveries for the same problem across both routes,
handled by the same evaluator.

After purchase twelve, the original buyer process ended. The next process
recovered the same evidence and decisions before continuing. The process
identities and unchanged source root are retained in the primary report.

The consumer is a deterministic local software simulator. Its completion
report is not evidence that physical jobs ran or that payment occurred.

## Continuity and controls

Two separate derivations from the complete private evidence produced identical
primary report bytes. Hash:
sha256:d65eb498b5aecafe6b9ac5347abcb68f3ea86f7a363af9b3c34b2a2f635d6000.

The original 31-test suite passed. Additional post-capture analysis used the
exact sealed P02 observation in disposable private copies, interrupting real
local processes at six persistence points. Before dispatch, no delivery was
inferred. After an unsealed intent, recovery abstained without retry. After a
complete capture, recovery restored the usable decision and exactly one local
consumption. Exact replay returned the stored assessment; a conflicting result
was refused. Repeated and 32-way concurrent application added no consumption.
These failures were injected, not live supplier outages.

The primary replay workers were network-denied, credential-free, and denied
access to private custody and fixture witnesses. Recovery-injection copies
retained the local observer signing seed only to issue local decision records;
they had no API credential, no network, and no access to original private
custody. The original custody files remained unchanged.

Ordinary signed JSON and ActionReceipt produced identical substantive
decisions for all 24 observations. Without response payloads, both abstained
on every purchase. A commitment did not reconstruct a schedule.

| Measured work, all 24 full-payload evaluations | Signed JSON | ActionReceipt v0.4 |
|---|---:|---:|
| Observation-record bytes | 17,136 | 58,416 |
| Signature-verification attempts | 24 | 72 |
| Python SHA-256 input bytes | 147,969 | 402,417 |

These costs cover the declared adapter/evaluator measurement, not native
Ed25519 internal hashing, record construction, or complete storage overhead.
All raw requests total 42,668 bytes; raw responses total 38,736 bytes.
Per-purchase measurements are retained in PRIMARY-REPORT.json.

Service-reported known cost totals USD 0.00288350, with one unresolved charge.
That is not an independently verified bill or the total charge for all calls.
Known reported usage totals 8,633 prompt and 3,925 completion tokens.
Recorded request durations range from 0.217 to 19.028 seconds; local assessment
durations range from 13.462 to 61.461 milliseconds. These are descriptive
observations, not a latency ranking or economic result.

## Privacy and reproducibility

P01's 961-byte error response contains an account identifier. Its entire body
remains unmodified in private mode-0600 custody. No sanitized replacement was
created. The safe corpus includes all 24 requests and authenticated records
but only 23 response bodies; the exclusion manifest supplies P01's exact hash.

The safe corpus rederives 23 original decisions. With P01's payload absent it
abstains for missing evidence, rather than reproducing the original HTTP-error
reason. Reproducing the complete primary report requires the private original.
No artifact is published by this sprint.

## What the result does and does not support

The result supports bounded buyer continuity across a real process replacement
and two supplier routes. OpenRouter provides the common interface; the research
controller and retained evidence provide recovery; the simulator provides
idempotence. Released Bulla supplies local observer ActionReceipts, not this
scheduling or continuity controller.

Signed-JSON parity persists. No Bulla-specific epistemic advantage or lower
integration cost was demonstrated; ActionReceipt incurred the measured overhead.
Independent organizations, direct-provider interoperability, willingness to
integrate or pay, inference correctness, legal remedy, collectibility and
operation without a common router remain untested.

Validation ran locally on macOS arm64, Python 3.11.14, using the hash-pinned
published Bulla 0.49.2 wheel. Remote CI and portability remain unrun. No website,
product, protocol, Doorstep stimulus or prior experiment changed.

The same hostile reviewer independently reproduced the safe replay and checked
the schedule outcomes with an occupancy-grid checker. The exact reviewed
candidate and review scope are recorded in [FINAL-REVIEW.json](FINAL-REVIEW.json).