fix(cd): verify used database connection budget correctly

apps/api/tests/test_executor_trust_boundary_readback.py

@@ -345,8 +345,8 @@ def test_executor_trust_boundary_requires_broker_secret_isolation() -> None:
 
 def test_executor_trust_boundary_requires_live_connection_headroom() -> None:
     receipt = _verified_receipt()
-    receipt["worker_active_role_connection_count"] = "7"
-    receipt["worker_available_connection_headroom"] = "1"
+    receipt["worker_active_role_connection_count"] = "8"
+    receipt["worker_available_connection_headroom"] = "0"
 
     readback = build_executor_trust_boundary_readback(
         receipt,
@@ -361,6 +361,24 @@ def test_executor_trust_boundary_requires_live_connection_headroom() -> None:
     )
 
 
+def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
+    receipt = _verified_receipt()
+    receipt["worker_active_role_connection_count"] = "4"
+    receipt["worker_available_connection_headroom"] = "4"
+
+    readback = build_executor_trust_boundary_readback(
+        receipt,
+        deployed_source_sha="abc123",
+    )
+
+    database_boundary = readback["database_identity_boundary"]
+    assert readback["full_workload_boundary_verified"] is True
+    assert database_boundary["connection_budget_verified"] is True
+    assert "worker_connection_budget_not_verified" not in (
+        database_boundary["active_blockers"]
+    )
+
+
 def test_executor_trust_boundary_binds_budget_and_verifier_contract() -> None:
     wrong_budget = _verified_receipt()
     wrong_budget["worker_required_connection_budget"] = "4"