prevent a unlikely race: concurrent restore() + work_response ()