fix: qualify native coverage selection and event recovery

Author: KSemenenko

.github/workflows/build-and-tests.yml

@@ -245,6 +245,7 @@ jobs:
       - name: Build the complete native coverage cohort
         run: dotnet build KeyLoad.slnx --no-restore --configuration Release
       - name: Prepare original source and test-image receipts
+        id: coverage-source
         shell: pwsh
         run: |
           $root = $env:GITHUB_WORKSPACE
@@ -255,59 +256,90 @@ jobs:
           "KEYLOAD_PRODUCT_COVERAGE_SOURCE_MANIFEST=$evidence/functional-coverage.production-source-manifest.json" | Add-Content $env:GITHUB_ENV
       - name: Test three-node database with .NET and MCP clients
         run: node scripts/Features/TestInfrastructure/run-tests.mjs --KeyLoadTests:Suite=rf3 --KeyLoadTests:ResultsDirectory=TestResults/rf3-required --KeyLoadTests:ReportTrx=true
-      - name: Collect four native functional coverage cohorts
+      - name: Reconcile original native full and five-group discovery in both modes
+        id: native-census
+        if: ${{ !cancelled() && steps.coverage-source.outcome == 'success' }}
+        shell: pwsh
+        run: |
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.workflow-discovery.ps1 `
+            -Repository $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3')
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Execute full censuses and twelve original covered suite inputs
         id: functional-coverage
+        if: ${{ !cancelled() && steps.native-census.outcome == 'success' }}
         shell: pwsh
         run: |
-          $common = @(
-            'scripts/Features/TestInfrastructure/run-tests.mjs',
-            '--KeyLoadTests:ReportTrx=true',
-            '--KeyLoadTests:CoverageSettings=scripts/Features/CodeQuality/functional-coverage.production.settings.xml',
-            '--KeyLoadTests:CoverageFormat=coverage')
-          & node @common '--KeyLoadTests:Suite=unit' '--KeyLoadTests:Filter=/*/*/(PartitionQueryAuthorizationTests|PartitionQueryCancellationTests|PartitionQueryContractTests|PartitionQueryGrantTests|PartitionQueryMcpContractTests|PartitionQueryMergeTests|PartitionQueryPublicAuthorizationTests|PartitionQueryPublicBudgetTests|PartitionQueryPublicContractTests|PartitionQueryPublicMergeTests|SqlInnerJoinBudgetTests|SqlInnerJoinCancellationTests|SqlInnerJoinDeclaredProjectionTests|SqlInnerJoinExecutionTests|SqlInnerJoinLifecycleTests|SqlInnerJoinOrdinalOrderTests|SqlInnerJoinRowAuthorizationTests|DocumentIndexCommittedScanTests)/*' `
-            '--KeyLoadTests:ResultsDirectory=TestResults/functional-coverage/rf3/unit' `
-            '--KeyLoadTests:CoverageOutput=TestResults/functional-coverage/rf3/unit/coverage.coverage'
-          $unitExitCode = $LASTEXITCODE
-          "unit_exit_code=$unitExitCode" | Add-Content $env:GITHUB_OUTPUT
-          & node @common '--KeyLoadTests:Suite=unit-scalar' '--KeyLoadTests:Filter=/*/*/(PartitionQueryAuthorizationTests|PartitionQueryCancellationTests|PartitionQueryContractTests|PartitionQueryGrantTests|PartitionQueryMcpContractTests|PartitionQueryMergeTests|PartitionQueryPublicAuthorizationTests|PartitionQueryPublicBudgetTests|PartitionQueryPublicContractTests|PartitionQueryPublicMergeTests|SqlInnerJoinBudgetTests|SqlInnerJoinCancellationTests|SqlInnerJoinDeclaredProjectionTests|SqlInnerJoinExecutionTests|SqlInnerJoinLifecycleTests|SqlInnerJoinOrdinalOrderTests|SqlInnerJoinRowAuthorizationTests|DocumentIndexCommittedScanTests)/*' `
-            '--KeyLoadTests:ResultsDirectory=TestResults/functional-coverage/rf3/unit-scalar' `
-            '--KeyLoadTests:CoverageOutput=TestResults/functional-coverage/rf3/unit-scalar/coverage.coverage'
-          $scalarExitCode = $LASTEXITCODE
-          "scalar_exit_code=$scalarExitCode" | Add-Content $env:GITHUB_OUTPUT
-          & node @common '--KeyLoadTests:Suite=recovery' `
-            '--KeyLoadTests:Filter=/*/*/CommandIdempotencyProcessRecoveryTests/*' `
-            '--KeyLoadTests:ResultsDirectory=TestResults/functional-coverage/rf3/recovery' `
-            '--KeyLoadTests:CoverageOutput=TestResults/functional-coverage/rf3/recovery/coverage.coverage'
-          $recoveryExitCode = $LASTEXITCODE
-          "recovery_exit_code=$recoveryExitCode" | Add-Content $env:GITHUB_OUTPUT
-          & node @common '--KeyLoadTests:Suite=rf3' `
-            '--KeyLoadTests:Filter=/*/*/(PartitionQueryPublicRf3Tests|McpDocumentCrudParityTests|RelationalSqlRf3JoinTests|RelationalSqlRf3JoinAuthorizationTests|RelationalSqlRf3JoinBudgetTests|RelationalSqlRf3JoinCancellationTests|RelationalSqlRf3JoinReadCutTests)/*' `
-            '--KeyLoadTests:ResultsDirectory=TestResults/functional-coverage/rf3' `
-            '--KeyLoadTests:CoverageOutput=TestResults/functional-coverage/rf3/coverage.coverage' `
-            '--KeyLoadTests:NativeCoverage:ServerMode=rf3-original-node-v1' `
-            "--KeyLoadTests:NativeCoverage:SourceManifest=$env:KEYLOAD_PRODUCT_COVERAGE_SOURCE_MANIFEST"
-          $rf3ExitCode = $LASTEXITCODE
-          "rf3_exit_code=$rf3ExitCode" | Add-Content $env:GITHUB_OUTPUT
-          if ($unitExitCode -ne 0 -or $scalarExitCode -ne 0 -or $recoveryExitCode -ne 0 -or $rf3ExitCode -ne 0) {
-            exit 1
-          }
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.workflow-collect.ps1 `
+            -Repository $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3') `
+            -SourceManifestPath $env:KEYLOAD_PRODUCT_COVERAGE_SOURCE_MANIFEST
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Verify original coverage source and test-image receipts after all children settle
+        id: coverage-source-after
+        if: ${{ !cancelled() && steps.coverage-source.outcome == 'success' }}
+        shell: pwsh
+        run: |
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.production-source-manifest.ps1 `
+            -Mode verify -Root $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3')
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Assemble product descriptor from original reports
         id: product-descriptor
         if: ${{ success() }}
         shell: pwsh
         env:
-          UNIT_EXIT_CODE: ${{ steps.functional-coverage.outputs.unit_exit_code }}
-          SCALAR_EXIT_CODE: ${{ steps.functional-coverage.outputs.scalar_exit_code }}
           RECOVERY_EXIT_CODE: ${{ steps.functional-coverage.outputs.recovery_exit_code }}
           RF3_EXIT_CODE: ${{ steps.functional-coverage.outputs.rf3_exit_code }}
         run: |
           & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.native-product-descriptor.ps1 `
             -Repository $env:GITHUB_WORKSPACE `
             -SourceManifestPath $env:KEYLOAD_PRODUCT_COVERAGE_SOURCE_MANIFEST `
             -ResultsRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3') `
-            -UnitExitCode ([int]$env:UNIT_EXIT_CODE) -ScalarExitCode ([int]$env:SCALAR_EXIT_CODE) `
+            -UnitRunStatusPath (Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3/functional-coverage.unit-run-status.v1.json') `
             -RecoveryExitCode ([int]$env:RECOVERY_EXIT_CODE) -Rf3ExitCode ([int]$env:RF3_EXIT_CODE)
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Exercise original product admission and copied TRX denial with healthy re-admission
+        id: product-admission
+        if: ${{ success() }}
+        env:
+          KEYLOAD_NATIVE_PRODUCT_ADMISSION_REQUIRED: 'true'
+          KEYLOAD_NATIVE_PRODUCT_DESCRIPTOR_PATH: ${{ github.workspace }}/TestResults/functional-coverage/rf3/functional-coverage.native-product-descriptor.v1.json
+        run: node scripts/Features/TestInfrastructure/run-tests.mjs --KeyLoadTests:Suite=unit '--KeyLoadTests:Filter=/*/*/NativeCoverageMergeTests/*' --KeyLoadTests:ResultsDirectory=TestResults/native-product-admission --KeyLoadTests:ReportTrx=true
+      - name: Verify original product-admission test and closed phase receipt
+        if: ${{ !cancelled() && steps.product-admission.outcome != 'skipped' }}
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-StrictMode -Version Latest
+          $directory = Join-Path $env:GITHUB_WORKSPACE 'TestResults/native-product-admission'
+          $reports = @(Get-ChildItem -LiteralPath $directory -Filter '*.trx' -File -Recurse)
+          $receipts = @(Get-ChildItem -LiteralPath $directory -Filter 'native-product-admission-phase.v1.json' -File -Recurse)
+          if ($reports.Count -ne 1 -or $receipts.Count -ne 1 -or $receipts[0].Length -le 0 -or $receipts[0].Length -gt 65536) {
+            throw 'Exactly one original TRX and bounded product-admission receipt are required.'
+          }
+          [xml] $trx = Get-Content -LiteralPath $reports[0].FullName -Raw
+          $counts = $trx.TestRun.ResultSummary.Counters
+          if ([int] $counts.total -ne 1 -or [int] $counts.executed -ne 1 -or [int] $counts.passed -ne 1 -or [int] $counts.failed -ne 0) {
+            throw 'The real product-admission whole operation must execute and pass.'
+          }
+          . ./scripts/Features/CodeQuality/functional-coverage.native-merge.inputs.ps1
+          $bytes = [IO.File]::ReadAllBytes($receipts[0].FullName)
+          $document = [Text.Json.JsonDocument]::Parse([ReadOnlyMemory[byte]]::new($bytes))
+          try { Assert-FcNativeJsonUnique $document.RootElement }
+          finally { $document.Dispose() }
+          $phase = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString($bytes)) -AsHashtable
+          Assert-FcNativeExactKeys $phase @('schemaVersion','phase','descriptorSha256','healthyAdmissions','rejectedAdmissions','rejectedOutcome')
+          $descriptor = Join-Path $env:GITHUB_WORKSPACE 'TestResults/functional-coverage/rf3/functional-coverage.native-product-descriptor.v1.json'
+          foreach ($name in @('schemaVersion','healthyAdmissions','rejectedAdmissions')) {
+            if ($phase[$name] -isnot [int] -and $phase[$name] -isnot [long]) { throw 'Invalid product phase integer.' }
+          }
+          if ($phase.schemaVersion -ne 1 -or $phase.phase -cne 'product-admission' -or
+              $phase.descriptorSha256 -cne (Get-FileHash $descriptor -Algorithm SHA256).Hash.ToLowerInvariant() -or
+              $phase.healthyAdmissions -ne 2 -or $phase.rejectedAdmissions -ne 1 -or
+              $phase.rejectedOutcome -cne 'An original native test outcome report does not match the exact contributor inventory.') {
+            throw 'The product-admission phase does not bind the original descriptor and complete flow.'
+          }
       - name: Validate and merge native product coverage
         if: ${{ success() }}
         shell: pwsh

README.md

@@ -339,31 +339,15 @@ outbox, **KL-024** time-series ordering/idempotency and **KL-025** reference
 ranges/aggregates. Each closure is bound to its original criteria and Linux
 operation evidence. Complete feature and cluster qualification remains open.
 
-Current source includes bounded Q2/AST2 same-partition relational INNER JOIN,
-52 JOIN rejection scenarios, graph mutation/atomic-retry and traversal deadline
-flows, vector atomic rejection flows and 12 public SDK/official MCP rejection
-flows. C# fixtures own fresh-image Aspire preparation, RF3 readiness and joined
-cleanup. Three GPT-6.1 Sol workers prepare disjoint implementation and complete
-operation batches while the integration owner validates stable compiled cohorts.
-Local full native normal and scalar suites passed **2876/2876 each**, and process
-recovery passed **236/236** on their retained compiled cohort. Final Release build
-and formatter passed after import-order and test identity corrections; eight real
-Aspire-owned RF3 SQL JOIN/schema/auth/budget/cancellation/read-cut operations passed
-**8/8** through .NET and official MCP clients. Exact-source Linux and complete RF3
-qualification, six-silo membership, full SQL/client protocol, FK, KL-075 scaling,
-functional coverage, endurance and release gates remain open. The
-[status tracker](docs/implementation/status.json) retains the original failures,
-source/report hashes and each qualification boundary.
-
-Functional coverage excludes load/comparison runs and admits complete operation
-flows only. The current registry selects **94 contributors**: 41 normal, 41
-scalar, one recovery and eleven RF3 cases. Selection is not measured coverage.
-The first historical Query profile bound 25 cases and 103 source files. Scoped
-local KeyCodec coverage records **202/203 executable lines** across three files,
-with all 19 native cases passing normal and scalar; branch coverage is unmeasured.
-The complete sixteen-module/RF3-server product cohort remains **unmeasured**.
-See the [coverage contract](docs/Features/CodeQuality.md) for source/contributor
-binding, native report preservation and the required product-admission flow.
+Current source includes bounded same-partition relational INNER JOIN and shared
+SDK, MCP and SQL operations across the database models. Complete RF3 fault
+qualification, full SQL and its native client protocol, foreign keys, scaling and
+endurance remain in progress. The [status tracker](docs/implementation/status.json)
+records the actual source, test results and remaining acceptance gates.
+
+Complete product functional coverage remains **unmeasured**. The
+[coverage contract](docs/Features/CodeQuality.md) admits whole operation flows,
+excludes load and comparison runs, and requires matching source and build reports.
 
 | Ready to try (in source, covered by tests) | Still in progress |
 |---|---|

docs/ADR/ADR-002-command-idempotency.md

@@ -122,3 +122,13 @@ full-partition replay and owned restart also pass. This task-local result does
 not mark the complete DocumentStorage/Messaging/EventStreams feature contracts,
 full Linux RF3, coverage, endurance, external effects or power-loss durability
 qualified. This ADR remains Accepted while its broader feature gates are open.
+
+
+## TASK-EVENT-APPEND-SEEDED-CRASH-001 implementation contract
+
+Accepted private scope; implementation/qualification pending. Canonical requirements and exact AC-EVENT-CRASH-001/002 are frozen in [EventStreams](../Features/EventStreams.md#task-event-append-seeded-crash-001), covering original KL083/KL091 plus REQ-MSG-005/AC-MSG-005 and REQ/AC-STORAGE-006/007. This is an additive current-format test mode, not a product seam or new storage contract.
+
+1. Freeze the seeded same-domain doc+Exact1 append+queue command and seven original pre/post-commit/apply cuts before implementation.
+2. CrashHost/EventStreams/Contracts and Helpers implement scenario/data; root joins its one existing CrashHostApplication dispatch arm. RecoveryTests/EventStreams/Cases, Processes and Assertions implement genuine native child kill/join/reopen and literal complete-prefix/receipt/replay/healthy flow. Reuse actual CanonicalCrashBoundary and bounded CommandIdempotencyProcessChild original readers/exit; no output-hook replacement or after-ACK substitute.
+3. Root verifies source guards, unchanged original modes/serialization/options, complete original child and store-lock joins, numeric400/200/64/depth3 limits, then formats/builds and executes the exact seven new cases and full native recovery. Retain exact CrashHost DLL/PDB/source/runtime identities, native arguments/marker/cut/index/exit/readers and original reports. New output does not qualify an unexecuted gate.
+4. Mandatory Linux exact-SHA full normal/scalar/recovery/RF3/coverage gates remain unchanged. No migration, dependency, trust, public protocol or deadline changes. Rollback removes the additive mode/cases and linked task contracts only. Root owns private-packet join and final gates; no parallel shared writer.