Checkpoint C1 ownership, due recovery and bounded native work

Commit the full current checkout scope: native outcome inspection/probe controls,
Aspire resource-log admission and joined cleanup, independent due/outbox replay
oracles, bounded native partition pages and ANN terminal build observations.
Freeze shortest-path requirements before integrating its private implementation.

Validation: solution Release build (0 warnings/errors), formatter, governance,
and 46 focused unit cases through the actual Aspire AppHost passed. Original
whole-source/runtime inventories stayed unchanged during these runs. The ANN
wide case used 10,000 records and real cancellation/deadline controls.

Complete unit/scalar/recovery/RF3, current-image Linux fault acceptance, physical
partition transfer and performance/endurance qualification remain pending.
No original acceptance task is marked complete by this checkpoint.

Author: KSemenenko

docs/ADR/ADR-016-atomic-physical-placement.md

@@ -24,6 +24,25 @@ ClusterRouting `REQ-ROUTE-001..003`/`AC-ROUTE-001..003`; ClusterReplication `REQ
 
 Dependencies: [ADR-001](ADR-001-partition-identity-affinity.md), [ADR-003](ADR-003-durability-ack-barrier.md), [ADR-004](ADR-004-committed-read-views.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), [ADR-007](ADR-007-replica-consensus-bootstrap.md), [ADR-008](ADR-008-backup-log-retention.md), and [ADR-017](ADR-017-migration-tokens.md). Stop if a plan transfers journal/lock ownership with an activation or changes logical AtomicPartitionId during a physical move.
 
+## First accepted native page stage, 2026-10-05
+
+TASK-PMOVE-PAGES and TASK-PMOVE-PAGE-ORACLES implement
+[REQ/AC-PMOVE-001..004](../Features/ClusterRouting/PartitionTransfer.md) as pure
+internal bounded record reads over an existing owned native committed view.
+Root freezes the listed reader signature, complete partition identity, exact raw
+bytes and record/retained/examined bounds. The implementation worker owns only
+new Core ClusterRouting Queries/Contracts/Validation files; the independent
+test worker owns only new UnitTests ClusterRouting Cases/Helpers. Root reviews
+both packets, joins them and runs strict build plus actual Aspire normal/scalar
+cases before checkpointing all code. No new package or project is required.
+
+There is no persisted-format rollout in this stage. Removing the unused
+internal primitive is its rollback; no data, token or journal is rewritten.
+Installation remains inadmissible until partition-associated outcomes, shared
+authorization/catalog/blob accounting and source fencing are frozen and tested.
+The final movement stages and all process/RF3 gates above remain required;
+this stage does not mark this ADR Implemented or close KL-036/071/072.
+
 ```mermaid
 flowchart LR
     Many[Many stable AtomicPartitionIds] --> Pack[Physical shard placement]

docs/ADR/ADR-019-managed-ann.md

@@ -2,6 +2,16 @@
 
 Status: Accepted for the bounded first-party managed HNSW candidate stage on 2026-10-04. Online projection, persisted index format and public ANN capability remain unqualified and gated by later contracts.
 
+The accepted 2026-10-05 test-resource stage is REQ/AC-ANN-013 in
+[ManagedAnn](../Features/Search/ManagedAnn.md). Root freezes/reviews/joins; a Luna
+worker adds only the named Search test resource and native keyed TUnit attributes
+on the specified five heavyweight fixture methods. Test bodies, corpus sizes,
+product execution budgets and global runner concurrency remain unchanged. Verify
+the private base/post packet, full strict build/format/governance, Aspire normal
+and scalar suites and exact-source Linux originals before any qualification
+claim. Rollback removes only the resource key and attributes; there is no data,
+dependency, public API or production admission migration.
+
 ## Context and decision
 
 Exact vector scans are the correctness oracle and current public source path. The product prefers a managed-first ANN implementation; a native provider adds deployment, license, persistence, concurrency, deletion, and memory-ownership risks. Root selects an independently authored KeyLoad-owned packed managed HNSW candidate for the first computational stage, with no new package, native binary or project. This decision approves implementation of the bounded candidate and its independent real-store tests; it does not qualify recall, an online projection, a persisted format or a public capability.
@@ -111,3 +121,17 @@ class/value traversal and allocation tests, then retains full Release/static and
 Aspire native/scalar corpus evidence. Exact-source Linux and ANN lifecycle/RF3
 acceptance remain required. No persistence or public transport changes occur;
 rollback reverts these computational joins, with no store migration.
+
+## Accepted unchanged-build observations, 2026-10-05
+
+REQ/AC-ANN-014 and TASK-ANN-BUILD-OBSERVATION are frozen in
+[ManagedAnn](../Features/Search/ManagedAnn.md#accepted-construction-observation-contract-2026-10-05).
+The Luna worker owns only the four existing heavy Search case files and two new
+feature-local model/helper files in that contract; root owns review, join, strict
+checks, actual Aspire normal/scalar evidence and all-code commits. Measure the
+single existing synchronous Build after retaining its original budget. Emit
+safe counters, elapsed ticks and current-thread allocations only after it settles,
+with original/fatal failure priority. Preserve every original resource limit,
+input, assertion and admission setting. No dependency, production, data or wire
+change occurs; rollback removes only the diagnostic wrappers. This stage measures
+failure context without claiming a cause, deadline repair or performance gain.

docs/ADR/ADR-082-native-cqrs-streams.md

@@ -119,3 +119,17 @@ Accepted before delegated writes: TASK-CRS-C1-BOUNDARY applies the existing REQ/
 Accepted before delegated implementation: TASK-CRS-C1-PHASE/CONTROL/FAULT use the exact native seams, optional silo-only observer, finite private AppHost controls, SDK/official-MCP outcome distinctions, authority/receipt/privacy oracles and worker scopes in NativeCqrsRequestV2. No public fault transport, canonical format, extra dispatcher or storage owner is added. Producer disposal is observed synchronously before deactivation scheduling, with every cleanup failure preserved. Migration of the stable command-partition activation still requires a separately frozen native scheduling/membership join and actual changed activation/silo evidence; a request activation's routine deactivation is not migration. Root owns control schema, AppHost/Server registration, fixture integration, original artifacts and final gates. Ordinary operation has no probe allocations or retained control state. Rollback disables the explicitly enabled ephemeral test profile; native request protocol/data contracts remain unchanged. This ADR remains Accepted until its full product and Linux qualification criteria pass.
 
 The exact private Version1 Owner/Arm/Release/Marker schema, file/memory bounds, disabled-mode contract, silo-only registration and ordered Server/AppHost/fixture integration are accepted in NativeCqrsRequestV2's "Accepted private phase-control schema and join" section before worker writes. Native migration is excluded from that schema. Private patches and local unit passes do not establish actual RF3 or delivered-source acceptance.
+
+## C1 native resource-log lifecycle contract, 2026-10-05
+
+TASK-CRS-DIAG-DRAIN implements REQ/AC-CRS-DIAG-003 in NativeCqrsRequestV2:
+native subscriber admission precedes actual AppHost startup, the real malformed
+guard call awaits its exact sanitized live record, and actual stop is followed
+by native stream completion and original-watcher drain before artifact write.
+The feature freezes ordered stages, precise IntegrationTests helper ownership,
+bounded waiter/storage, cancellation and fatal/cleanup failure preservation,
+root-only joins and genuine current-image Linux RF3 verification. No parser,
+assertion, public contract, canonical data, topology or dependency is changed.
+Rollback removes the test-only lifecycle stage. Original failed artifacts
+remain evidence; mechanism tests and source review do not qualify real guard
+publication or the complete ADR.

docs/ADR/ADR-098-bounded-graph-paths.md

@@ -0,0 +1,30 @@
+# ADR-098: Bounded authorized shortest paths
+
+Status: Accepted; implementation and qualification pending, 2026-10-05.
+
+KL-023 requires unweighted shortest paths and batched frontiers beyond existing
+reachability. Select one versioned directed same-partition path operator over
+native node-local ZoneTree adjacency in one current authorized committed cut.
+Explicit depth frontiers batch local work without per-edge RPC. Orleans retains
+one request grain and native ManagedCode CQRS; storage handles remain node-local.
+
+The implementation contract is [ShortestPath](../Features/GraphTraversal/ShortestPath.md),
+REQ-GRAPH-007..010, AC-GRAPH-006..009, TASK-KL023-PATH. It freezes new version1
+aliases/IDs, deterministic BFS ties, empty/zero-hop results, conservative metadata
+retention, real read/time/cancellation caps, Q1.GraphPath.v1 literal/parameter
+grammar and shared deadline. Existing ADR-004/005/010/014/034/082 continue to own
+committed reads, keys, persisted authority and native routing/lifecycle.
+
+Ordered stages and exact files/roles are in that contract: root freezes; private
+Luna Core/contracts packet; independently authored real-store tests; root SQL
+compile/parity; root Orleans/HTTP/SDK/official MCP and Aspire RF3 joins; full strict
+checks and original delivered-source Linux evidence. Root owns all shared/Git/
+acceptance joins. Workers cannot alter packages, shared configuration or formats.
+Neither source presence nor focused passes complete KL-023; normal/scalar,
+recovery and full RF3/client gates, including failover/revocation, remain required.
+
+No canonical data, existing alias/ID, journal, placement or acknowledgement
+changes occur. There is no data migration. Rollout adds explicit v1 capabilities;
+unknown versions fail closed. Rollback removes new read registration without
+rewriting acknowledged data. Weighted/cross-partition paths, full SQL/protocol
+and measured performance leadership remain separate mandatory workstreams.

docs/Features/ClusterRouting.md

@@ -24,6 +24,11 @@ this discovery does not choose the still-proposed token format, migrate a store,
 change a public API or satisfy runtime acceptance. The join requires concrete
 current file/method evidence and an ordered, disjoint implementation graph.
 
+The first concrete page stage is frozen in
+[PartitionTransfer](ClusterRouting/PartitionTransfer.md), TASK-PMOVE-PAGES and
+TASK-PMOVE-PAGE-ORACLES. Exact canonical pages retain an owned native cut;
+complete ownership, installation, token and RF3 gates remain explicit.
+
 The owner2026-10-04 native CQRS/result/long-operation requirement is specified in
 [NativeCqrs](ClusterRouting/NativeCqrs.md) and [ADR-082](../ADR/ADR-082-native-cqrs-streams.md).
 Only the real Graph/native-enumeration compatibility test stage is accepted for

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -750,3 +750,41 @@ RF3 status capture, positive-control/cleanup ordering and the parent-call join.
 Workers must not edit the checkout or start builds/tests/processes/Git; deliver
 complete private source, patch, hashes and self-review. Root reads every byte,
 integrates, runs the gates and commits the complete stage scope.
+
+## Accepted C1 native resource-log lifecycle, 2026-10-05
+
+REQ-CRS-DIAG-003 / AC-CRS-DIAG-003 extends DIAG-001/002: initialize the actual
+native subscriber observer, start the three original resource watchers and
+observe subscriber admission for all three actual RF3 resources before
+`DistributedApplication.StartAsync`. The real malformed MCP call retains its
+400 Validation assertion, then awaits the original node1
+`BodyMethodMismatch/ToolsCall` record under the existing wave cancellation
+deadline before the healthy SDK/official MCP follow-up. Use an event-driven
+bounded waiter; no delay, fabricated record or additional raw log retention.
+Keep the unchanged parser, V1 artifact, closed enums, 32-record-per-node and
+16-KiB artifact caps. Stream completion before the expected record is a visible
+failure. This lifecycle repair is a test-infrastructure stage, not evidence
+that the original empty captures had one proven cause.
+
+After actual AppHost stop, complete the three native resource log streams and
+drain/join their original watcher tasks before writing either success or
+failure evidence. Cancellation is only a bounded cleanup fallback after
+completion/drain failure; it cannot replace an original task join. Preserve
+stop, observer, completion, watcher, cancellation, disposal, artifact and fatal
+failures with `ServerFailureObserver`; `SaveEvidence` remains fail-closed until
+the original joins have completed. Caller cancellation must not become a
+successful capture or erase its primary failure.
+
+TASK-CRS-DIAG-DRAIN stages: freeze this contract, privately implement subscriber
+admission in `RequestCqrsRf3WaveStartup.cs`, bounded live-record observation
+and native completion/drain in `RequestCqrsRf3Diagnostics.cs`, the thin wave
+join in `RequestCqrsRf3Wave.cs`, and the real-call wait in
+`RequestCqrsRf3McpGuardEvidenceScenario.cs`. Keep these under IntegrationTests
+`Features/ClusterRouting/Helpers/`; additional populated Helpers files may
+separate watcher/waiter responsibilities without adding a second collector.
+Reuse `RequestCqrsRf3DiagnosticsSubscriberObserver` and the pinned Aspire
+13.6.0 native APIs. Root owns docs, packet review/join, strict build, format,
+Aspire mechanism cases and genuine exact-source Linux current-image RF3
+`AcCrsDiag002` acceptance. No product/public/persisted contract or dependency
+changes; rollback removes only the test lifecycle addition. ADR-082 remains
+Accepted until its complete qualification gates pass.

docs/Features/ClusterRouting/PartitionTransfer.md

@@ -0,0 +1,82 @@
+# ClusterRouting: bounded partition record pages
+
+Status: first implementation stage for KL-036/071/072; complete movement remains
+unqualified. Decisions: [ADR-016](../../ADR/ADR-016-atomic-physical-placement.md)
+and [ADR-017](../../ADR/ADR-017-migration-tokens.md). Initial serving remains RF3.
+
+This stage reads exact canonical key/value bytes from an already owned committed
+`IKeyValueView`. The node-local caller retains that cut for all its pages. It
+changes no existing persisted format, public API, placement or writer authority.
+
+| Requirement | Acceptance criterion and real oracle |
+|---|---|
+| REQ-PMOVE-001: use a closed source-owned partition-family inventory | AC-PMOVE-001: actual partition-key constructors are covered; every selected family uses `KeySpace.Partition` with the four complete partition components. Unknown families, invalid partitions and foreign continuation keys fail before copying. Global catalog, principal/API keys, global outcomes, physical watermarks and shared blob accounting are explicitly excluded. |
+| REQ-PMOVE-002: bound retained bytes, records and examined work independently | AC-PMOVE-002: real native ZoneTree pages cover empty/inclusive/one-over bounds, exact keys/values/order and charged lookahead. Retained bytes include every returned key/value buffer and the independent continuation buffer. Checked reservation precedes every copy, including continuation; an overlarge record or examined-byte exhaustion throws typed BudgetExceeded with no successful partial page. No full Scan, payload decode or whole-store materialization. |
+| REQ-PMOVE-003: preserve caller-owned cut, cancellation and identity | AC-PMOVE-003: paginated reads inside one actual native view reproduce exact selected records; equal key text across tenant/database/domain stays isolated. Cancellation before/during traversal settles the original call with no successful partial image. Reopen preserves bytes; grains acquire no file owners. |
+| REQ-PMOVE-004: a family page cannot stand in for a complete movable image | AC-PMOVE-004: no installer or public move endpoint exists until partition outcomes, shared catalog/authorization, blob accounting, retained cursor/transfer state and derived-index readiness have an accepted complete protocol. Later process-kill/fencing/RF3 SDK/MCP gates remain mandatory. |
+
+The inventory covers documents/indexes/unique keys and epochs, graphs and
+adjacency, vectors/lineage/effects, samples/sequence/dedup/retention, blob heads/
+uploads/parts/metadata, every queue index/body/metadata/counter/inbox, recurring
+schedules/sagas/capacity, subscription state/window/completion/inbox, both remote
+transfer endpoints, event streams/topics/identities/sequence/feed/snapshots,
+outbox/heads/consumers/receipts and visibility epochs. Enumerate actual current
+constructors, including dynamic family arguments. There is no universal encoded
+partition prefix: the family precedes the four partition components.
+
+## Frozen reader contract and ordered ownership
+
+TASK-PMOVE-PAGES: root owns architecture, source inventory and joins. Luna
+implementation owns only new internal Core ClusterRouting Queries/Contracts/
+Validation files prefixed `PartitionRecord`. Exact contract:
+`PartitionRecordPageReader.Read(IKeyValueView view, PartitionRef partition,
+string family, int maxRecords, long maxRetainedBytes, long maxExaminedBytes,
+ReadOnlyMemory<byte> afterKey = default, CancellationToken cancellationToken = default)`
+returns an internal immutable `PartitionRecordPage` containing owned
+`ImmutableArray<KeyValueRecord> Records`, `bool HasMore`, `long RetainedBytes`,
+`long ExaminedBytes` and optional independently owned `ReadOnlyMemory<byte>`
+continuation. `PartitionRecordFamilies.All` is an immutable ordinal inventory.
+Use native VisitRange, charge its real observer before copying, verify the
+exclusive continuation belongs to this exact prefix and has canonical KeyCodec
+encoding, and preserve raw bytes. Validate the continuation's bounded length
+before decoding its key components; user value payloads are never decoded.
+Reserve and copy continuation independently from the last returned key; its
+bytes contribute to RetainedBytes and maxRetainedBytes. Native accounting and
+unexpected visitor stops fail closed.
+Positive bounds must be checked before traversal; overflowing counters fail
+closed. There is no serialization or inter-grain DTO in this first stage.
+
+TASK-PMOVE-PAGE-ORACLES: an independent Luna worker owns only new UnitTests
+ClusterRouting Cases/Helpers prefixed `PartitionRecord`. Derive the criteria
+above against actual ZoneTree/TestDatabase primitives, without mocks, fake view,
+skips or weakened limits. Preserve callbacks' borrowed lifetime. Root reviews
+the complete private packets, then executes Aspire normal/scalar tests.
+
+Complete ownership is a later root-owned stage. Current epoch7 outcome keys have
+no partition locator; their hash cannot recover one. Copying every global outcome
+or dropping outcomes is incorrect. Existing-store migration needs its exact
+accepted upgrade/rollback contract. Current persisted authorization remains
+authority and an acknowledged revocation must fence all serving groups. Source
+and destination group indexes are never directly comparable; explicit ownership
+epoch invalidation is the first candidate under KL-072, pending full freeze.
+
+Slice map: Core owns this internal pure reader in ClusterRouting; Server's
+StorageRecovery retains native views/files and Replication retains ordered
+commit authority. Later Orleans orchestration uses one request grain and native
+ManagedCode.Communication asynchronous streams with bounded handoff. Public
+contracts, SDK/MCP, frontend/admin controls are N/A for this internal stage;
+their later actual move contract must be specified and qualified.
+
+Verification: full strict Release build, formatter/governance, genuine Aspire
+unit and unit-scalar focused PartitionRecord cases for local development, then
+exact-source Linux CI. Later movement requires process cuts at every persisted
+state and Docker/Aspire RF3 SDK/MCP recovery, fencing, token and receipt oracles.
+Internal pages alone do not satisfy those movement acceptance criteria.
+
+```mermaid
+flowchart LR
+    Owner[Node local committed view] --> Family[Closed family and full partition prefix]
+    Family --> Budget[Reserve examined and retained bytes]
+    Budget --> Page[Exact owned bounded page]
+    Page --> Later[Later complete ownership and fenced transfer]
+```