Qualify command replay recovery and outbox pin contracts

Commit all current stage code, fixtures, acceptance plans and native evidence.
Release solution build and format pass; Aspire recovery1, outcome normal2/scalar2
and projection-pin normal6/scalar6 pass. Native macOS Node lifecycle remains4/5.
Retain the exact frozen source/runtime inventories and original reports. Record
CB5 CI's final failure. Full Linux/RF3, partition outcome scope and durable ANN
projection/publication acceptance remain open.

Author: KSemenenko

docs/ADR/ADR-019-managed-ann.md

@@ -100,3 +100,14 @@ private Search test files; root owns review, Aspire normal/scalar/full gates,
 original evidence and all-code checkpoints. No physical generation, alias,
 format, public capability or canonical migration is accepted by this prerequisite;
 the complete native ZoneTree projection/recovery contract remains required.
+
+Root accepts TASK-ANN-R1-CONSTRUCTION-VALUE and REQ/AC-ANN-011 in the
+[construction join](../Features/Search/ManagedAnn.md#accepted-prepared-value-construction-join-2026-10-05).
+Use the existing finite-owned readonly value for construction, with one internal
+constrained generic traversal and explicit class/value contract implementations.
+Preserve every score, ordinal order, validation and work/deadline/cancellation
+charge. Root freezes and reviews the private implementation, joins independent
+class/value traversal and allocation tests, then retains full Release/static and
+Aspire native/scalar corpus evidence. Exact-source Linux and ANN lifecycle/RF3
+acceptance remain required. No persistence or public transport changes occur;
+rollback reverts these computational joins, with no store migration.

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -593,3 +593,66 @@ Query worker revises only its six private AppHost helper files from the reviewed
 R2 packet, with original base/post hashes, without checkout writes or gates.
 Actual no-follow/FIFO mechanisms and complete Aspire/RF3/Linux gates remain
 required; static source repair does not qualify a started topology.
+
+### Accepted C1 public phase interruption cases, 2026-10-05
+
+TASK-CRS-C1-PUBLIC-INTERRUPTION implements four genuine RF3 cases for
+AC-CRS-003/005, one SDK and one official MCP case at BeforeSubmit and
+SubmitReturned. Each case owns a fresh current-image Aspire RF3 wave, private
+profile/data/control roots, current signed discovery, one persisted non-admin
+synthetic principal whose ID starts c1-probe-, and one document with exact before
+and after strings. Configure that principal and resources through genuine public
+administrator operations. No caller-supplied role, reused control session or
+existing user's store may be used.
+
+Root owns the shared RequestCqrsRf3Wave.StartProbedAsync(dataRoot, images,
+RequestCqrsProbeFixture controls, CancellationToken) join. It adds only the frozen
+private probe configuration to the existing current-image wave startup, preserving
+immutable image proof, three physical voters, native uid:gid, readiness,
+diagnostics, shutdown and original failures. Helpers await root's actual reviewed
+Server/AppHost/fixture join; a private test packet is not RF3 evidence.
+
+For BeforeSubmit, arm Hold for the exact principal/command, retain the original
+real client Task, await the genuine signed phase marker, and prove the unchanged
+entity with a separate real administrator read before cancelling that original
+caller. Require the actual SDK UnknownWriteOutcome or actual official MCP safe
+unknown tool result/transport cancellation. Await the actual cancelled/released
+hold settlement and native ProducerDisposed marker for the claimed request,
+join the original caller, then retire the arm before retry. Retry the identical
+stable command/body with fresh signed requests through SDK and official MCP;
+require equal full receipts and exactly one document revision/effect.
+
+For SubmitReturned, await that exact marker and independently read the committed
+intended entity before cancelling. Require the same actual caller interruption,
+settlement/disposal and original joins; fresh SDK/MCP retries must return the
+complete already committed receipt and retain one revision advance. The probe
+request ID is compared with an actual MCP request ID when a validated tool result
+exists; transport failures must not invent an ID or tool response. These cases
+exercise actual phase cancellation, not remote-voter death; remote execution
+placement and death remain separately required.
+
+Each case has the existing parent/wave/cleanup bounds. Cleanup stops admission,
+cancels/joins every original caller, releases and joins admitted control gates,
+disposes actual public clients, stops/disposes the Aspire-owned resources and
+original diagnostics watchers, proves native file locks released, then removes
+only exclusively owned control/data roots. Preserve primary and every cleanup
+failure with ServerFailureObserver and fatal policy. A deadline observation or
+Task.IsCompleted test is not a replacement original join. Never delete controls
+before actual producer disposal/resources join; retain failure originals.
+
+Task graph: root freezes these requirements and shared joins; query_wave Luna/high
+owns only new IntegrationTests/ClusterRouting Cases/Helpers/Models files prefixed
+RequestCqrsPhaseFault, with existing real client, receipt, probe and profile helpers.
+It emits a private exact-base patch, complete source, hashes and self-review, with
+no checkout/shared/docs/package/Git edits or gates. Root reviews every line,
+implements the shared startup join, builds/formats/governs the full solution,
+runs the actual Aspire rf3 caller with four bounded development cases, retains
+native JSON/TRX/image/topology/phase evidence and follows exact-source Linux
+complete gates. Requirement mappings are the preceding AC-CRS-003/005 matrix;
+current-authority revocation, ordinary-fault privacy, migration, remote death,
+C2/C3 and full KL acceptance remain required separately.
+
+ADR-034/058 and the preceding accepted C1 control implementation contract already
+cover these private controls and public CQRS behavior. No public API, canonical
+format, credential contract or deployment topology changes; rollback removes
+the test entry points/private controls without migrating canonical data.

docs/Features/Search/ManagedAnn.md

@@ -246,3 +246,41 @@ Rollback reverts the computational joins; there is no data migration. Public
 SDK/MCP/frontend additions are N/A because this internal optimization preserves
 their existing exact operation contracts. Comparable GitHub measurements and
 remaining ANN projection/public/RF3 acceptance are still mandatory.
+
+## Accepted prepared-value construction join, 2026-10-05
+
+TASK-ANN-R1-CONSTRUCTION-VALUE extends the accepted finite-owned prepared value
+through packed construction traversal. The exact cb5 Linux scalar report retains
+two unchanged 10,000-row filtered-planner failures during the ordinary 30-second
+build deadline; it does not establish that allocations caused those timeouts.
+Construction currently creates a PreparedSimilarity reference per inserted row.
+Remove that reference allocation by using the already accepted readonly
+PreparedPackedSimilarity carrier. Keep one shared Greedy/SearchLayer/neighbor
+traversal implementation via an internal IPackedAnnSimilarity contract and
+constrained generic calls. Implement the contract explicitly on the existing
+sealed untrusted-query class and readonly owned value; no boxing, delegate,
+second traversal, vector copy, cached norm array or changed formula is allowed.
+
+REQ-ANN-011 / AC-ANN-011: for all three metrics, actual class and owned-value
+traversals over the same genuine finite packed graph return identical greedy
+nodes, ordered candidate ordinals and exact double scores with identical charged
+work/distance/edge counters. Preserve all untrusted/owned validation and existing
+zero-allocation value, independent similarity, graph adjacency, 10,000-row recall,
+filter, scalar, cancellation and deadline cases with their original limits.
+The construction join must use the value directly and constrained traversal must
+not box it; source review and a warmed zero-byte actual value traversal measurement
+cover that specific claim, with setup/assertions outside the measured interval.
+This does not claim improved elapsed time, full ANN qualification or deadline repair.
+
+Ordered graph: root freezes the contract and ADR, cluster_wave Luna/high prepares
+only PackedAnnConstruction, PackedAnnLayerSearch, PreparedSimilarity,
+SimilarityMetricMath and the new Search/Contracts/IPackedAnnSimilarity.cs in a
+private exact-base packet. Query's ordinary prepared-query public validation and
+all other product sources are unchanged. Independent tests are a separately
+assigned new PackedAnnConstructionValueTests and cohesive Search helpers against
+actual existing packed fixtures; root owns their later assignment, integration,
+full Release/format/governance and Aspire normal/scalar unchanged ANN gates.
+No worker may alter corpus, budgets, options, formulas, graph ordering, packages,
+shared configuration, docs or Git. Escalate a missing seam or changed accounting.
+Rollback reverts computational joins only. Data/wire/public SDK/MCP/frontend
+changes are N/A; no persisted format or canonical authority changes.

docs/Features/Search/ManagedAnnSeed.md

@@ -141,3 +141,34 @@ SQL/SDK/MCP contracts and new native aliases/formats are N/A for this proof.
 Root must still freeze native ZoneTree generation records/publication, owner locks,
 replay, combined reservations and real process recovery before R2 production
 implementation. Existing R2A and AC-ANN-007/008 qualification remain open.
+
+### Accepted native cancellation observer repair, 2026-10-05
+
+TASK-ASD-CANCELLATION-OBSERVER repairs the independent AC-ASD-004 test oracle.
+The original cb5 Linux scalar failure is retained: the asynchronous delay-based
+observer shares a busy ThreadPool with synchronous real capture, so the test did
+not establish cancellation before capture completion. This is not evidence that
+production ignored an already-cancelled token.
+
+Use one owned dedicated native Thread for observation, started and confirmed
+running before the original synchronous 10,000-record capture. Poll the real
+ReadExecutionBudget.ReadBytes with bounded native scheduling; after its first
+positive charge call the actual CancellationTokenSource.Cancel and retain an
+explicit cancellation-requested witness plus the original observer exception.
+The unchanged original capture must throw OperationCanceledException and return
+no seed. Require actual positive charged bytes and observed token cancellation,
+then a healthy unchanged 10,000-record following capture. Keep the original
+15-second observation/join bound, real clock, corpus and product budgets. No
+production pause, fake progress, synthetic cancelled result, repeat-until-pass,
+assertion waiver or ThreadPool worker substitutes for this native observer.
+
+Root freezes this refinement under ADR-019's existing AC-ASD-004 cancellation
+contract. Lifecycle worker Luna/high owns only AnnSeedCancellationTests and new
+cohesive Search test observer helpers as a private exact-base packet. Root joins
+and reviews startup, completion/error handshakes, cancellation and original
+Thread.Join on success and failure before disposing synchronization/token state;
+all primary and observer/cleanup failures remain observable, with fatal policy.
+No background thread or original capture is abandoned. Root runs full Release,
+static checks and actual Aspire normal/scalar cases and the unchanged complete
+seed suite, retaining original evidence. No product format or transport change;
+rollback removes the test scheduling repair, not a native cancellation check.