remove migrations

Author: KSemenenko

.github/workflows/ci.yml

@@ -215,41 +215,14 @@ jobs:
       - name: Build KeyLoad server and benchmark Docker images
         id: images
         run: node scripts/Features/BenchmarkComparisons/prepare-images.mjs
-      - name: Build the genuine previous KeyLoad server image
-        id: prior-images
-        run: node scripts/Features/StorageRecovery/prepare-native5-server-image.mjs
-      - name: Build the genuine epoch-six RPC1 KeyLoad server image
-        id: rpc1-images
-        run: node scripts/Features/ClusterRouting/prepare-rpc1-server-image.mjs
-      - name: Build the genuine epoch-seven interface-three KeyLoad server image
-        id: interface3-images
-        run: node scripts/Features/ClusterRouting/prepare-interface3-server-image.mjs
       - name: Configure Docker image references
         shell: bash
         env:
           KEYLOAD_SERVER_IMAGE: ${{ steps.images.outputs.server-image }}
           KEYLOAD_RUNNER_IMAGE: ${{ steps.images.outputs.load-generator-image }}
-          KEYLOAD_PRIOR_SERVER_IMAGE: ${{ steps.prior-images.outputs.prior-server-image }}
-          KEYLOAD_PRIOR_IMAGE_RECEIPT: ${{ steps.prior-images.outputs.prior-image-receipt }}
-          KEYLOAD_PRIOR_SERVER_MANIFEST: ${{ steps.prior-images.outputs.prior-server-manifest }}
-          KEYLOAD_RPC1_SERVER_IMAGE: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_SERVER_IMAGE }}
-          KEYLOAD_RPC1_IMAGE_RECEIPT: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_IMAGE_RECEIPT }}
-          KEYLOAD_RPC1_SERVER_MANIFEST: ${{ steps.rpc1-images.outputs.KEYLOAD_RPC1_SERVER_MANIFEST }}
-          KEYLOAD_INTERFACE3_SERVER_IMAGE: ${{ steps.interface3-images.outputs.KEYLOAD_INTERFACE3_SERVER_IMAGE }}
-          KEYLOAD_INTERFACE3_IMAGE_RECEIPT: ${{ steps.interface3-images.outputs.KEYLOAD_INTERFACE3_IMAGE_RECEIPT }}
-          KEYLOAD_INTERFACE3_SERVER_MANIFEST: ${{ steps.interface3-images.outputs.KEYLOAD_INTERFACE3_SERVER_MANIFEST }}
-          KEYLOAD_INTERFACE3_SERVER_INVENTORY: ${{ steps.interface3-images.outputs.KEYLOAD_INTERFACE3_SERVER_INVENTORY }}
-          KEYLOAD_INTERFACE3_SERVER_ARCHIVE: ${{ steps.interface3-images.outputs.KEYLOAD_INTERFACE3_SERVER_ARCHIVE }}
         run: |
           test -n "$KEYLOAD_SERVER_IMAGE" && test -n "$KEYLOAD_RUNNER_IMAGE"
-          test -n "$KEYLOAD_PRIOR_SERVER_IMAGE" && test -n "$KEYLOAD_PRIOR_IMAGE_RECEIPT" && test -n "$KEYLOAD_PRIOR_SERVER_MANIFEST"
-          test -n "$KEYLOAD_RPC1_SERVER_IMAGE" && test -n "$KEYLOAD_RPC1_IMAGE_RECEIPT" && test -n "$KEYLOAD_RPC1_SERVER_MANIFEST"
-          test -n "$KEYLOAD_INTERFACE3_SERVER_IMAGE" && test -n "$KEYLOAD_INTERFACE3_IMAGE_RECEIPT" && test -n "$KEYLOAD_INTERFACE3_SERVER_MANIFEST"
-          test -n "$KEYLOAD_INTERFACE3_SERVER_INVENTORY" && test -n "$KEYLOAD_INTERFACE3_SERVER_ARCHIVE"
           printf 'KeyLoad__ContainerImages__Server=%s\nBenchmarks__ContainerImages__LoadGenerator=%s\nKEYLOAD_IMAGE_RECEIPT=%s\n' "$KEYLOAD_SERVER_IMAGE" "$KEYLOAD_RUNNER_IMAGE" "$RUNNER_TEMP/keyload-images/image-receipt.json" >> "$GITHUB_ENV"
-          printf 'KEYLOAD_PRIOR_SERVER_IMAGE=%s\nKEYLOAD_PRIOR_IMAGE_RECEIPT=%s\nKEYLOAD_PRIOR_SERVER_MANIFEST=%s\n' "$KEYLOAD_PRIOR_SERVER_IMAGE" "$KEYLOAD_PRIOR_IMAGE_RECEIPT" "$KEYLOAD_PRIOR_SERVER_MANIFEST" >> "$GITHUB_ENV"
-          printf 'KEYLOAD_RPC1_SERVER_IMAGE=%s\nKEYLOAD_RPC1_IMAGE_RECEIPT=%s\nKEYLOAD_RPC1_SERVER_MANIFEST=%s\n' "$KEYLOAD_RPC1_SERVER_IMAGE" "$KEYLOAD_RPC1_IMAGE_RECEIPT" "$KEYLOAD_RPC1_SERVER_MANIFEST" >> "$GITHUB_ENV"
-          printf 'KEYLOAD_INTERFACE3_SERVER_IMAGE=%s\nKEYLOAD_INTERFACE3_IMAGE_RECEIPT=%s\nKEYLOAD_INTERFACE3_SERVER_MANIFEST=%s\nKEYLOAD_INTERFACE3_SERVER_INVENTORY=%s\nKEYLOAD_INTERFACE3_SERVER_ARCHIVE=%s\n' "$KEYLOAD_INTERFACE3_SERVER_IMAGE" "$KEYLOAD_INTERFACE3_IMAGE_RECEIPT" "$KEYLOAD_INTERFACE3_SERVER_MANIFEST" "$KEYLOAD_INTERFACE3_SERVER_INVENTORY" "$KEYLOAD_INTERFACE3_SERVER_ARCHIVE" >> "$GITHUB_ENV"
       - name: Find Chrome for admin tests
         shell: bash
         run: |

AGENTS.md

@@ -405,6 +405,7 @@ Local `AGENTS.md` files may tighten these values, but they must not loosen them
 - Local rules and ADRs MUST NOT weaken `MCAF-ARCH-001`; they may only document stricter rules or a time-bounded migration to compliance.
 - Prefer composition over inheritance unless inheritance is explicitly justified.
 - Do not preserve obsolete, dead, duplicate, or replaced legacy code unless the user explicitly asks for a temporary compatibility path.
+- Owner correction 2026-10-06 removes backward compatibility with unreleased development storage formats from the first-release scope. Implement and qualify one current native storage format; remove old-format readers, migration/probe executables, historical-format test preparation and their active acceptance gates instead of developing compatibility for an unfinished product. This explicitly supersedes earlier requirements to migrate native5/native6/native7 development epochs before the first release. Preserve current-format process recovery, backup/restore, RF3 correctness and strict rejection of unsupported or corrupt formats; a later released-format upgrade requires a separate owner-approved contract.
 - When replacing an old implementation, remove the old code, tests, configuration, docs, and routing in the same change once the new path is proven.
 - Do not leave compatibility shims, placeholder implementations, or fallback paths as a substitute for a complete migration.
 - If a temporary transition path is unavoidable, document the reason, owner, scope, verification, and removal plan in the nearest ADR, feature doc, or local `AGENTS.md`.
@@ -523,3 +524,10 @@ A bounded website qualification candidate contains the20-project historical runt
 ## Final Benchmarks Website trigger, owner clarification 2026-10-06
 
 - Benchmarks MUST finish with only a bounded dispatch of the separate Website workflow; it MUST NOT build, test or deploy the site itself. This supersedes Website's `workflow_run` completion subscription. Confine dispatch permission to that final trigger job, keep main/manual Website publication independent, and authenticate any supplied producer run through GitHub before bounded completion waiting and newest-ready selection. A trigger input is not metric provenance or permission to bypass website qualification.
+
+## Super rule: owner-only migration and legacy authorization
+
+- Owner correction 2026-10-06: KeyLoad is a new product. Do not implement or retain data, schema, storage-format, persisted-record, configuration or prior-KeyLoad-version migrations, legacy readers, compatibility shims, dual paths or fallbacks unless the owner directly requests that specific migration or legacy path.
+- This prohibition is the highest project rule for migration/legacy scope and explicitly supersedes every earlier plan, ADR, feature requirement, acceptance gate, local policy and inferred authorization to maintain unreleased or previous KeyLoad implementations. A generic instruction to finish the product, an agent proposal or a recorded migration contract is not the owner's direct permission.
+- Delete existing KeyLoad-owned migration and legacy implementations now, together with their exclusive tests, helpers, prior-binary/image preparation, configuration, routes, dependencies and active documentation/plan references. Do not preserve them as dead branches or deferred cleanup and do not replace them with a new migration mechanism.
+- Implement and qualify the current product contract. Preserve current-format crash recovery, verified backup/restore, persisted authorization, strict unsupported/corrupt-version rejection and genuine Aspire RF3. Native Orleans activation movement and SQL interoperability with external clients are current product capabilities, not authorization for legacy KeyLoad code or data conversion.

docs/ADR/ADR-001-partition-identity-affinity.md

@@ -12,21 +12,21 @@ Resolve one `AtomicPartitionId` from the server-validated tenant, database, `Tra
 
 ## Rationale, alternatives, consequences
 
-This makes authorization, command routing, transaction scope, and idempotency agree. Per-resource independent identity would prevent required document/event/local-queue transactions; using a raw key string globally would leak state across domains. A partition-per-engine/grain model is also rejected because it couples logical cardinality to physical resources. Catalog binding and migration now become correctness-critical, and a split must preserve unique constraints and command/read tokens or reject the operation.
+This makes authorization, command routing, transaction scope, and idempotency agree. Per-resource independent identity would prevent required document/event/local-queue transactions; using a raw key string globally would leak state across domains. A partition-per-engine/grain model is also rejected because it couples logical cardinality to physical resources. Catalog binding and physical movement are correctness-critical; movement must preserve unique constraints and command/read tokens or reject the operation.
 
 ## Related requirements
 
 `REQ-DSTORE-004`/`AC-DSTORE-004`, `REQ-MSG-005`/`AC-MSG-005`, and `REQ-GRAPH-001`/`AC-GRAPH-001`; see [DocumentStorage](../Features/DocumentStorage.md), [Messaging](../Features/Messaging.md), and [GraphTraversal](../Features/GraphTraversal.md). Cluster routing and placement requirements remain in [ClusterRouting](../Features/ClusterRouting.md) and [ClusterReplication](../Features/ClusterReplication.md).
 
 ## Implementation contract
 
-1. Freeze canonical identity fields, catalog binding validation, compatibility fixtures, and token lineage before changing routing.
+1. Freeze canonical identity fields, catalog binding validation, movement fixtures, and token lineage before changing routing.
 2. Add real tests for cross-domain key reuse, valid shared resources, authorization, stable command scope, and split/movement boundaries.
 3. Implement in `src/KeyLoad.Abstractions/Features/ClusterRouting/` and `src/KeyLoad.Core/Features/ClusterRouting/`; route via the owning Orleans request/partition grains. Preserve the current node-local `PartitionHost` ownership of stores and locks.
-4. Migration imports old isolated-domain mappings explicitly; reject ambiguous bindings. Rollout keeps old routing until a verified catalog/ownership epoch is active. Rollback returns to the old owner only with a complete committed cut and fenced epoch.
+4. Create resources under the canonical catalog binding and reject ambiguous or absent bindings. A physical move fences the current owner, publishes only after a verified catalog/ownership epoch and complete committed cut, and returns to that owner on rollback only while its state remains complete and fenced.
 5. GitHub Actions must run TUnit, recovery, and Aspire RF3 through .NET and MCP SDKs; compare stable outcomes across failover and movement. Root owns shared resolver/contracts; worker joins only after exact tests and changed paths are reported.
 
-Dependencies: [ADR-002](ADR-002-command-idempotency.md), [ADR-004](ADR-004-committed-read-views.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), [ADR-007](ADR-007-replica-consensus-bootstrap.md), [ADR-016](ADR-016-atomic-physical-placement.md), and [ADR-017](ADR-017-migration-tokens.md). Verification: named catalog tests plus the repository GitHub CI matrix; no local test qualification. Stop if a source binding, token lineage, or multi-resource atomic scope is ambiguous; do not add a physical-placement shortcut.
+Dependencies: [ADR-002](ADR-002-command-idempotency.md), [ADR-004](ADR-004-committed-read-views.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), [ADR-007](ADR-007-replica-consensus-bootstrap.md), and [ADR-016](ADR-016-atomic-physical-placement.md). Verification: named catalog tests plus the repository GitHub CI matrix; no local test qualification. Stop if a source binding, token lineage, or multi-resource atomic scope is ambiguous; do not add a physical-placement shortcut.
 
 ```mermaid
 flowchart LR

docs/ADR/ADR-002-command-idempotency.md

@@ -19,10 +19,10 @@ Persisting command identity with effects resolves lost responses across process
 1. Freeze command fingerprint inputs, principal/scope binding, error replay, and retention horizon before changing envelopes.
 2. Add TUnit tests for same-ID/same-content replay, same-ID/changed-content conflict, lost response after commit, precondition failure replay, and unrelated principal/partition scope.
 3. Keep shared command/request/outcome contracts in the existing `src/KeyLoad.Abstractions/Contracts.cs` building block and dispatch/persisted outcome handling in `src/KeyLoad.Core/DatabaseEngine.cs`; feature-specific mutation logic remains in its canonical owning `Features/<SliceName>/` directory. Do not create a separate CommandExecution slice or project.
-4. This ADR authorizes no outcome-format migration, compatibility reader, dual-format read/write path, or legacy fallback. If an existing persisted outcome requires an upgrade, stop until [ADR-011](ADR-011-format-upgrades.md) is Accepted with the concrete format version, migration mode, and rollback boundary. Any temporary compatibility transition additionally requires a documented reason, owner, exact scope, verification, and removal date. Until then, unknown formats fail closed.
+4. The current outcome format has one canonical reader and writer. Unknown, malformed, or unsupported outcomes fail closed without rewrite or alternate-key lookup.
 5. GitHub qualification is TUnit, real process recovery, and RF3 SDK outcomes after leader change. Root owns shared command contracts; feature owners join with fingerprint vectors and named test evidence.
 
-Dependencies: [ADR-001](ADR-001-partition-identity-affinity.md), [ADR-003](ADR-003-durability-ack-barrier.md), [ADR-004](ADR-004-committed-read-views.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), [ADR-011](ADR-011-format-upgrades.md), and [ADR-016](ADR-016-atomic-physical-placement.md). Stop if canonical fingerprint or dedup expiry behavior is not specified. Do not infer exactly-once handler execution or include an external API call in the database transaction.
+Dependencies: [ADR-001](ADR-001-partition-identity-affinity.md), [ADR-003](ADR-003-durability-ack-barrier.md), [ADR-004](ADR-004-committed-read-views.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), and [ADR-016](ADR-016-atomic-physical-placement.md). Stop if canonical fingerprint or dedup expiry behavior is not specified. Do not infer exactly-once handler execution or include an external API call in the database transaction.
 
 ## TASK-DSTORE-COMMAND-100-RESTART implementation contract
 
@@ -32,18 +32,16 @@ UnitTests/Features/DocumentStorage. Root freezes the literal error, document,
 revision and outbox oracles; query_wave owns only the new cases/helpers. This
 stage changes no outcome format, canonical key or public API. Current source
 uses principal/command keys and partition-bearing fingerprints; independent
-resolved-partition identity remains an explicit implementation gap. The Accepted
-decision above is unchanged. Root must define the exact upgrade and public
-resolution contract under ADR-011 before repairing that separate gap. Tests of
-principal isolation must not stand in for partition isolation.
+resolved-partition identity remains an explicit implementation gap. The accepted identity decision remains unchanged. Tests of principal isolation
+must not stand in for partition isolation.
 
 Current command outcomes have no automatic TTL or purge implementation. A
 matching authorized retry resolves its retained canonical outcome in the same
 store incarnation. This does not promise a finite minimum retention period,
 eternal replay after explicit store/record removal, or replay across a changed
 incarnation; an existing outcome from another incarnation is TokenInvalidated.
-Adding expiry, purge, a minimum temporal horizon or an outcome-format change
-requires its own accepted policy and migration contract before implementation.
+Expiry, purge, a minimum temporal horizon, and outcome-format changes require
+a separately accepted current-product contract before implementation.
 
 REQ-DSTORE-006 / AC-DSTORE-006 and original KL-012 require two actual CrashHost
 processes over one owned native ZoneTree store. The first commits one authorized
@@ -87,28 +85,23 @@ flowchart LR
     Effects --> Commit[Ordered commit]
 ```
 
-## Accepted scoped-key completion, 2026-10-05
+## Accepted scoped command-outcome contract, 2026-10-05
 
 REQ/AC-DSTORE-009 and TASK-DSTORE-SCOPED-OUTCOMES-001..004 in
-[DocumentStorage](../Features/DocumentStorage.md) now freeze the independent
-full-partition identity missing from the earlier test-only matrix. The exact
-[ADR-011 outcome-v2 matrix](ADR-011-format-upgrades.md) accepts cold homogeneous
-writes to scoped v2 keys while retaining and validating original native outcome
-bytes. Existing fingerprint/authorization/incarnation/error/atomicity semantics
-remain required. Remove public principal/ID-only result/key access; every active
-lookup carries its original normalized operation. No SDK/HTTP/MCP endpoint
-replacement is needed because none exposes that removed Core API.
-
-Ordered stages and exact file/test ownership are in the feature contract. Root
-joins its contract before Luna implements Core keys/locator inventory and the
-existing commit/resolution path, then updates all actual callers and adds real
-unit/scalar/prior-process/restart/RF3 scenarios. Root reviews, qualifies and
-delivers the full joined stage. Wrong/missing locator, contradictory scope,
-same-scope old/new duplicates and malformed frames fail closed without rewrite.
-Unknown prior scope blocks ambiguous reuse, never hash-derived backfill. New
-Unknown failures have a distinct explicit nonmovable v2 identity and cannot
-install an old-key barrier over a prior Global/Partition success; every new
-write is v2, with bounded point resolution and no shared reservation protocol.
-After the first v2 write recover forward; a legacy-only downgrade requires the
-verified full pre-upgrade backup and explicit accepted data-loss scope. The
-accepted contract does not close any original KL-012 acceptance gate by itself.
+[DocumentStorage](../Features/DocumentStorage.md) freeze the complete atomic
+partition identity in persisted command-outcome lookup. Current command writes
+use the accepted outcome representation; every lookup is bound to its normalized
+operation, authenticated principal, and complete partition scope. Public
+principal/ID-only result or key access is not an accepted path.
+
+The current contract rejects a missing or contradictory locator, malformed
+record, duplicate scoped identity, or unsupported outcome without rewriting
+persisted bytes, searching an alternate key, or deriving identity from a hash.
+The current `Unknown` scope represents a normalized operation that failed before
+partition resolution. Its matching, freshly authorized retry replays only that
+same failed operation; it never invents partition authority or permits effects.
+Unknown scope values and contradictory identities fail closed. New commands use the
+canonical current identity and outcome representation. Ordered source ownership
+and the real unit, scalar, process-recovery, restart, and RF3 cases remain mapped
+in the feature contract; root owns shared joins and actual qualification. This
+section records the current behavior contract and does not claim gate completion.