Verify ClusterRouting repairs and align current ADR contracts

Author: KSemenenko

AGENTS.md

@@ -531,6 +531,7 @@ A bounded website qualification candidate contains the20-project historical runt
 - Owner correction 2026-10-06: KeyLoad is a new product. Do not implement or retain data, schema, storage-format, persisted-record, configuration or prior-KeyLoad-version migrations, legacy readers, compatibility shims, dual paths or fallbacks unless the owner directly requests that specific migration or legacy path.
 - This prohibition is the highest project rule for migration/legacy scope and explicitly supersedes every earlier plan, ADR, feature requirement, acceptance gate, local policy and inferred authorization to maintain unreleased or previous KeyLoad implementations. A generic instruction to finish the product, an agent proposal or a recorded migration contract is not the owner's direct permission.
 - Delete existing KeyLoad-owned migration and legacy implementations now, together with their exclusive tests, helpers, prior-binary/image preparation, configuration, routes, dependencies and active documentation/plan references. Do not preserve them as dead branches or deferred cleanup and do not replace them with a new migration mechanism.
+- Owner clarification 2026-10-06 requires every ADR to describe the current product decision and implementation contract. Remove superseded KeyLoad implementation narratives, old-format preparation and retired-plan references from ADRs; preserve current requirements, strict rejection, authentic qualification limits and independently retained original evidence.
 - Implement and qualify the current product contract. Preserve current-format crash recovery, verified backup/restore, persisted authorization, strict unsupported/corrupt-version rejection and genuine Aspire RF3. Native Orleans activation movement and SQL interoperability with external clients are current product capabilities, not authorization for legacy KeyLoad code or data conversion.
 
 ## Build and Tests workflow filename, owner direction 2026-10-06

docs/ADR/ADR-068-native-benchmark-gate-repair.md

@@ -26,7 +26,7 @@ flowchart LR
 
 AC-NGR-001 requires authenticated, bounded discovery followed by revalidation of the exact same own-repository workflow/source/attempt/job identity; only strict in-progress with a null result admits native setup. A queued response is not executing evidence. The original request bound is 120,000 ms; only after an exact queued response may one 60,000 ms stale-response window run at cancellation-aware 1,000 ms cadence, with at most 61 total captures. Mismatch, terminal/unknown state, exhaustion, cancellation, transport or parse failure rejects before allocation/timing; no reselection or workload retry occurs. AC-NGR-002 retains exact original/custom/system event metadata, a complete 55,378-item owned-stream oracle, foreign-resource noninterference and cleanup across genuine native one/two/three-node cases; empty tracing remains uncharacterized and must not be assumed empty. AC-NGR-003 retains SDK/advertised endpoint validation, genuine leader/follower routing, observed membership/copies/ACK, and no guessed leader, standalone substitute or measured write retry. AC-NGR-003D preserves the original thrown failure and emits only one failure-only line bounded to 4,096 bytes, at most three causes, eight frames per cause and 64-character identifiers; messages, stacks, paths, endpoints, credentials and payloads are excluded.
 
-**AC-NGR-004 is the complete current publication predicate:** the authenticated source/run/attempt/job and uploaded archive must match the canonical 1,386-worker plan (330 controls, 264 scaled CRUD, 792 vector) and its required 2,530 unique regular-file evidence inputs (2,470 suite and 60 provider files), with exact paths, sizes and hashes, original archive bytes, and all source/provenance identities validated. Each slot is either a measured result, an authenticated explicit unsupported-topology disposition or an authenticated terminal workload failure with the required safe null report; failed, canceled, skipped, missing, mixed-cohort or unavailable evidence can never become numeric success. Native preflights, full source/normal/scalar/recovery/RF3, coverage, site/browser/freshness/provider gates remain separate required predicates. The TimeSeries family is separate and remains subject to its own ADR-050/059 scale-specific plan. AC-NGR-005 preserves the original failed case, timing and samples; only after an eligible exact resource-exhausted case and its session settle may one authenticated outbox-status read inspect at most 64 consumer heads, outside the measured clock. Unknown/unavailable remains unavailable; no quota, purge, retention or retry changes are implied. These criteria map to the current BenchmarkComparisons failure/null and Website selection contracts, not the retired NativeGateRepair plan.
+**AC-NGR-004 is the complete current publication predicate:** the authenticated source/run/attempt/job and uploaded archive must match the canonical 1,386-worker plan (330 controls, 264 scaled CRUD, 792 vector) and its required 2,530 unique regular-file evidence inputs (2,470 suite and 60 provider files), with exact paths, sizes and hashes, original archive bytes, and all source/provenance identities validated. Each slot is either a measured result, an authenticated explicit unsupported-topology disposition or an authenticated terminal workload failure with the required safe null report; failed, canceled, skipped, missing, mixed-cohort or unavailable evidence can never become numeric success. Native preflights, full source/normal/scalar/recovery/RF3, coverage, site/browser/freshness/provider gates remain separate required predicates. The TimeSeries family is separate and remains subject to its own ADR-050/059 scale-specific plan. AC-NGR-005 preserves the original failed case, timing and samples; only after an eligible exact resource-exhausted case and its session settle may one authenticated outbox-status read inspect at most 64 consumer heads, outside the measured clock. Unknown/unavailable remains unavailable; no quota, purge, retention or retry changes are implied. These criteria map to the current BenchmarkComparisons failure/null and Website selection contracts.
 
 The benchmark source paths own current-job capture, target-specific diagnostics and comparison runner behavior. Unit tests cover real current source paths and native fixtures rather than fake executor or target behavior. Root owns workflow, schema, current cohort, Website, docs and final integration. The canonical current inventory is 330 control cells, 264 scaled cells, 792 vector cells across 11 targets; scaled profiles contain 100,000 and 1,000,000 records and applicable cells execute at least 100,000 measured operations. TimeSeries remains its separate family under ADR-050/059.
 

docs/ADR/ADR-076-current-cohort-publication.md

@@ -11,8 +11,7 @@ composite plan. The plan contains 330 control cells, two 132-cell CRUD profiles
 (100,000 and 1,000,000 records), and 24 vector profiles with 33 target/node
 cells each: 1,386 workers total. Applicable scaled workloads retain at least
 100,000 measured operations; vector profiles retain at least 100,000 measured
-queries. The 270-worker/277-file cohort belongs only to authentic historical
-receipts. It does not define current completeness or qualify current metrics.
+queries.
 
 The current composite evidence inventory is derived from the canonical plan:
 2,470 suite files and 60 provider files (2,530 total), including every planned

docs/ADR/ADR-110-native-orleans-execution-primitives.md

@@ -154,6 +154,24 @@ RF3 bootstrap and verification complete. Both physical stores must already satis
 the current required reader contract before first journal admission; fresh stores
 are created with that contract and unsupported capabilities fail closed.
 
+The REQ/AC-ORL-013 call graph copies every existing default-deny edge and admits
+the native RuntimeJournalClient's exact ReadCoreAsync and SendCommandAsync calls
+to IRequestGrain.ExecuteStreamAsync. Native JournaledStateManager suppresses
+ExecutionContext for its background work loop, so provider callbacks establish
+their immediate caller identity with the supported RunWithCurrentCallerAsync
+API around the complete native CQRS stream drain and restore it on every exit.
+The coordinator's concrete ExecuteJobAsync edge remains scoped to its actual
+saga effect; remove the unused manager wildcard and speculative concrete
+ProcessDueAsync provider allowance. TASK-ORL-JOURNAL-GRAPH-014 freezes exact
+Orleans client/Server registration ownership, ordered guarded private preparation,
+root join and verification in the RuntimeJournal contract. Preserve signed
+protected identity, fresh separately authorized request grains, backpressure and
+RF3 authority. Actual native scheduling/journal callbacks, duplicate dispatch,
+single saga/message effect, caller restoration, denied method/target and healthy
+follow-up controls run through Aspire after build/format. No coordinator wildcard
+or alternate database path is admitted; complete process, RF3 and Linux
+qualification remains required.
+
 Native streamed-request telemetry join, 2026-10-06: TASK-ORL-TELEMETRY-STREAM-002
 in [RuntimeAdoption](../Features/ClusterRouting/RuntimeAdoption.md) freezes the
 REQ/AC-ORL-012 client propagation and exact native stream-start classification

docs/ADR/ADR-112-independent-website-publication.md

@@ -85,6 +85,10 @@ flowchart TD
 2. Selection contributor owns site-isolated-github capture/runs/contract; builder
    contributor owns site/Features/BenchmarkComparisons/build-site.mjs. Preserve
    exact original artifacts, bounded native calls and source closure.
+   TASK-CURRENT-WEBSITE-EVENT-071 limits capture to current executor and REST
+   selection/wait inputs. It removes event-file parsing and its exclusive probe,
+   cap and fixtures, preserving REST workflow_runs and artifact.workflow_run
+   provenance, actual authenticated capture and latest-selection operation flows.
 3. Qualification contributor owns SiteContent cases/helpers/contracts and current
    coverage/source inventory joins. Native file/Node/Chrome flows prove successful
    admission, absence, foreign executor, corrupt evidence and healthy follow-up.

docs/Features/BenchmarkComparisons.md

@@ -1443,3 +1443,62 @@ rejection, unchanged inputs and a healthy follow-up. Static actionlint and YAML
 graph review verify infrastructure; a genuine final dispatch and separate
 workflow_dispatch Website/Pages run supply provider evidence. Ordered tasks and
 ownership are in ADR-112 TASK-WEB-TRIGGER-001..003.
+
+### Current Website capture source closure
+
+TASK-CURRENT-WEBSITE-EVENT-071 implements REQ/AC-BC-WEB-001/002/004/006/007 and
+AC-BC-FAIL-019 using only trusted push/manual executor admission, bounded
+authenticated optional-run waiting and current REST producer selection. Capture
+has no event-file input or event-payload parser/probe; remove their exclusive
+fixtures and cap. REST workflow_runs paging and artifact.workflow_run provenance
+remain separate mandatory authority checks, including rejection of unsupported
+producer-list events. No API/archive/request bound or coverage threshold changes.
+
+The source packet owns site-isolated-github-context.mjs, the parser-only cap in
+site-isolated-github-contract.mjs, SiteIsolatedGitHubNodeProgram and its fields,
+Website executor cases, and producer-selection cases/fixtures. Keep the two
+latest-selection whole flows under current AC-BC-WEB-002 ownership; keep actual
+authenticated AcPipe003 capture, no mutation and healthy follow-up, exact-source
+freshness, full source inventories and native Node/Chrome coverage. Root owns
+policy/docs, shared source closure, joins, canonical gates and Git. Preparation
+must account for the separately reviewed current archive-source packet before
+joining overlapping files; source review is not Linux or Pages evidence.
+
+### Current archive consumer closure
+
+TASK-CURRENT-ARCHIVE-IMPLEMENTATION-070-CONSUMERS implements
+REQ/AC-BC-CURRENT-001..004 and REQ/AC-BC-WEB-002/004/006/007 alongside
+TASK-CURRENT-WEBSITE-EVENT-071. The current dependency manifest contains exactly
+80 source paths. QualifySite/action.yml must validate that exact current list and
+remove the deleted historical-contract path from its closed allowlist; preserve
+all remaining regular-path, byte/hash, archive, source, coverage and freshness
+checks. Root alone joins the composite-action change.
+
+Keep SiteOptionalBenchmarkSelectionTests as the mandatory Aspire-owned native
+Website preparation gate. Its Cases and Processes own complete push/manual
+admission, CI/foreign-path/unsupported-executor rejection, unchanged controlled
+inputs, healthy follow-up and strict optional-argument flows using the production
+context API. Delete HistoricalBenchmarkContractTests,
+SiteHistoricalEligibilityNodeProgram, SiteOptionalBenchmarkSelectionTokens and
+their eleven SiteOptionalRetained JSON metadata fixtures. They are exclusive
+old-plan code inputs, not immutable original measurement artifacts. Current
+authenticated producer capture, optional unavailability, newest-ready selection,
+strict selected-evidence rejection and healthy follow-up remain owned by the
+current SiteTests under AC-BC-WEB-002 and AC-BC-FAIL-019/020.
+
+The exact unit modifications are Cases/SiteOptionalBenchmarkSelectionTests.cs
+and Processes/SiteOptionalBenchmarkSelectionNodeProgram.cs,
+SiteOptionalBenchmarkSelectionNodeProcess.cs and SiteWebsiteAdmissionNodeProgram.cs
+under Features/BenchmarkComparisons. Remove the unused fixture-directory
+argument. SiteIsolatedInventory and its real SiteTests callers must use current
+no-argument inventory functions; delete its unused Files helper. Do not retain
+ignored source/revision parameters as compatibility shims. Preserve the current
+1,386-worker/2,530-input contract and separate source authentication.
+
+Read the owning policies before preparation. Coding agents prepare only guarded
+private packets; root owns docs/policy, serialized joins, exact coverage/source
+inventories, canonical build/format, Aspire unit/SiteTests and Git. Join the
+archive packet before the dependent event packet, verify every live base hash,
+then run the full ordinary unit suite separately from functional coverage.
+Required exact-source Linux website/browser/provider gates remain open until
+their original evidence exists. Deletion is not a passing qualification result.