refactor(orleans): organize vertical slices by responsibility

Move tracked source files without changing contents or namespaces. Require feature-local role folders and update source navigation. Local solution Release build, formatter and governance passed; runtime qualification remains incomplete, with RF3 local environment/image-proof failures recorded.

Author: KSemenenko

AGENTS.md

@@ -74,6 +74,7 @@ This file defines how AI agents work in this solution.
 ## Mandatory Solution Architecture (`MCAF-ARCH-001`)
 - This solution MUST be delivered as one repository. All solution-owned backend, frontend, contracts, tests, infrastructure, and documentation live here and are versioned together.
 - Vertical-slice architecture is mandatory across the entire repository.
+- Owner correction 2026-10-04 requires responsibility-based structure inside every vertical slice. A `Features/<SliceName>/` directory MUST NOT become a flat dump of unrelated grains, commands, queries, models, contracts, streaming and infrastructure helpers. Keep applicable roles in explicit child folders such as `Grains/`, `Commands/`, `Queries/`, `Models/`, `Contracts/`, `Streaming/`, `Identity/`, `Serialization/` and `Topology/`, all within the owning slice; create only folders with actual owned code. Feature-local role folders MUST NOT become repository-wide layers. Preserve stable namespaces, Orleans aliases/field IDs and runtime behavior during structural moves, and update source maps, path-bound checks and local policy in the same change.
 - Every feature MUST use one canonical `<SliceName>` across backend, frontend, contracts, tests, and `docs/Features/`.
 - Every technical root MUST organize feature-owned work under the same `Features/<SliceName>/` convention, or use one fully colocated executable-artifact convention; durable feature docs remain under `docs/Features/<SliceName>.md`.
 - A feature surface that does not apply MUST be recorded as `N/A` with a reason in the feature spec; it must not be silently omitted.

docs/ADR/ADR-032-mcaf-governance.md

@@ -80,3 +80,32 @@ flowchart LR
     Links --> Verify[Real Node validator and TUnit checks]
     Verify --> Deliver[Reviewed scoped Git delivery]
 ```
+
+## Owner-directed feature-local role migration, 2026-10-04
+
+Decision: MCAF-ARCH-001 requires populated responsibility folders inside each owning
+feature. A flat collection of unrelated grains, commands, queries, models and helpers
+is not the target structure. Roles stay inside the canonical slice rather than becoming
+global layers. Requirements: REQ-MCAF-010; acceptance: AC-MCAF-010; execution:
+TASK-MCAF-LAYOUT-001/002 in RepositoryGovernance. This stage covers KeyLoad.Orleans.
+
+Implementation contract: root first adds policy and captures exact current source bytes,
+then moves every feature source to its actual role, preserving dirty/untracked work,
+namespaces, API signatures, Orleans aliases/Ids and serialization. Routing owns Grains,
+Commands, Queries, Models, Contracts, Streaming, Identity, Serialization, Diagnostics and
+Topology. Replication owns GrainServices, Discovery, Transport, Authentication, Replay,
+Contracts and Models. ResourceExecution owns Models, Contracts, Serialization,
+Authentication and Validation. Small read-capability slices own Queries. The read-only
+reviewer verifies responsibility assignment and path consumers; root owns all writes,
+reference updates, combined checks and delivery. New API/data/dependencies/topology,
+behavior fixes and other projects' layout migrations are outside this stage.
+
+Rollout is an exact-content physical move with current documentation path repair;
+MSBuild's existing recursive source glob includes the files. Rollback reverses physical
+paths without losing later code edits; it does not revoke the owner's mandatory rule.
+Verification compares every pre/post file byte and complete inventory, checks no flat
+feature C# file remains, reviews live links, and runs governance, formatter, Release
+build and AppHost unit/recovery/RF3 suites. Existing process-recovery and real SDK/MCP
+RF3 contracts remain mandatory. Missing infrastructure or unrelated concurrent compiler
+failures are reported and never relabelled as passing. This migration does not mark the
+ADR's other architecture debt or product qualification complete.

docs/Architecture.md

@@ -179,7 +179,7 @@ All KeyLoad-owned backend, clients, contracts, frontend, tests, infrastructure a
 | src/KeyLoad.Query | QueryEngine.cs, SqlParser.cs, SearchEngine.cs; Features/ChangeFeeds/LiveQueryExecutor.cs behind LiveQueries.cs facade | QueryExecution, Search, ChangeFeeds; one authorized typed AST and bounded read cut. |
 | src/KeyLoad.Artifacts | Features/BackupRestore/ArtifactTransfer.cs, BackupArtifact.cs | BackupRestore; verified artifact transport and format ownership. |
 | src/KeyLoad.Replication | Features/ClusterReplication/ClusterCoordinator.cs, DurableReplicaLog.cs, ReplicaMaterializer.cs | ClusterReplication, StorageRecovery; ordered durable apply and quorum authority behind the active Orleans server composition; delivered-SHA RF3 qualification pending. |
-| src/KeyLoad.Orleans | Features/ClusterRouting/RequestGrain.cs, DatabaseReadGrain.cs, CommandPartitionGrain.cs, ReplicaMembershipTable.cs | ClusterRouting; active server composition routes through grains while node-local hosts own storage; forced activation-migration qualification pending. |
+| src/KeyLoad.Orleans | Features/ClusterRouting/Grains/{RequestGrain,DatabaseReadGrain,CommandPartitionGrain}.cs; Topology/ReplicaMembershipTable.cs | ClusterRouting; active server composition routes through grains while node-local hosts own storage; forced activation-migration qualification pending. |
 | src/KeyLoad.Server | Program.cs, NodeOptions.cs, Features/ClientApi/, Features/ClusterRouting/OrleansNode.cs and feature API files | Composition root and public API; caller identity never supplies trusted roles. |
 | src/KeyLoad.Client | KeyLoadClient.cs, KeyLoadQuery.cs | ClientApi shared transport; business operations mirror the same canonical slices as core/contracts/API/tests. |
 | src/KeyLoad.Cli | Program.cs, Hosting/KeyLoadCliApplication.cs, Features/ClientApi/CliClientApi.cs and Features/BackupRestore/CliBackupRestore.cs | Composition-only administrative entry point and typed ClientApi/BackupRestore feature owners. |
@@ -224,6 +224,17 @@ classDiagram
 
 ## Feature convention and migration
 
+Each vertical slice groups actual responsibilities in populated local role folders;
+`Features/<SliceName>/` is an ownership boundary, not a flat file collection.
+KeyLoad.Orleans now separates routing grains, commands, queries, models, contracts,
+streaming, identity, serialization, diagnostics and topology. Its replication slice
+separates grain services, discovery, transport, authentication, replay and wire models;
+ResourceExecution separates cache-control models, contracts, serialization,
+authentication and validation. AdminDashboard and BlobStorage own query capabilities
+in `Queries/`. The migration preserves namespaces, aliases/Ids and runtime behavior.
+The owner contract and checks are in [RepositoryGovernance](Features/RepositoryGovernance.md)
+and [ADR-032](ADR/ADR-032-mcaf-governance.md).
+
 Canonical slice names use PascalCase consistently: RepositoryGovernance, BenchmarkComparisons, DocumentStorage, RelationalStorage, EventStreams, Messaging, GraphTraversal, TimeSeries, Search, QueryExecution, Authorization, ChangeFeeds, StorageRecovery, ClusterReplication, ClusterRouting, ClientApi, BackupRestore, BlobStorage, ResourceExecution, CodeQuality and TestInfrastructure. Their owning contracts and navigation are in the [Feature index](README.md).
 
 The embedded microbenchmark boundary follows Accepted ADR-047; it is peripheral

docs/Features/ClusterReplication.md

@@ -101,7 +101,7 @@ cleanup failures require source lifetime review rather than a synthetic injector
 
 ## Actors, entry points and failure boundaries
 
-Actors are authenticated SDK/MCP callers, the node-local replica host, fixed voters, the membership provider and the recovery operator. Current source is composed by [ServerApplication](../../src/KeyLoad.Server/Features/ClientApi/ServerApplication.cs): it starts the node-local [PartitionHost](../../src/KeyLoad.Server/Features/StorageRecovery/PartitionHost.cs) and Orleans silo, whose [replica service](../../src/KeyLoad.Orleans/Features/ClusterReplication/PartitionReplicaGrainService.cs) routes peer operations. Aspire declares three Docker nodes with separate data mounts. This source is not yet qualified as a delivered RF3 deployment: current tests do not force request-activation migration and then verify storage ownership and a durable caller-visible outcome. Public HTTP/.NET transport belongs to ClientApi; required official MCP parity is pending. Frontend is N/A because replica consensus has no independent UI. Shared contracts stay in Abstractions and the exact ClusterReplication/StorageRecovery slice owners above.
+Actors are authenticated SDK/MCP callers, the node-local replica host, fixed voters, the membership provider and the recovery operator. Current source is composed by [ServerApplication](../../src/KeyLoad.Server/Features/ClientApi/ServerApplication.cs): it starts the node-local [PartitionHost](../../src/KeyLoad.Server/Features/StorageRecovery/PartitionHost.cs) and Orleans silo, whose [replica service](../../src/KeyLoad.Orleans/Features/ClusterReplication/GrainServices/PartitionReplicaGrainService.cs) routes peer operations. Aspire declares three Docker nodes with separate data mounts. This source is not yet qualified as a delivered RF3 deployment: current tests do not force request-activation migration and then verify storage ownership and a durable caller-visible outcome. Public HTTP/.NET transport belongs to ClientApi; required official MCP parity is pending. Frontend is N/A because replica consensus has no independent UI. Shared contracts stay in Abstractions and the exact ClusterReplication/StorageRecovery slice owners above.
 
 Positive flow: an authorized command reaches its own request grain, the physical host orders and persists it, a majority crosses the declared acknowledgement barrier, and canonical apply returns the stable outcome. Negative flow: minority, stale term/owner, invalid peer MAC/replay or denied principal cannot establish committed success. Edge/error flow: an unknown response is resolved by stable command ID; interrupted/corrupt append or snapshot reopens one verified cut or fails explicitly; cancellation drains owned work without transferring locks to a migrating activation.
 

docs/Features/ClusterRouting.md

@@ -46,7 +46,7 @@ with `TimeProvider.System` and the silo startup cancellation token. Later provid
 calls use independent bounded request deadlines, so cancellation of the startup
 token does not prevent membership shutdown. Membership never owns files and never
 resolves an Orleans client while constructing its provider. Source ownership is
-the new `Features/ClusterRouting/ReplicaMembershipTable.cs` and cohesive helpers;
+the new `Features/ClusterRouting/Topology/ReplicaMembershipTable.cs` and cohesive helpers;
 the lead replaces the old provider and composes the actual silo. The frozen primary
 constructor accepts database, coordinator, replica endpoint, cluster ID, internal
 principal ID, TimeProvider, and startup CancellationToken in that order.

docs/Features/RepositoryGovernance.md

@@ -17,6 +17,7 @@ All requirements are mandatory. IDs remain stable when implementation changes.
 | REQ-MCAF-007 | Evidence / P0 | Keep conflicts, migration gaps and CI qualification explicit; publish only GitHub Actions performance JSON. | AC-MCAF-007: no unsupported readiness or benchmark claim is introduced. |
 | REQ-MCAF-008 | Repository hygiene / P0 | Remove temporary planning Markdown files and keep requirements, acceptance and execution contracts in canonical Feature/ADR documents. | AC-MCAF-008: no tracked or checkout `*.plan.md`, `*.brainstorm.md` or `*.acceptance.md`; all three patterns are ignored without exceptions. |
 | REQ-MCAF-009 | Validation / P0 | Repository rules validate durable documents and reject reintroduced working planning files. | AC-MCAF-009: the real Node validator passes without planning files and fails for each suffix at root or nested paths; prefix, ownership and skill checks remain. |
+| REQ-MCAF-010 | Architecture / P0 | Organize each vertical slice by its actual responsibilities instead of placing mixed role files in a flat feature root. The immediate migration covers every KeyLoad.Orleans slice. | AC-MCAF-010: every Orleans feature C# file belongs to a populated role folder; the before/after file-content inventory is identical, namespaces/aliases/Ids remain unchanged, live references resolve and Release compilation includes the moved files. |
 
 ## Slice surfaces
 
@@ -120,3 +121,52 @@ REQ-MCAF-008/009 and AC-MCAF-008/009 supersede only the earlier requirement for
 Testing methodology: AC-008 uses complete file/Git inventory and real `git check-ignore` checks at root/nested paths for every suffix. AC-009 uses TUnit/Microsoft.Testing.Platform to execute the original Node validator on real filesystem copies of the current repository's required policy/inventory documents, with no planning files (pass) and each suffix at root or nested paths (fail). Existing prefix, project/module, required document and skill rejection checks remain. Static review verifies live links and that only the explicitly authorized file-placement policy changed. Local development checks do not establish RF3, recovery, performance or production qualification.
 
 Local verification, 2026-10-03: removed 59 tracked files and 123 additional checkout files; all three suffixes are ignored at root and nested paths, including the former governance exceptions. The live Node validator passes with 26 projects and four modules. The original nine TUnit cases pass with no failures or skips; their focused Release build has zero warnings/errors and the scoped formatter passes. Reference review preserves existing REQ/AC occurrences and Markdown fences and resolves every new local link. The shared solution build is blocked by concurrent, untracked scaled-storage tests requiring unfinished Fixture/Snapshot types; those files are outside this delivery.
+
+## Feature-local responsibility structure, 2026-10-04
+
+REQ-MCAF-010 / AC-MCAF-010 extend MCAF-ARCH-001 and [ADR-032](../ADR/ADR-032-mcaf-governance.md).
+A feature folder remains the ownership boundary; role folders inside it make grains,
+commands, queries, models and supporting protocols discoverable. Global layer folders,
+empty placeholder folders and namespace/wire-contract changes are outside this migration.
+
+TASK-MCAF-LAYOUT-001: root owns policy, this specification, ADR-032, Architecture and
+all physical moves in `src/KeyLoad.Orleans/Features/`. TASK-MCAF-LAYOUT-002: read-only
+reviewer inventories responsibilities and path-bound consumers, then reviews the final
+map. Shared documentation and source moves have one integration owner because the
+current routing files contain concurrent CQRS changes. Reviewer starts after the root
+policy correction; integration joins only after its exact mapping and concerns are reviewed.
+
+Ordered work: capture exact file contents; group routing, replication and cache metadata
+by actual role; move small read-capability slices into Queries; repair current source
+navigation; compare the complete byte inventory and ensure no flat C# files remain;
+run governance, formatter, solution Release build and relevant AppHost suites. Positive
+flow resolves a grain/query/model through its owning slice and role. Negative flow
+rejects lost, duplicated, flat or changed source files. Edge flow preserves dirty and new
+files byte for byte. Compiler/style failures and unavailable test infrastructure remain
+explicit blockers. No runtime behavior changes are intended, so no new behavior test
+is added: the structural criteria use explicit complete-inventory/manual role review
+plus existing compilation and runtime suites. Local checks do not qualify RF3 or durability.
+
+```mermaid
+flowchart LR
+    Slice[Owning feature] --> Grains[Grains]
+    Slice --> Commands[Commands]
+    Slice --> Queries[Queries]
+    Slice --> Models[Models and contracts]
+    Slice --> Protocols[Streaming and supporting roles]
+    Grains --> Verify[Unchanged source and runtime contracts]
+    Commands --> Verify
+    Queries --> Verify
+    Models --> Verify
+    Protocols --> Verify
+```
+
+Structural development verification, 2026-10-04: moved all108 current Orleans C#
+files (105 tracked files and three concurrent new source files) across all five slices;
+complete SHA-256 inventory and independent role review passed with unchanged source.
+Governance and the full solution formatter passed. Release solution build passed with
+zero warnings/errors (MSBuild servers disabled, single build worker after sandbox IPC
+blocked the initial attempt). RF3 attempt:14/93 passed,79 failed;76 reject macOS
+temporary reparse paths, two require authentic GitHub RF3 image identity and one requires
+genuine prior-server proof. Unit/recovery verification remains pending; no delivered
+Linux GitHub runtime, fault, performance or durability qualification is claimed.

docs/implementation/documentation-coverage.json

@@ -13386,8 +13386,8 @@
         "fileOwnership": [
           "Directory.Packages.props",
           "src/KeyLoad.Orleans/KeyLoad.Orleans.csproj",
-          "src/KeyLoad.Orleans/Features/ClusterRouting/GrainRequestContextState.cs",
-          "src/KeyLoad.Orleans/Features/ClusterRouting/GrainIdentityContext.cs",
+          "src/KeyLoad.Orleans/Features/ClusterRouting/Identity/GrainRequestContextState.cs",
+          "src/KeyLoad.Orleans/Features/ClusterRouting/Identity/GrainIdentityContext.cs",
           "src/KeyLoad.Server/Features/ClientApi/PersistedPrincipalRequestContextScope.cs",
           "src/KeyLoad.Server/Features/ClientApi/CanonicalOperationGateway.cs",
           "src/KeyLoad.Server/Features/Authorization/DatabaseCredentialResolver.cs",