fix: bind RF3 membership and native test package roots

Bind the actual flat authority options emitted by the six-node Aspire model
and compose native pinned TUnit import paths for both package-root forms.
Add whole-operation indexed process recovery, indexed backup/replay and SDK
query-factory regressions with bounded cleanup and exact state oracles.

Local full Release build, native formatter, governance, owning unit/scalar
10/10 each and real process recovery 2/2 pass with no source/image drift.
Retain original Linux failures and pending complete RF3/coverage acceptance.

Author: KSemenenko

README.md

@@ -333,46 +333,36 @@ Discovery exposes static operation documentation. Each invocation checks current
 > **KeyLoad is a development preview.** Try it, build with it and [tell us what breaks](https://github.com/managedcode/KeyLoad/issues), but don't trust it with production data yet.
 
 The original 104-task plan has **3 fully accepted, 101 in progress and 0 pending**.
-KL-075 now has its first scaling source stage; six-node, open-loop, shard-skew,
-fanout, recovery and movement acceptance remains open. The joined stage has
-passed the local Release build with zero analyzer errors and warnings. The
-[original Linux run at 259a3fa5](https://github.com/managedcode/KeyLoad/actions/runs/37554329420/job/112576973966)
-passed normal and scalar **2,765/2,765**, recovery **235/235** and same-job native
-source/test-image identity verification, without skips. Later native codec and
-captured-envelope criteria now close **KL-007**, with all19 mapped cases passing
-in both modes and all33 owned source files bound to the original compiled images.
-Original document **KL-010 CRUD/CAS** and **KL-012 batch/idempotency** acceptance
-is also closed: unchanged product/test source is bound to original Linux reports
-and compiled PDBs, including100 retries in each of two real processes. Their
-five SDK/MCP/restart RF3 cases pass in both retained Linux reports and a fresh
-local native Aspire/Docker run. This does not qualify the full RF3 cohort.
-The newer cross-process ownership and read-cut regressions pass locally; their
-task acceptance remains open. The [newer original Linux run at 6816ae91](https://github.com/managedcode/KeyLoad/actions/runs/37560457057/job/112596312154)
-passed normal and scalar **2,767/2,767**, recovery **235/235** and same-job native
-source/test-image identity checks. Its RF3 job was canceled near the original
-60-minute aggregate budget without producing a completed RF3 report. That job
-now has 180 minutes, with individual scenario deadlines and gates unchanged.
-The [later Linux run at 57532cd5](https://github.com/managedcode/KeyLoad/actions/runs/37569205558/job/112623818966)
-passed normal and scalar **2,769/2,769**, recovery **235/235**, and same-job
-source/test-image checks. Its complete RF3 report records **131/141 passed,
-10 failed**, with bootstrap admission exhaustion, a specific missing ACK grant
-and separate startup/cancellation failures retained. The next source's Linux
-normal/scalar reports each pass **2,770/2,771**; the sole failure is a test
-expecting logger-selection rejection after image-provenance rejection, and
-recovery passes **235/235**. That fixture correction remains pending.
-Local Stage V fixes pass **99/99** owning unit operations in
-each mode and the two real RF3 admission cases. SDK backup and dispatch also
-pass their actual RF3 flows, including native archive restore and queue delivery,
-replay/conflict/denial checks. Full current-source Linux/RF3 remains open.
-All six unchanged native Aspire logger-control flows pass locally, including
-caller cancellation and original task settlement; these model/logger controls
-do not qualify Docker database execution. Six focused local Docker RF3 flows
-pass through the real SDK and official MCP clients, covering native schema
-discovery and autonomous saga timeout/replay. The owned image lifecycle also
-passes prepare, verify, cleanup and repeated cleanup. Full Linux RF3,
-functional coverage, scale and release qualification remain open. The
-[implementation status](docs/implementation/status.json) records each
-source and report boundary.
+The accepted tasks are **KL-007** storage codecs, **KL-010** document CRUD/CAS and
+**KL-012** batch/idempotency, each bound to its original Linux tests and compiled
+source, including real process retries and task-specific SDK/MCP RF3 operations.
+Their acceptance does not qualify the remaining features or the complete cluster.
+
+The [latest completed Linux RF3 cohort](https://github.com/managedcode/KeyLoad/actions/runs/37578573276/job/112652868979)
+recorded **122/132**, with ten failed operations. Coverage collection and merge
+were skipped after that failure. The [same run's Linux verify job](https://github.com/managedcode/KeyLoad/actions/runs/37578573276/job/112652908001)
+passed normal and scalar **2,767/2,768** and recovery **235/235**, without skips.
+Its sole unit failure is an incorrect expected rejection in the C1 fixture; the
+correction passes locally and awaits fresh complete Linux verification.
+Local Stage V passed **99/99** owning unit
+operations in each mode and actual Aspire RF3 SDK/MCP admission, backup/restore
+and queue dispatch flows, in separately retained source/image cohorts.
+
+Stage VI has joined whole-operation query-factory, indexed-document backup/dedup,
+scalar-index process-recovery and six-resource membership configuration work.
+A fresh isolated restore now selects all **264** package/version archives from
+NuGet.org with zero unresolved package/license inventory rows. The corrected
+compile-identity target passes actual native builds with both package-root forms
+and rejects a counterfeit defining import. The complete Release build and native
+formatter pass; owning native normal/scalar flows each pass **10/10**, and real
+indexed/idempotency process recovery passes **2/2**, without source/assembly drift
+or skips. These are focused local results; a new complete Linux run is required.
+Bounded Q2 relational INNER JOIN and a
+TUnit-owned fresh-image six-silo flow have frozen contracts and private source
+stages; neither is runtime-qualified yet. KL-075 scaling, full SQL/client protocol,
+complete Linux RF3, functional coverage, endurance and release gates remain open.
+The [implementation status](docs/implementation/status.json) retains original
+failures, source hashes and each qualification boundary.
 
 Functional coverage excludes load/comparison runs and admits complete operation
 flows only. The current Query profile binds exactly 25 named cases and 103 source

docs/ADR/ADR-004-committed-read-views.md

@@ -22,6 +22,15 @@ EventStreams `REQ-EVENT-001..003`/`AC-MP-005`, QueryExecution `REQ-QUERY-001..00
 4. Validate current cursor versions and invalidate stale bindings explicitly. Reject unsupported cursors with a stable error rather than translating them or guessing their cut.
 5. GitHub CI runs real-store TUnit, process recovery, and RF3 client reads across leader changes; root owns the common cut/token contract and joins feature-specific tests.
 
+TASK-CUT-DOCUMENT-INDEX-SCAN maps REQ-CUT-005 /
+AC-CUT-DOCUMENT-INDEX-SCAN-001 in
+[NativeReadCuts](../Features/StorageRecovery/NativeReadCuts.md). The bounded real
+document/index scan, concurrent atomic writer, joined failure cleanup, reopen and
+healthy follow-up are test-only completion of the existing gate contract. Root
+owns integration and exact-source qualification; the worker's exact private
+ownership and ordered implementation are frozen in that feature document.
+Snapshot/segment-movement performance and complete KL-004 acceptance stay open.
+
 Dependencies: [ADR-001](ADR-001-partition-identity-affinity.md), [ADR-003](ADR-003-durability-ack-barrier.md), [ADR-005](ADR-005-canonical-keyspace-codec.md), [ADR-006](ADR-006-strict-derived-indexes.md), and [ADR-010](ADR-010-query-budgets-security.md). Stop on any ambiguity about visibility, cut translation, or cancellation lifetime; do not claim read-your-writes or global ordering beyond the verified contract.
 
 ```mermaid

docs/ADR/ADR-074-aspire-owned-test-entry.md

@@ -299,3 +299,11 @@ The identity crossing start/readiness is the actual pre-start verifier return:
 VerifyModelAsync returns it to a WaveStartup local, then the same value supplies
 started-container checks. Early ReadAsync selects the validated reference only.
 Keep existing caller maps; no ambient state or extra identity carrier is needed.
+
+The direct TUnit ownership in ADR-117 is refined by Accepted
+[ADR-119](ADR-119-tunit-owned-local-membership-image.md) for an explicit local
+six-silo membership image. Its TUnit case owns the existing Aspire prerequisite
+and exact-tag cleanup; no outer test runner executes. The typed selection does
+not mutate global environment or erase GitHub provenance. Preserve original
+producer bounds, all six actual container checks, 18 locks, SDK/MCP flow and Linux
+qualification gates. Implementation and native runtime proof are pending.

docs/ADR/ADR-106-partition-owner-movement.md

@@ -256,3 +256,32 @@ Aspire testing resumes the normal AppHost entry point; absence of an explicit
 StartAsync call is not a guarantee that resources never start. Joined application
 disposal and owned-root cleanup remain mandatory. The real homogeneous image,
 six-silo startup, membership and public fail-closed cases still qualify runtime.
+
+
+## Accepted TASK-MEMBERSHIP-FLAT-CONFIG refinement (2026-10-07)
+
+Related AC-MEMBERSHIP-001/002/006 and AC-MEMBERSHIP-CONFIG-001 in
+ClusterRouting/PartitionTransfer. Original Linux run37569205558 source57532
+fails before health because its AppHost emits nested TrustedGroup keys while the
+unchanged native settings/binder/strict validator owns flat property names.
+Freeze the single supported flat names before source correction. No dual-format
+acceptance, migration, secret/trust change or old-format compatibility is added.
+
+Ordered stages: root freezes this contract; Luna privately changes only AppHost
+Features/ClusterRouting/Resources/TwoRf3ClusterResources.cs key constants and
+matching feature-local UnitTests whole model/binding regressions; root verifies
+source guards, joins, builds, executes native normal/scalar and the genuine
+six-silo Aspire Docker SDK/MCP scenario, then commits/pushes. Every original
+membership/readiness/admission/identity/cleanup gate remains mandatory. Preserve
+the three-node local profile and all authority/proxy server validation.
+
+Rollback restores only those current-stage key/test changes while retaining
+original failure artifacts. There is no persisted rollout; the corrected
+AppHost emits the existing settings shape. Source integration and exact-source
+Linux/runtime qualification remain open; do not mark this ADR Implemented.
+
+The Accepted [ADR-119](ADR-119-tunit-owned-local-membership-image.md) refinement
+assigns TASK-MEMBERSHIP-TUNIT-LOCAL-IMAGE and AC-MEMBERSHIP-001/002/006 local image
+ownership/proof to the TUnit case, existing Aspire prerequisite and exact-tag
+cleanup. It changes no membership or database ownership protocol; the strict
+GitHub route and original Linux gates remain mandatory and unqualified here.

docs/ADR/ADR-117-native-tunit-ci-entry.md

@@ -17,3 +17,10 @@ Current stage evidence: [NativeTUnitVerification](../Features/TestInfrastructure
 TASK-TUNIT-ENTRY-005 implements REQ/AC-TUNIT-ENTRY-004 from NativeTUnitEntry by changing only the bounded aggregate `docker-rf3` job timeout from 60 to 180 minutes in `.github/workflows/build-and-tests.yml`. The complete same-image coverage cohort requires two full uninstrumented unit censuses, ten positive instrumented groups, native recovery/RF3 and strict descriptor/product admission, alongside the required RF3 suite and build. The observed unchanged local full unit census lasted 19 minutes 28 seconds; that failed development run informs scheduling and provides no acceptance or coverage evidence.
 
 Stages are: freeze the linked requirement; join the workflow together with its source-bound native coverage producer and qualified unit inventory; parse the actual YAML/PowerShell; execute the original complete Linux job; retain all original exits, TRX, source/image hashes and coverage admission receipts. Root owns final integration and the agent's private workflow overlay. Every individual native deadline, bounded operation, coverage threshold, no-skip and fail-closed publication contract remains unchanged. Rollback removes the scheduling amendment and its overlay without admitting partial evidence. This amendment is Accepted, with complete Linux runtime qualification pending.
+
+[ADR-119](ADR-119-tunit-owned-local-membership-image.md) defines the Accepted
+REQ/AC-TUNIT-ENTRY-005 local membership prerequisite refinement. Native selection
+passes arguments only; the TUnit case removes the recursive runner, executes the
+existing Aspire image prerequisite, passes typed identity without environment
+mutation, and joins final exact-tag cleanup after the actual six-silo wave. Root
+freezes/joins; Luna prepares guarded source. Implementation and runtime pending.

docs/ADR/ADR-119-tunit-owned-local-membership-image.md

@@ -0,0 +1,86 @@
+# ADR-119: TUnit-owned local membership image
+
+Status: Accepted; implementation and native runtime qualification pending.
+
+Feature contracts: TestInfrastructure REQ/AC-TEST-015, NativeTUnitEntry
+REQ/AC-TUNIT-ENTRY-005 and ClusterRouting/PartitionTransfer
+AC-MEMBERSHIP-001/002/006. This refines ADR-074/117 prerequisite ownership and
+ADR-106 six-silo membership. No public database, dependency, persistence or
+membership protocol changes are authorized.
+
+The native caller selects `Suite=rf3`, a nonblank bounded filter and
+`LocalRf3Image:Enabled=true`. Initially the only supported owned-image filter is
+`/*/*/TwoRf3MembershipProfileTests/*`; reject other filters instead of silently
+running an unowned local topology. `scripts/Features/TestInfrastructure/run-tests.mjs`
+only validates selection and passes bounded JSON through
+`KEYLOAD_TUNIT_LOCAL_RF3_IMAGE_ARGUMENTS`. It never starts Aspire or Docker.
+Reject mixed native coverage/comparison/protocol selectors and GitHub receipt,
+revision or actions identity; do not erase provenance to admit local mode.
+
+The membership TUnit case owns a `LocalRf3ImageTestSession` followed by a
+`TwoRf3MembershipWave`, in that disposal order. The session reads the explicit
+native preparation arguments and creates the existing testing builder for the
+RF3 suite/filter/local-image prerequisite. Read the original validated runner
+configuration, remove the recursive runner before building or starting, and run
+only `LocalRf3ImagePrerequisite` to its original successful exit. Reuse
+`LocalRf3ImageExecution`, the original source snapshot producer/verifier and
+`LocalRf3ImageCleanup`; do not create another image implementation. Capture the
+canonical reference/tag/receipt as a typed selection, verify its actual current
+receipt/config ID, and pass it explicitly to the wave. Never mutate process-global
+environment or fabricate a registry digest for a Docker config ID.
+
+With no owned-local selection, preserve the existing authenticated GitHub image
+path. A selected malformed local identity fails before cluster startup without a
+GitHub fallback. AppHost's `TwoRf3ClusterResources` uses the existing
+`LocalDevelopmentContainerImage` branch for all six fixed names and preserves
+all current ephemeral/no-benchmark/no-probe/no-cohort gates. Every child builder
+receives only the original validated local selector arguments. The existing
+strict GitHub digest oracle remains unchanged.
+
+Extend `LocalRf3ImageIdentity` with explicit expected-name overloads, preserving
+ordinary three-node wrappers. Validate the exact distinct nonempty expected set,
+all matching model nodes and repository/tag/no-digest annotations before start.
+After the unchanged six-node healthy barrier, inspect the actual six
+`ContainerNameAnnotation` names through the existing native Docker helper and
+require the exact receipt-owned image config ID and configured reference on each.
+Preserve the existing six-member Orleans view, two three-voter groups and actual
+SDK/official MCP no-dispatch operations through nodes 1 and 4.
+
+Stages and ownership:
+1. Root freezes this contract and its feature/ADR links before source work.
+2. Luna unpack_atomicity prepares guarded source under AppHost
+   Features/ClusterRouting/Resources/TwoRf3ClusterResources.cs; IntegrationTests
+   Features/ClusterReplication/Fixtures/LocalRf3ImageTestSession.cs and cohesive
+   feature-local helpers as needed, Helpers/LocalRf3ImageSelection.cs and
+   LocalRf3ImageIdentity.cs; ClusterRouting/Helpers/TwoRf3MembershipWave.cs,
+   Cases/TwoRf3MembershipProfileTests.cs and applicable model negatives; and the
+   native selection script plus UnitTests/TestInfrastructure native selection
+   whole-process regressions. Root owns shared composition and final joins.
+3. Root reviews every source/contract guard, compiles with published packages,
+   and runs native positive and negative selections. Actual local preparation,
+   six started containers, membership, SDK/MCP rejection and full cleanup must be
+   observed in the original TUnit case. Model-only checks cannot qualify runtime.
+4. Commit/push and retain exact-source original Linux qualification separately.
+
+Keep the existing 15-minute case/start deadline, 60-second wave cleanup, producer
+snapshot admission of 20,000 files/512 MiB and existing image cleanup policy.
+Join preparation output readers and application stop/disposal. After wave stop,
+application disposal and all 18 exclusive lock checks, invoke exact-tag image
+cleanup and settle its original process/readers. Preserve primary and cleanup
+failures together. Never force-remove/prune images, delete another invocation,
+skip lock errors or weaken the SDK/MCP no-effect oracle.
+
+AC-TUNIT-ENTRY-005 maps to the actual membership case plus native selection and
+model admission regressions: accepted selection executes the complete flow;
+missing/partial/mixed/GitHub selectors and unsupported filters fail closed before
+startup; changed source/image identity fails without fallback; original cleanup
+refuses a still-referenced image and removes only its own unused tag. Existing
+canonical producer/cleanup whole-operation tests remain mandatory. No new test
+may merely inspect a field/getter or duplicate source logic.
+
+Frontend: N/A, test orchestration only. Public contracts: N/A, no server API
+change. The image and receipt are disposable local development artifacts. A
+failed stage retains original evidence and removes only successfully settled
+owned resources. Rollback is an ordinary source revert of this explicit local
+refinement, preserving ADR-117 direct TUnit and the strict GitHub route. No data
+migration, legacy support, widened deadline or qualification bypass is introduced.

docs/ADR/README.md

@@ -152,5 +152,6 @@ flowchart LR
 | [ADR-114: verified backup artifact publication](ADR-114-verified-artifact-publication.md) | Accepted |
 | [ADR-115: TimeProvider ownership](ADR-115-time-provider.md) | Accepted |
 | [ADR-116: one current format before the first release](ADR-116-first-release-current-format.md) | Accepted |
-
+| [ADR-117: native TUnit CI entry](ADR-117-native-tunit-ci-entry.md) | Accepted |
 | [ADR-118: bounded typed-row INNER JOIN](ADR-118-bounded-relational-inner-join.md) | Accepted |
+| [ADR-119: TUnit-owned local membership image](ADR-119-tunit-owned-local-membership-image.md) | Accepted |