fix: bound query results and repair native RF3 qualification

Apply consistent SQL, AST, graph search and live result caps without changing
native atomic write budgets. Order embedded commit timestamps inside the apply
gate and restore native silo and membership-authority readiness routes.

Add whole-operation SQL rejection, graph/vector, indexed cursor, event/queue
atomicity and cancellation regressions. Keep fixture-owned Aspire image
preparation, diagnostics and native process shutdown joined.

Local Release and format pass. Complete normal/scalar suites passed2876/2876
each on their retained pre-format cohort; recovery236/236. Final current
Aspire-owned RF3 SQL/.NET/official MCP operations passed8/8. Exact-source Linux,
full RF3, six-silo membership and product coverage remain open.

Author: KSemenenko

README.md

@@ -332,34 +332,28 @@ Discovery exposes static operation documentation. Each invocation checks current
 
 > **KeyLoad is a development preview.** Try it, build with it and [tell us what breaks](https://github.com/managedcode/KeyLoad/issues), but don't trust it with production data yet.
 
-The original 104-task plan has **3 fully accepted, 101 in progress and 0 pending**.
-The accepted tasks are **KL-007** storage codecs, **KL-010** document CRUD/CAS and
-**KL-012** batch/idempotency, each bound to its original Linux tests and compiled
-source, including real process retries and task-specific SDK/MCP RF3 operations.
-Their acceptance does not qualify the remaining features or the complete cluster.
-
-The [latest completed Linux RF3 cohort](https://github.com/managedcode/KeyLoad/actions/runs/37590715245/job/112691267500)
-recorded **151/158**, with seven failed operations. Coverage collection and merge
-were skipped after that failure. The [same run's Linux verify job](https://github.com/managedcode/KeyLoad/actions/runs/37590715245/job/112691308536)
-passed normal and scalar **2,771/2,771** and recovery **236/236**, without skips.
-These results bind to Stage VI commit `4c48909`; they do not qualify later edits.
-Stage VII has joined bounded Q2/AST2 relational INNER JOIN, real concurrent
-committed document/index scanning, strict native MCP schema oracles and exact
-functional contributor selection. The final full Release build and formatter
-pass with zero warnings, errors or source drift. Owning normal/scalar operations
-each pass **606/606**, and real indexed/idempotency process recovery passes
-**2/2**, with unchanged source/DLL/PDB identities and no skips. These are local
-owning subsets. New public Q2 RF3 and complete current-source Linux qualification
-remain open; the Stage VI results above predate these additions.
-
-Three GPT-6.1 Sol workers prepare disjoint implementation and whole-operation
-verification batches while the integration owner runs stable compiled cohorts.
-The next reviewed source packets contain **52 JOIN rejection scenarios** and
-TUnit-owned fresh-image preparation/shutdown for standard RF3 and six silos;
-these packets have not been integrated or executed yet. Full SQL/client protocol,
-FK, KL-075 scaling, complete RF3, functional coverage, endurance and release gates
-remain open. The [implementation status](docs/implementation/status.json) retains
-original failures, source/report hashes and each qualification boundary.
+The original 104-task plan has **7 accepted, 97 in progress and 0 pending**.
+Accepted: **KL-005** backup/restore, **KL-007** storage codecs, **KL-010**
+document CRUD/CAS, **KL-012** batch/idempotency, **KL-016** committed projection
+outbox, **KL-024** time-series ordering/idempotency and **KL-025** reference
+ranges/aggregates. Each closure is bound to its original criteria and Linux
+operation evidence. Complete feature and cluster qualification remains open.
+
+Current source includes bounded Q2/AST2 same-partition relational INNER JOIN,
+52 JOIN rejection scenarios, graph mutation/atomic-retry and traversal deadline
+flows, vector atomic rejection flows and 12 public SDK/official MCP rejection
+flows. C# fixtures own fresh-image Aspire preparation, RF3 readiness and joined
+cleanup. Three GPT-6.1 Sol workers prepare disjoint implementation and complete
+operation batches while the integration owner validates stable compiled cohorts.
+Local full native normal and scalar suites passed **2876/2876 each**, and process
+recovery passed **236/236** on their retained compiled cohort. Final Release build
+and formatter passed after import-order and test identity corrections; eight real
+Aspire-owned RF3 SQL JOIN/schema/auth/budget/cancellation/read-cut operations passed
+**8/8** through .NET and official MCP clients. Exact-source Linux and complete RF3
+qualification, six-silo membership, full SQL/client protocol, FK, KL-075 scaling,
+functional coverage, endurance and release gates remain open. The
+[status tracker](docs/implementation/status.json) retains the original failures,
+source/report hashes and each qualification boundary.
 
 Functional coverage excludes load/comparison runs and admits complete operation
 flows only. The current registry selects **94 contributors**: 41 normal, 41

docs/ADR/ADR-016-atomic-physical-placement.md

@@ -51,3 +51,23 @@ flowchart LR
     Pack --> Move[Explicit fenced snapshot and tail movement]
     Move --> New[New physical placement same logical identity]
 ```
+
+
+## Accepted query-scoped observation composition, TASK-PMOVE-OBSERVATION-001
+
+REQ-PMOVE-002/003 and AC-PMOVE-002/003 require deterministic cancellation during actual native traversal, not an aggregate-counter polling race. Preserve the existing PartitionRecordPageReader.Read signature and all default callers. Add an internal overload accepting the existing typed StorageReadObserver before optional afterKey and cancellationToken. Its production purpose is caller-owned query-scoped examined-work accounting, admission and cooperative cancellation; it exposes byte counts only, never keys, values, identity or payloads. It owns no view/store/thread and makes no placement or persistence change.
+
+Compose the native VisitRange observation after existing checked page examined-byte charging, exactly once for each successfully charged native observation including lookahead; immediately check the initiating token again before any consumer copy. Existing provider/page bounds retain precedence. The callback is synchronous inside the original caller-owned read gate and cannot escape that call. Callback failure propagates as the original exception, prevents successful partial-page return and leaves storage unchanged. Callers must supply bounded nonblocking accounting/admission callbacks; no awaited work, store reentry or detached work is supported. Default calls take one null callback branch per charge with no extra native reads, copies, counters or retained buffers. No throughput/latency improvement is claimed without measurements.
+
+Implementation ownership: Core ClusterRouting/Queries/PartitionRecordPageReader.cs composes the existing native delegate; UnitTests ClusterRouting/Helpers/PartitionRecordCancellationRunner.cs executes one synchronous original read and cancels only after its actual observed bytes exceed a separately measured one-record page including lookahead. Cases/PartitionRecordCancellationTests.cs and Assertions/PartitionRecordCancellationStateAssertions.cs require exact initiating token, no partial page, completed original call before owner disposal, exact diagnostic observed-byte agreement, all seeded canonical key/value bytes and position unchanged, and a healthy complete bounded page. A second real native flow throws from the caller observation and retains that exact exception with the same full-state/healthy oracles. No fake view/provider, timing sleeps, retries, thread priorities, larger fixture or accepted-success alternative is admissible.
+
+Root freezes/joins this private packet, runs strict build/native normal/scalar reports and retains original raced-case failures. Rollback removes the observer overload/test composition only; no format or data migration. Linux/process/RF3 and complete movement gates remain required, and ADR-016 is not marked Implemented by this stage.
+
+
+## TASK-GRAPH-RF3-UNKNOWN-RECONCILIATION-001 (source-only acceptance amendment)
+
+Preserves REQ-GRAPH-010 / AC-GRAPH-009 and REQ/AC-REP-003 stable-command outcomes under original fixture-owned graph-path-rf3-leader-loss. Original Linux run37612238705/attempt1/job112762012221/SHA24c0ac47 actual AcGraph009 failed on UnknownWriteOutcome after leader loss; that failure is immutable. Unknown does not establish either commit or absence. Native KeyLoadClient.CommitAsync is the existing public canonical CommitReceipt operation with caller-owned stable command identity. There is no generic public read-only command receipt lookup; specialized queue-transfer inspection is unrelated and cannot substitute.
+
+Freeze before code: capture the original CommandRequest exactly once, preserve its original partition/mutation bytes, existing administrator principal/client and unchanged original initiating deadline/token. Only an actual first UnknownWriteOutcome admits ONE awaited same-object CommitAsync reconciliation. Any other first error, any unsuccessful reconciliation (including another unknown), and cancellation remain failure. No loops, new IDs, alternate caller, sleep/backoff, generic election retry, health-only success or deadline extension. A successful receipt must come from the real SDK, never inferred from readiness or path existence. After actual canonical success, one same-command receipt replay must return byte-identical complete CommandId/token/mutations/durability. Literal mutation upsertEdge/exact graph+edge/revision1 and complete shortcut edge endpoints/label/attributes{} /revision1 prove one logical graph effect. This also applies when initial call succeeds.
+
+Owning paths: existing IntegrationTests GraphTraversal Helpers/GraphPathRf3LeaderLoss.cs and cohesive Helpers/GraphPathRf3CommandReconciliation.cs. The existing real AcGraph009 flow is the regression; no fake provider/probe is introduced. All original survivor SDK and official MCP path checks, restored-node health/native status/catchup, every replica SDK path and restored-node official MCP path remain, strengthened with exact shortcut edge equality. Cleanup retains primary and all original stop/restart errors. Dependencies unchanged; no migration/public dispatcher/consensus repair. Root guards/joins/builds and runs exact native AcGraph009 plus mandatory full gates. Source reconstruction is unqualified. Rollback removes helper/calls/oracle amendments together, without changing canonical identity or RF3 policies.

docs/ADR/ADR-028-persisted-scheduling-time.md

@@ -35,3 +35,18 @@ Related: `REQ-MSG-004/AC-MSG-004`, `REQ-REP-002/AC-REP-002`; ADR-003, ADR-026, A
 5. Qualify process recovery, real RF3 leaders/followers, and operator readiness signals through GitHub Actions only.
 
 Current `MessagingTests` cover queue time behavior, but a full scheduler gate is planned. Owner: Messaging plus ClusterReplication/Orleans; dependencies: persisted command time, resource governor, and ADR-036 foundation.
+
+
+## Embedded final clock ordering, TASK-EMBEDDED-CLOCK-ORDER-001
+
+EmbeddedCoordinator is the product-owned real standalone admission coordinator over DatabaseEngine and its native ZoneTree Store.Commit gate. For coordinator-owned JSON/native submissions, bounded validation/normalization stays before commit; the final EvaluationClock.GetUtcNow sample is selected inside the original Store.Commit callback immediately before the existing ApplyCommittedCommand. Retain exactly one commit and the shared authorization/outcome/fingerprint/strict ValidateCommandClock pipeline. Public Apply(ReplicatedOperation, replicationIndex) retains supplied canonical EvaluatedAt unchanged. This matches RF3 ReplicaLeader final timestamp selection under rounds and state.LockedAsync before ordered append; embedded ownership does not qualify RF3. No clamp, retry, backward-clock acceptance, fence reset or second coordinator lock is allowed. Cancellation is rechecked inside admission before clock selection; synchronous original apply settles before return. TASK-EMBEDDED-CLOCK-ORDER-001 maps REQ-REP-001 and AC-REP-001, and native durable-job clock/owner contracts under ADR-028/ADR-110. Preserve original R308 four journal-fence failures. Root validates all five NativeSagaTimeoutFunctionalTests actual native job operations, plus existing strict stale-clock/replay tests, normal/scalar and required Linux/RF3 gates. No result or source review closes these runtime predicates.
+
+
+## Native fixture default-time admission, TASK-TEST-EMBEDDED-CLOCK-ORDER-001
+
+TASK-TEST-EMBEDDED-CLOCK-ORDER-001: TestDatabase is the shared test owner of a genuine native ZoneTree DatabaseEngine. Submit without explicit time must use existing DatabaseEngine.ApplyEmbedded, which selects final business time inside the original ordered Store.Commit callback. Submission with explicit DateTimeOffset retains public Apply and its strict supplied-clock/replay/outcome semantics. Preserve the same stable operation ID, serialization, principal, errors and one real commit; no clamp, retry, mock coordinator, new gate or fenced-manager reset. This fixture composition refines TestInfrastructure actual-operation evidence (REQ/AC-TEST-010) and ADR-028 embedded clock ordering, not RF3 topology or clock qualification. NativeSagaTimeout shared PerTestSession fixture concurrently admits default CompleteSaga/CancelSaga/ConfigurePrincipal/revocation operations while native durable-job journal removal commits; pre-gate default clock sampling can therefore race the later committed instant. Existing five actual NativeSagaTimeoutFunctionalTests plus explicit stale-clock/ClockUncertain/replay tests, full normal/scalar and Linux gates remain required. Original R308 journal fences remain immutable evidence; no runtime success is claimed.
+
+
+## Saga deadline construction and admission
+
+TASK-TEST-SAGA-DEADLINE-ORDER-002 freezes CreateWaitingSaga intent: sampled now constructs dueAt, persisted CompareExchangeSaga.Deadline and identical DueWorkHint.DueAt. It is not an externally authoritative command evaluation instant. Sample deadline construction from the owning Database.EvaluationClock, preserve unchanged DueOffset/CompletionTimeout arithmetic and the exact canonical deadline/hint. Submit without explicit time selects final operation evaluation inside existing ApplyEmbedded commit admission. Never widen deadline, clamp time, retry or reset the native journal fence. Explicit-time canonical clock/replay regressions elsewhere remain unchanged. Existing five genuine NativeSagaTimeoutFunctionalTests deadline/effect/stale/revoked/completed/canceled and healthy control-job oracles remain required, along with original R317 outcomes before join.

docs/ADR/ADR-033-code-quality.md

@@ -209,3 +209,22 @@ completeness and numeric gates stay intact. The separate AC-CQ-018 first-profile
 contract is preserved. Luna owns a private one-workflow selector patch, root
 reviews and joins it before delivery; no fabricated native evidence or coverage
 claim is permitted. A rollback removes registry, reader and selectors together.
+
+
+### Native coverage package-producer implementation contract, 2026-10-07
+
+Native coverage package metadata composition joins the legitimate NuGetPackageRoot, dotnet-coverage and the centrally pinned version with System.IO.Path.Combine. Roots with and without a trailing separator have identical native package ownership semantics. Retain immutable build metadata, original feed/package closure validation and fail-closed preparation; no environment fallback or surrogate package is admitted.
+
+Ownership: CodeQuality, ADR-033, TASK-CQ-PRODUCTION-IDENTITY-003; AC-CQ-039..042 and the existing source-manifest/process-settlement acceptance flows. Root must build legitimate NuGet package roots with and without their trailing separator, then execute NativeCoverageMergeTests.ActualCliBackupRestoreCoverageMergesWithRepeatedInputInvariantAndPreservedState and NativeCoverageImageMaterializationTests.RealMaterializerRejectsAlteredAndOccupiedInputsThenCopiesTheObservedReleaseClosure on the genuine installed package. Preserve original pre-operation failures and exact new source/image identities.
+
+
+### Native coverage metadata-enumeration implementation contract, 2026-10-07
+
+Native compilation receipt enumeration uses MetadataReader.GetAssemblyDefinition().GetCustomAttributes(), the native indexed collection for the owning assembly. Preserve assembly parent, constructor, type, scope, signature, blob, enumeration order, record/count/text bounds and all original source pre/post equality scans. No caching, skipped project scan or weakened manifest validation is permitted.
+
+Ownership: CodeQuality, ADR-033, TASK-CQ-PRODUCTION-IDENTITY-003; AC-CQ-039..042 and the existing source-manifest/process-settlement acceptance flows. Root must execute the existing complete NativeImagesProduceClosedManifestAndRejectTamperingWithoutReplacingEvidence and AcCq045CanceledChildAndOutputOverflowSettleBeforeHealthyOperation flows, retaining tamper denials, restored healthy verification, create-only evidence and joined child cleanup. Compare actual original metadata records before/after on genuine product and generated TUnit images. No runtime equivalence or speedup is claimed by this packet.
+
+
+## Native confined path traversal, TASK-CQ-NATIVE-CONFINED-PATH-001
+
+TASK-CQ-NATIVE-CONFINED-PATH-001 preserves Resolve-FcPath lexical rooted/parent/escape rejection and every per-segment reparse denial. Replace PowerShell provider Join-Path/Test-Path/Get-Item with native Path.Combine/File.GetAttributes for the same original segments. Only FileNotFoundException and DirectoryNotFoundException retain the original missing-path behavior; all other native IO failures propagate, never admit an unchecked path. Symlink/dangling/reparse points retain the exact frozen ErrorPath message. No filesystem cache, omitted segment, skipped source/PDB/image scan, new authority or timeout change. Final regular-file/compiled-file and caller-specific existence checks remain unchanged. Original path normalization, source checksum/pre-post identity binding, all complete manifest passes and cleanup remain mandatory. Linux filesystem behavior requires original runner proof; private macOS native diagnostics are development evidence only. Ownership is CodeQuality shared path confinement under ADR033/TASK-CQ-PRODUCTION-IDENTITY-003 and AC-CQ-039..042 plus existing complete native manifest tamper/restoration and process-settlement flows. Root must qualify real normal/scalar source-manifest operations with original bounds before closure.