Fix native C1 capture ownership and current WAL preflight

Author: KSemenenko

.github/workflows/build-and-tests.yml

@@ -213,7 +213,7 @@ jobs:
   docker-rf3:
     name: Test three-node database
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 180
     steps:
       - name: Download source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

README.md

@@ -342,7 +342,14 @@ source/test-image identity verification, without skips. Later native codec and
 captured-envelope criteria now close **KL-007**, with all19 mapped cases passing
 in both modes and all33 owned source files bound to the original compiled images.
 The newer cross-process ownership and read-cut regressions pass locally; their
-original Linux results remain pending. Six focused local Docker RF3 flows now
+task acceptance remains open. The [newer original Linux run at 6816ae91](https://github.com/managedcode/KeyLoad/actions/runs/37560457057/job/112596312154)
+passed normal and scalar **2,767/2,767**, recovery **235/235** and same-job native
+source/test-image identity checks. Its RF3 job was canceled near the original
+60-minute aggregate budget without producing a completed RF3 report. That job
+now has 180 minutes, with individual scenario deadlines and gates unchanged.
+All six unchanged native Aspire logger-control flows pass locally, including
+caller cancellation and original task settlement; these model/logger controls
+do not qualify Docker database execution. Six focused local Docker RF3 flows
 pass through the real SDK and official MCP clients, covering native schema
 discovery and autonomous saga timeout/replay. The owned image lifecycle also
 passes prepare, verify, cleanup and repeated cleanup. Full Linux RF3,

docs/ADR/ADR-057-orleans-atomic-wal.md

@@ -56,6 +56,19 @@ complete-envelope/current-header proof gaps. They remain open and do not gain
 qualification from this sequence guard or a development build. The ADR remains Accepted until its full original
 unit/process/RF3 and current resource evidence exists.
 
+## Complete current-frame payload-length regression
+
+TASK-WAL-LENGTH-MISMATCH is test-only under REQ-STORAGE-017 / AC-WAL-003. The
+existing preflight operation test adds one-byte-short declared payload-length
+arguments to both direct ZoneTree open and the real CrashHost inspector. The
+frame remains physically complete and follows a real committed prefix; both
+paths must return the existing Corruption category, leave the entire provider
+file/tree inventory unchanged, and settle owner-lock cleanup. No production
+format, cap, error category, or torn-tail behavior changes. The already-covered
+short-header suffix remains an incomplete-tail case and is truncated only by
+ordinary recovery. The regression is not qualified until root joins actual
+normal/scalar and applicable recovery evidence.
+
 ## Native codec refinement from exact-source CI
 
 Run37077856823 at6ad4741a7 disproved the authored1024-byte size assertion and overflow-rejection protocol fixture. centrally pinned Orleans NullableCodec's generic codec resolution uses ReadOnlyMemoryCodec<byte> with per-byte tagged fields. Accept the framework's closed native IFieldCodec<ReadOnlyMemory<byte>> → ReadOnlyMemoryOfByteCodec registration, with no custom wire codec. Nullable nonnull values then use native length-prefixed raw bytes. The original size/4096-byte assertions remain unchanged and passed in that native qualification. The current generated Orleans codec uses the accepted closed native memory codec; no custom JSON or alternate-format decoder is supported. The active identity/WAL/checkpoint values and exact bytes remain those frozen in CurrentFormat.

docs/ADR/ADR-074-aspire-owned-test-entry.md

@@ -271,3 +271,31 @@ image/receipt/label/config-ID gates and refusal of any referencing container;
 no force/prune or unrelated resource changes. Keep original failed cleanup and
 owned diagnostic removal receipts distinct from the corrected canonical flow.
 This command repair adds no resource, deadline, dependency or product contract.
+
+TASK-TEST-RF3-AGGREGATE-BUDGET, under REQ/AC-TEST-010, increases only the
+docker-rf3 GitHub job's aggregate budget from60 to180 minutes. Original
+run37560457057 at6816ae91 ended near its60-minute ceiling after its native RF3
+step started, without producing an original RF3 TRX. Its separate verify job
+passed2767 normal,2767 scalar and235 recovery cases. This timing supports an
+aggregate-budget diagnosis; it does not identify an individual case failure.
+Ordered stages: root freezes this contract and the TestInfrastructure evidence;
+changes that single workflow budget; retains all native suites, coverage/source
+identity checks, per-case deadlines and artifacts; verifies the next original
+Linux run. No cancellation or missing report becomes success. Rollback restores
+only the aggregate budget; no product, format, topology or dependency changes.
+
+TASK-TEST-LOCAL-CURRENT-WAVE under REQ/AC-TEST-015 follows R183's pre-start
+GitHub-only receipt rejection. Freeze the linked current homogeneous local-wave
+contract; privately factor the existing LocalRf3ImageIdentity native identity
+read and join it in RequestCqrsRf3ImageProof; join its model proof before wave
+start and actual container proof after native readiness; build and run original
+due and catalog-mismatch SDK/MCP whole flows; retain owned image cleanup and
+fresh Linux qualification. Expected references, current input digest, labels,
+config ID and exclusive local/GitHub environments all remain mandatory. No
+registry digest is fabricated, default CI gate bypassed or deadline extended.
+Root owns integration and evidence. Rollback removes only local-wave admission;
+the native preparation/cleanup producer and default CI path retain their gates.
+The identity crossing start/readiness is the actual pre-start verifier return:
+VerifyModelAsync returns it to a WaveStartup local, then the same value supplies
+started-container checks. Early ReadAsync selects the validated reference only.
+Keep existing caller maps; no ambient state or extra identity carrier is needed.

docs/ADR/ADR-082-native-cqrs-streams.md

@@ -156,7 +156,8 @@ publication or the complete ADR.
 TASK-CRS-DIAG-JOIN-ORACLE implements REQ/AC-CRS-DIAG-005. Aspire 13.6
 `WatchAnySubscribersAsync` reports global subscriber changes and cannot certify
 that this wave's original resource watchers have settled. Keep it for admission
-before `AppHost.StartAsync`, then join the same memoized capture disposal and
+before `AppHost.StartAsync` and bounded nonblocking diagnostics of completed
+transitions at fixed completion/cleanup checkpoints, then join the same memoized capture disposal and
 original `Task.WhenAll` watcher set after the actual resource `Complete` calls;
 only afterward dispose/join the admission observer or publish evidence. Add a
 real `ResourceLoggerService` test consumer on a separate actual model resource
@@ -239,3 +240,59 @@ evidence; dependency_closeout owns the guarded diagnostics packet correction.
 TASK-CRS-DIAG-COMPLETION-OBSERVATION is accepted before implementation under REQ/AC-CRS-DIAG-003/005/006. The linked NativeCqrsRequestV2 contract freezes fixed per-node native Complete-start/return, original-task and drain-token observations at the existing calls/awaits, bounded to the unchanged 2,048-byte context. Preserve all original native work, ordering, failure/fatal priority and cleanup even when observation fails. Existing real Aspire whole-flow cases and fresh exact-source Linux RF3 artifacts provide verification; root owns integration and qualification. The exact existing and optional role paths, private agent scope and observation-only rollback are in the feature contract. No production/public/persisted contract or dependency changes; source reasoning does not prove the initiating failure.
 
 TASK-CRS-DIAG-CLEANUP-JOIN-ORDER, accepted before code under REQ/AC-CRS-DIAG-005, corrects only `RequestCqrsRf3DiagnosticsTestScope.DisposeAsync` to join original diagnostic captures before disposing its independent consumer. The linked feature freezes pinned Aspire close/join semantics, the retained AppHost lifetime, all bounded waits and original/fatal cleanup errors. Stages are freeze, root call-order correction, strict build/format, and existing real Aspire whole-flow/fresh Linux verification. No source-only timeout-cause or qualification claim is permitted; rollout/rollback changes only the same scope order.
+
+TASK-C1-BOUNDED-SUBSCRIBER-DIAGNOSIS implements the linked DIAG-005/006
+refinement in the existing ClusterRouting diagnostics observer, cleanup and
+test scope, with feature-local transition/stream-completion helpers. Freeze the
+same-enumerator single-reader contract first; join the guarded diagnostic code;
+run the original native Aspire case; interpret fixed masks/counts alongside the
+original capture-task states. No added consumer or wait, raw resource names,
+payloads, topology, timeout or publication rule is allowed. At most three
+successful completed events are consumed at each fixed checkpoint; unsuccessful
+or ended moves stay with the original join owner and remain ambiguous here.
+Root owns integration and gates. Rollback removes these optional diagnostics
+without changing any original native task, assertion or completion contract.
+
+TASK-C1-LOGGER-MODEL-CONTROL follows the linked DIAG-003/005/006 contract and
+R177 original native failure evidence. Ordered stages: freeze the exact internal
+selector/trust/ownership contract; root joins AppHostControlOptions, its native
+registration, KeyLoadAppHostApplication and the existing diagnostics argument
+helper; build; run the unchanged native logger-control whole flows; retain the
+separate real RF3 gates. The admitted scope composes the actual AddKeyLoad graph
+and builds it, returning before RunAsync; the testing wrapper retains disposal.
+Reject mixed modes without changing ordinary selection behavior or inherited
+immutable image provenance. No shadow graph, fake logger, private resolver,
+timeout change, original-task shortcut or evidence-schema change is allowed.
+Rollback removes only selector/branch/opt-in. Source and R177 prove unexpected
+ordinary startup in the control scope; they do not prove logger-key drift or
+the initiating cause of the full Linux RF3 cohort failures.
+
+TASK-C1-DIAGNOSTIC-READ-CANCEL-001 refines the optional subscriber observation
+under DIAG-005/006 after R179. Freeze the linked exact diagnostic-task predicate
+and admission-reader ownership transfer; root joins the two guarded observer
+helpers; build; run all unchanged native logger-control whole flows. A pending
+move created only by diagnostic drain is normal cleanup cancellation only when
+it was incomplete immediately before owned cancellation, is canceled at join,
+and the caller stayed uncanceled through join. An original admission reader
+adopting that move removes its diagnostic tag. Keep actual cancellation, join
+and disposal, terminal task state, all other failures and their ordering.
+Rollback removes only that diagnostic lifetime refinement. No task abandonment,
+deadline, original-task assertion, production or persisted contract changes.
+
+TASK-C1-ADMISSION-MOVE-STATUS-002, under DIAG-005/006, preserves the exact
+original admission task in lifecycle evidence after optional diagnostics read
+later moves. R182's five passes and one cancellation-status assertion failure
+remain original failed-cohort evidence. Freeze the linked task-reference
+contract, join only the subscriber observer, build and rerun all six unchanged
+native flows. This observation neither creates nor owns another task and does
+not change cancellation, joins, assertions, deadlines or the context schema.
+Rollback removes only that separate reference; all broader gates remain open.
+
+TASK-TEST-LOCAL-CURRENT-WAVE is accepted for existing current homogeneous C1
+waves under the linked TestInfrastructure contract and ADR-074. Root freezes
+the exact local identity/model/started-container joins, then reviews the guarded
+three-helper packet and runs actual due/catalog SDK/MCP flows. Preserve all
+original production assertions, signed controls, tasks, deadlines and cleanup.
+It grants no GitHub provenance or delivered RF3 qualification to a local image;
+default native CI digest/manifest verification remains mandatory. No public,
+persisted, authorization, topology or dependency contract changes.

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -695,8 +695,10 @@ the original joins have completed. Caller cancellation must not become a
 successful capture or erase its primary failure.
 
 REQ-CRS-DIAG-005 / AC-CRS-DIAG-005 refines the native completion oracle:
-`WatchAnySubscribersAsync` is used only to observe the required pre-start
-admission. Its global `AnySubscribers` changes are never proof that this wave's
+`WatchAnySubscribersAsync` observes the required pre-start admission and may
+diagnose already-completed transitions at the fixed resource-completion,
+pre-fallback and post-original-join checkpoints. Its global `AnySubscribers`
+changes are never proof that this wave's
 three captures have completed, because another native consumer may remain
 subscribed. After completing the three captured resource streams, join the same
 memoized diagnostics disposal and every original watcher task/enumerator before
@@ -708,6 +710,70 @@ scope cleanup. Repeated disposal, fail-closed publication, original task
 settlement, cleanup and fatal/error preservation remain asserted. No parser,
 artifact shape, cap, topology or timeout is changed.
 
+TASK-C1-BOUNDED-SUBSCRIBER-DIAGNOSIS refines REQ/AC-CRS-DIAG-005/006 without
+changing the completion oracle. Reuse the same native observer enumerator with
+one read owner; consume at most three successful, already-completed transitions
+per checkpoint, without waiting for another event or creating another consumer.
+Record only fixed node masks, bounded counts and explicit ambiguity in a fixed
+failure diagnostic. Aggregate subscriber state cannot identify this wave's
+watchers. Failed, canceled and ended moves remain with their original join
+owner, preserving failure order. The original three capture tasks and existing
+deadlines decide success; join them before observer disposal and publication.
+Root joins the reviewed feature-local observer, cleanup and scope helpers, then
+reruns the original native Aspire failure case before interpreting its evidence.
+This diagnostic stage does not establish a timeout cause or qualify RF3.
+
+TASK-C1-LOGGER-MODEL-CONTROL refines REQ/AC-CRS-DIAG-003/005/006 for the
+existing native logger-control scope. R177 records actual ordinary AppHost
+startup during that scope and original captures pending until fallback; the
+aggregate transitions remain ambiguous and do not establish logger-key drift.
+Only this scope selects `KeyLoadTests:LoggerModelControl=true`. Admit that exact
+true-only value without descendants, selected suite, comparison/benchmark,
+TwoRf3, request probe, protocol cohort or local-image preparer. Require its
+existing explicit ephemeral DataRoot and ports; permit ordinary inherited
+immutable image references/provenance from the full RF3 suite. Compose the same
+authoritative AddKeyLoad graph and Build, then return before RunAsync. The native
+testing wrapper owns disposal after all original logger/observer tasks join.
+Keep actual ResourceLoggerService/IResource APIs, assertions, failure priority
+and the 45-second deadline. Actual ClusterFixture and C1 Wave startup, readiness,
+SDK/MCP operations and RF3 qualification stay unchanged and mandatory. This
+control qualifies native logger/model lifetime only, never Docker or database
+RF3. Root joins the four guarded AppHost/options/scope-argument files and runs
+the unchanged positive, independent-consumer, cancellation and early-completion
+whole flows; rollback removes only this opt-in and branch.
+
+TASK-C1-DIAGNOSTIC-READ-CANCEL-001 refines that diagnostic lifetime after R179:
+the original three captures completed without fallback, but a drain-created
+pending move made observer-owned shutdown cancellation fail ObserverJoin.
+Tag only that exact optional move; transfer it out of diagnostic ownership if
+the original admission reader adopts it. Keep the same cancellation/join/dispose
+sequence. Its cancellation is normal cleanup only if it was pending immediately
+before owned cancellation, is canceled at join, and the caller stayed uncanceled
+through join. Retain terminal task state and every fault, preexisting/admission
+or caller cancellation, callback/disposal failure and original error ordering.
+Root joins the two guarded observer/transition helpers and runs all unchanged
+native logger whole flows; no task is abandoned and no deadline changes.
+
+TASK-C1-ADMISSION-MOVE-STATUS-002 refines that observation after R182 passed
+five of six original logger-control flows. Optional diagnostic moves overwrote
+the shared last-move reference after the actual admission move was canceled.
+Retain the exact latest original admission-reader task separately: initialize
+it from the native first move and update it only when that reader adopts or
+creates its next move. AdmissionMove reports this task's actual status, even
+after later diagnostics. This reference owns no new work. Root joins the
+guarded observer correction and reruns all six unchanged native cases; retain
+the original failed receipt, assertions, deadlines, joins and failure ordering.
+
+TASK-TEST-LOCAL-CURRENT-WAVE applies the linked TestInfrastructure REQ/AC-TEST-015
+local image contract to these current homogeneous RF3 waves. Reuse the same
+owned native verifier and actual three-container config-ID checks; reject mixed
+expected references and never synthesize GitHub digest/provenance. Root freezes
+ADR-074/082 before the guarded three-helper packet, builds and runs original
+due and catalog fault flows through real SDK/MCP clients. Keep unique request
+grains, signed controls, resource deadlines and joined cleanup unchanged.
+Local passes cannot close the separate exact-source Linux gates. Rollback
+removes only this explicit local-wave branch and retains default fail-closed CI.
+
 REQ-CRS-DIAG-006 / AC-CRS-DIAG-006 adds test-only first-failure lifecycle
 evidence before changing any cancellation behavior. Retain at most 2,048 UTF-8
 bytes using fixed stage/task labels, native `TaskStatus` and boolean

docs/Features/StorageRecovery.md

@@ -448,6 +448,25 @@ post-cleanup receipt cancellation risk without altering production data.
 |REQ-STORAGE-018 current-version fence and restore|AC-WAL-004 current checkpoint/empty/refusal and InstallSnapshot/restore identity preservation|
 |REQ-STORAGE-019 authentic qualification|AC-WAL-005 full Release/formatter/governance and exact-SHA GitHub unit/process-recovery/RF3 SDK+MCP; speed and power-loss unclaimed|
 
+### TASK-WAL-LENGTH-MISMATCH complete-frame regression
+
+TASK-WAL-LENGTH-MISMATCH refines existing REQ-STORAGE-017 / AC-WAL-003 only.
+`NativeStoreOpenPreflightTests.R12Ac002CompleteCorruptionRejectsBeforeAnyProviderFileChanges`
+adds direct-open and real CrashHost-inspector arguments for an otherwise complete
+current WAL frame whose declared payload length is one byte shorter than its
+actual serialized payload. Both paths must return the existing exact
+`ErrorCode.Corruption`, preserve the complete provider file/tree hash inventory,
+and release the owner lock. The test begins with an actual committed ZoneTree
+record and a valid preceding frame; it does not add a frame-size limit or change
+reader behavior.
+
+The short-header case is already covered by
+`R12Ac002IncompleteCurrentTailIsOnlyTruncatedByOrdinaryRecovery`: it is an
+incomplete-tail recovery case, not a corruption oracle. Existing truncation and
+committed-prefix assertions remain unchanged. This proposal adds regression
+evidence only; fresh normal/scalar and required recovery/RF3 gates remain open
+until their actual reports are joined.
+
 ```mermaid
 flowchart LR
     Transaction[Owned ordered transaction] --> Codec[Orleans generated binary payload]