Checkpoint all current KeyLoad implementation changes

Author: KSemenenko

docs/ADR/ADR-090-graph-search.md

@@ -37,6 +37,11 @@ Implementation contract:
 5. G2 implements SQL equivalence and actual .NET/official MCP RF3 fault cases
    before complete task closure. Keep Linux source/run/job/artifact evidence;
    build or development subset success is not whole-task qualification.
+   Its frozen Q1.Search.v1 statement grammar, dedicated SqlGraphSearchRequest,
+   exact lowering, rejection/parameter rules and same-executor ownership are in
+   GraphRetrieval's G2 contract. Root owns wire admission and public adapters;
+   lifecycle_wave owns the bounded QueryExecution parser, manifest profile and
+   mapped real-store lowering/parity tests. Scalar QueryPage stays unchanged.
 
 No persisted data converter, automatic store migration, dependency change or
 physical placement change is involved. Nodes lacking the application capability

docs/ADR/ADR-091-epoch7-interpretation-fence.md

@@ -0,0 +1,34 @@
+# ADR-091: epoch7 interpretation fence
+
+Status: Accepted, 2026-10-04. Owner: root integration; implementation worker:
+Luna query_wave. Related tasks KL-043/019/094/097/100 and
+[REQ/AC-EPOCH7-001 through006](../Features/StorageRecovery/Epoch7.md).
+
+New canonical transfer, saga and projection-lineage records must never be read
+by an engine that can ignore their interpretation. RPC fencing alone cannot
+prevent offline rollback from exposing protected derived vectors. Increment the
+strict data epoch to7 and native checkpoint to5; admit exactly the new serving
+format. Preserve stable native contract aliases/IDs and WAL4 framing.
+
+Choose one explicit stopped-copy converter with exact migration-only native5
+and native6 profiles and a native7 writer. This preserves the existing source5
+acceptance obligations without retaining an obsolete serving path or writer.
+Reject automatic migration and in-place header changes because they cannot
+prove full-node/current-image authority or preserve an independent rollback copy.
+
+The feature specification is the canonical implementation contract: ordered
+stages, exact role-folder ownership, root protocol/AppHost join points, source
+inventory/receipt revision, immutable prior5/prior6 tests, bounded crash/retry
+verification and all-stopped RF3 rollout/rollback. No live conversion is executed
+without explicit scope for the particular user stores. Implementation remains
+Accepted until mapped real process, SDK/MCP RF3 and exact-source Linux evidence
+exists. Missing probe artifacts fail the gate and must not skip tests.
+
+```mermaid
+flowchart TB
+  Contract[New persisted interpretation] --> Data[Strict epoch7 admission]
+  Contract --> Peer[Capability3 and signed-purpose fence]
+  Prior[Exact old binaries] --> Reject[Old readers reject native7]
+  Source[Stopped5 or6 with complete authority] --> Copy[Separate verified7 copy]
+  Copy --> RF3[Start only homogeneous verified RF3]
+```

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -1,4 +1,6 @@
-# Native CQRS request RPC v2
+# Native CQRS stream contract v2
+
+The active epoch7 admission contract is [ADR-091](../../ADR/ADR-091-epoch7-interpretation-fence.md): application RequestInterfaceVersion3 and signed data-epoch7-rpc3 purposes admit the new feature cohort, while native stream shapes, v2 aliases/Ids and KLT2 framing remain frozen. The epoch6/rpc2 pins recorded below describe the prior C1 stage and do not authorize a mixed epoch6/7 deployment. Cancellation/shutdown/unavailable cohort fixtures now run without parallel contention, preserving every native RPC/TTL bound and failure oracle after the original Linux5-failure report.
 
 Status: root implementation contract accepted, 2026-10-04; C1 implementation and regression fixtures are authored. The unchanged six C0 Aspire oracles also passed with published Communication10.2.9. C1 product qualification remains required; authored fault fixtures and local mechanism results do not close it. Canonical slice: ClusterRouting; parent [NativeCqrs](NativeCqrs.md). Decision: [ADR-082](../../ADR/ADR-082-native-cqrs-streams.md). Related slices: ClusterReplication, ClientApi, Authorization, ResourceExecution and StorageRecovery.
 

docs/Features/Messaging/RecurringSaga.md

@@ -69,7 +69,11 @@ destination queue; both queues must share the exact atomic partition.
 
 Persisted SchedulerManage plus relevant QueuePublish grants are required for
 configuration/cancellation/emission/saga writes; root adds the next unused
-Capability bit. All payload/header write grants apply. Emission additionally
+Capability bit. All payload/header write grants apply. Explicit persisted
+scheduler/publish capabilities are required even for a cluster
+administrator, using the existing policy evaluator with its administrator bypass
+disabled for these checks. This applies to both caller and retained creator.
+Emission additionally
 reloads the original creator and its CURRENT scheduler/data/field/header-use
 authority before using retained templates; a revoked creator cannot emit jobs.
 Timeout similarly rechecks the persisted saga creator and source field-use plus
@@ -87,6 +91,23 @@ JSON/default arrays, input bytes and same-partition scope before writes. Read
 inspection uses one Clock-based ReadExecutionBudget, current principal, and
 cancellation; never return partial lists or invented timing guarantees.
 
+Inspection DTOs are `InspectRecurringScheduleRequest(Lane,ScheduleId)` and
+`RecurringScheduleInspection(Definition,Revision,Generation,NextOrdinal,
+Cancelled,Redacted,RedactedFields)`. Definition payload and headers are projected
+under their respective current policies, with distinct payload/header redacted
+paths. `InspectSagaRequest(Lane,SagaId)` returns
+`SagaInspection(Lane,SagaId,Revision,Phase,StateJson,Deadline,Redacted,
+RedactedFields)`, projecting StateJson and omitting the raw timeout template.
+Neither reply exposes persisted creator identity. Public Core
+`InspectRecurringSchedule`/`InspectSaga` take principalId, Lane, Guid and final
+optional CancellationToken and return nullable replies. Root owns their
+HTTP/SDK/official MCP adapters. SchedulerManage is appended at bit37; existing
+numeric capability values remain frozen and prior All grants gain no implicit bit.
+The public reads are `/v1/queues/schedules/inspect` and
+`/v1/queues/sagas/inspect`, .NET `InspectRecurringScheduleAsync` and
+`InspectSagaAsync`, and MCP `keyload_schedule_inspect` and `keyload_saga_inspect`.
+Each reuses the native separate request grain and existing bounded read transport.
+
 ## Requirements, acceptance and stages
 
 | Requirement | Acceptance and automated mapping |
@@ -106,6 +127,16 @@ the coherent stage. S2 freezes the periodic coordinator/fair due-index and real
 process/RF3 failure contract before implementation. Root records all original
 Linux acceptance and source/run/job/artifact results before complete KL-100 closure.
 
+After S1 source handoff, Luna cluster_wave owns new IntegrationTests Messaging
+Cases/Helpers for S1 public mutation and inspection parity over the existing
+genuine Aspire RF3 fixture: SDK/official MCP configure, emit/catch-up/CAS,
+unknown-response replay, timeout atomicity, current creator revocation and
+redacted inspection. These qualify the canonical S1 transitions, not autonomous
+S2 scheduling. The same worker may add the already-required F1 RemoteTransfers
+public intent/accept/receipt/complete and repeated target acceptance oracles.
+Do not change shared fixtures/topology, manufacture failures, bypass discovered
+endpoints, weaken outcomes or run gates. Root owns combined execution and faults.
+
 No dependency or automatic migration is introduced. New persisted contracts need
 the epoch7 old-reader rejection/explicit stopped-copy upgrade workstream before
 delivery; rollback never opens these stores using an unaware reader. Interactive

docs/Features/Search/GraphRetrieval.md

@@ -59,6 +59,10 @@ statistics remain the complete authorized corpus. Traversal never applies that
 endpoint predicate to intermediate vertices. Retriever produces only visible
 Search.Collection endpoints, sorted by shortest hops then full EntityRef;
 missing branches contribute zero and duplicate paths never amplify score.
+Zero-weight branches still validate their request and execute their current
+authorization and bounded read work, but contribute no candidates or score to
+fusion. A zero-weight-only retriever therefore produces no hits; it does not
+bypass GraphRead, seed visibility, label-use checks or shared resource bounds.
 Current edge authority is persisted GraphRead; edge label policy applies when
 Labels is non-null, using exactly the `label` field-use path, including empty
 label arrays. Expansion excludes all selected-hit EntityRefs from its context
@@ -94,6 +98,71 @@ rejects unsupported graph requests, never silently drops an operator. Interactiv
 UI N/A: this is a SDK/SQL/MCP database capability. Current evidence is source
 implementation in progress; no runtime or performance qualification is claimed.
 
+## G2: versioned SQL SEARCH profile
+
+This is a bounded Q1.Search.v1 profile of the shared SQL language, not full SQL
+conformance or a SQL client connection protocol. The dedicated typed
+`SqlGraphSearchRequest(Version, QueryRequest Query)` uses native IDs0/1 and alias
+`keyload.contract.sql-graph-search-request.v1`. Version must be1, Cursor must be
+null and AllowFullScan must be explicitly true. Root joins the native read kind,
+HTTP `/v1/query/search`, SDK `SearchSqlAsync` and official MCP
+`keyload_query_search`; all return the existing GraphSearchResult. Current
+application capability3 admits it. Existing scalar QueryPage is unchanged.
+
+The complete accepted statement order is:
+
+```text
+SEARCH FROM collection
+ [TEXT field MATCH string-or-@parameter [WEIGHT number]]
+ [VECTOR field MATCH @parameter SPACE (id, dimension, metric, model, version)
+  [WEIGHT number]]
+ [SCOPE GRAPH graph SEEDS ((collection, id), ...)
+  DEPTH integer VERTICES integer EDGES integer [LABELS (value, ...)]]
+ [RETRIEVE GRAPH graph SEEDS ((collection, id), ...)
+  DEPTH integer VERTICES integer EDGES integer [LABELS (value, ...)]
+  [WEIGHT number]]
+ [EXPAND GRAPH graph DEPTH integer VERTICES integer EDGES integer
+  [LABELS (value, ...)]]
+ [ALLOW IDS (value, ...)] [LIMIT integer] [FUSION integer]
+```
+
+Collection/field/graph/space identifiers follow current bounded SQL identifier
+rules; seed IDs, label/allowed-ID values and MATCH text accept quoted strings or
+named JSON string parameters. Seed collection is an identifier in the same
+request partition. Vector MATCH is a named JSON array of finite float-compatible
+numbers, with exact supplied space dimension and defined VectorMetric. Empty
+LABELS/ALLOW IDS retain the direct API's empty-set semantics; empty/default seed
+sets reject. Weights default1, limit10, fusion60; walk caps are explicit. At least
+one graph operator is required; graph-only retrieval is valid. Duplicate,
+reordered, unknown clauses, missing/wrong-kind parameters, nonfinite/overflow
+numbers, unsupported cursor/version and trailing tokens reject Validation.
+No clause can be silently ignored or manufacture a different identity scope.
+
+Use the existing bounded tokenizer/token cursor and named constants, preserve
+their whole-SQL token/depth/byte limits, and cap JSON parameters/the complete
+request before building arrays. Parser output is exactly GraphSearchRequest;
+the final G1 validation remains authoritative. Execute solely through
+SearchEngine.GraphSearchAsync with the original principal and cancellation.
+There is no second traversal implementation, extra store read or SQL-specific
+authorization path. Manifest ReadProfiles adds `graph-search-v1`, while its Q1
+baseline and honest scalar conformance inventory remain unchanged.
+
+AC-GSEARCH-006 maps G2 syntax and real-store direct/SQL equivalence to new
+`SqlGraphSearchParserTests`, `SqlGraphSearchParityTests` and
+`SqlGraphSearchRejectionTests` in QueryExecution/Cases with Helpers fixtures.
+Cover all operator combinations, multi-seed/different-collection intermediates,
+empty labels/allowlist, zero weights, exact lowering and invalid parameter/budget
+cases. Root extends genuine Aspire RF3 SDK/official MCP parity with policy,
+write and fault changes before closing the criterion. Public UI N/A.
+
+Root freezes this contract/ADR and owns public adapters/capability/central docs.
+Luna lifecycle_wave owns new Abstractions QueryExecution SQL-search DTO, Query
+QueryExecution parser/validation/executor/manifest profile joins and mapped new
+Unit QueryExecution tests, preserving G1 source and unrelated SQL behavior.
+It escalates unsupported grammar or public contract changes rather than inventing
+fallback syntax. Root reviews/builds/runs actual Aspire gates and commits the
+verified stage while other feature workers continue.
+
 ```mermaid
 flowchart LR
   Request[Versioned graph operators] --> Cut[One authorized read cut]

docs/Features/StorageRecovery.md

@@ -27,6 +27,10 @@ JSON stay unchanged. UI/SDK/MCP schema work N/A: no new wire operation.
 
 ## Native data epoch and explicit offline copy upgrade
 
+The active next-epoch interpretation and conversion contract is
+[epoch7](StorageRecovery/Epoch7.md), under ADR-091. The native5-to6 receipts
+below remain truthful historical evidence and do not qualify the new format.
+
 [ADR-077](../ADR/ADR-077-offline-native-data-epoch.md) freezes KL-043's supported
 native5 -> separate native6 transition. Source is authored and root-reviewed;
 provider and RecoveryTests development Release builds passed with zero warnings