Repair native roster contracts and retain official MCP initialization diagnostics

Author: KSemenenko

docs/ADR/ADR-008-backup-log-retention.md

@@ -83,3 +83,5 @@ flowchart LR
   D --> E[Atomic new identity pair and paused authority reset]
   E --> F[Joined owner then target publication]
 ```
+
+TASK-KL042-ROSTER-ORIGIN-NATIVE-ANALYZER-002 preserves REQ-BACKUP-ROSTER-RESTORE-001 and AC-BACKUP-ROSTER-RESTORE-001/002 after original source f3d7feb2/run37946644265 failed CA1819 and CA1062. The new unqualified generated-origin digest uses bounded ReadOnlyMemory<byte> at unchanged field Id5; compare its span against exact SHA256 without exposing a mutable array property. Validate actual public reference parameters before native key/identity matching. This is the current new metadata contract, with no format fallback, migration or acceptance claim. Existing genuine restore, first-write/replay, corrupt/missing-origin refusal, exact repair and cold/second-restore flows remain required. Root owns the source repair, coherent integration and fresh original Linux compiler/format/native operation evidence; rollback is confined to this still-unqualified origin contract.

docs/ADR/ADR-039-official-mcp-agent-api.md

@@ -500,3 +500,8 @@ REQ-CLIENT-006 / AC-MCP-001/003/007 map to the independently frozen movement enu
 ## Accepted native MCP failure diagnostic contract
 
 TASK-MCP-PIPELINE-DIAG-001 implements REQ/AC-MCP-PIPELINE-DIAG-001 through the [exact ClientApi ownership/privacy/stages/tests](../Features/ClientApi.md#task-mcp-pipeline-diag-001--owning-native-failure-evidence). At the original two catches, event5 publishes only closed stage/ErrorCode/actual method category; preserve original first failure and diagnostic failures in their native ledger. Missing request method reports Other. Root owns integration/docs/CI/Git; whole-task owner obtains actual original failing-branch evidence and repairs its proven cause. Contract→source→coherent Linux compilation/native discovery→actual branch observation→complete official SDK normal/scalar-caller RF3 outcomes/cleanup. No negotiation/schema/payload/data/quota/retry/fallback changes. Rollback removes observation only; source diagnostics do not establish causality, runtime branch coverage or acceptance. ADR remains Accepted.
+
+
+## Accepted official SDK initialization evidence
+
+TASK-MCP-NATIVE-SDK-INIT-DIAG-001 implements REQ/AC-MCP-NATIVE-SDK-INIT-DIAG-001 under the [ClientApi exact contract](../Features/ClientApi.md#task-mcp-native-sdk-init-diag-001--official-caller-failure-classification). The native pinned CreateAsync ILoggerFactory carries only the native LogSendingRequestFailed integer ErrorCode to a caller-owned maximum8-event closed observation. No formatter/message/state strings/exception/Data/body/header/private identity are inspected or published. Factory recording starts only around actual CreateAsync, stops before operations, outputs only on failure, and is disposed after joined native session/transport/HTTP owners. Original failure remains first with observation/write/cleanup errors separately retained. No new protocol/parser/options/deadline/retry/fallback/production semantics. Existing real unsupported initialization→healthy official two-operation flow gains full native SDK result parity; original held/no-quorum failures still require native branch evidence. Contract→verified exact official source→private guarded packet→root join/Linux build/native census→actual original branch classification→proven owner repair→full normal/scalar RF3 qualification. Root owns join/Git/CI; KL021 worker owns private diagnostics/evidence. Rollback removes observation/parity only. Event absence is unclassified, never inferred timeout. Source review and supporting regression do not qualify the original cause; ADR remains Accepted.

docs/Features/BackupRestore.md

@@ -398,3 +398,5 @@ flowchart LR
   D --> E[Atomic new identity pair and paused authority reset]
   E --> F[Joined owner then target publication]
 ```
+
+TASK-KL042-ROSTER-ORIGIN-NATIVE-ANALYZER-002 preserves REQ-BACKUP-ROSTER-RESTORE-001 and AC-BACKUP-ROSTER-RESTORE-001/002 after original source f3d7feb2/run37946644265 failed CA1819 and CA1062. The new unqualified generated-origin digest uses bounded ReadOnlyMemory<byte> at unchanged field Id5; compare its span against exact SHA256 without exposing a mutable array property. Validate actual public reference parameters before native key/identity matching. This is the current new metadata contract, with no format fallback, migration or acceptance claim. Existing genuine restore, first-write/replay, corrupt/missing-origin refusal, exact repair and cold/second-restore flows remain required. Root owns the source repair, coherent integration and fresh original Linux compiler/format/native operation evidence; rollback is confined to this still-unqualified origin contract.

docs/Features/ClientApi.md

@@ -962,3 +962,16 @@ REQ-MCP-PIPELINE-DIAG-001 / AC-MCP-PIPELINE-DIAG-001 require failure-only native
 Pinned official SDK2.2.0/explicit2026-07-28 uses server/discover; a helper named Initialize does not establish a different original method. Existing outgoing replacement behavior remains unchanged. This observation does not prove the original connection cause or repair negotiation. Exact ownership: src/KeyLoad.Server/Features/ClientApi/Transport/McpSessionPipeline.cs, Contracts/McpPipelineFailureStage.cs, Contracts/McpPipelineMethodCategory.cs, Diagnostics/McpPipelineFailureDiagnostic.cs. Frontend N/A; no public endpoint/protocol/schema/catalog/persisted format/provider/quota/deadline/retry/fallback/cancellation change. ADR: [ADR-039](../ADR/ADR-039-official-mcp-agent-api.md).
 
 Root freezes/joins/docs/CI/Git; KL-021 whole-task owner obtains actual catch execution evidence, repairs only a proven owning cause, and retains genuine official SDK/MCP healthy/refusal/cancellation/full receipt/cold cases. Ordered stages: contract; coherent source; Linux build/format/native discovery; original source/image-bound native failing-branch observation; proven repair; complete normal/scalar-caller RF3. Existing unsupported-protocol/healthy flows do not themselves prove catch coverage. No getters/metadata/synthetic PASS qualify. Rollback removes only observation while original native failure/cleanup remain. Actual native branch coverage, compilation and Linux results are OPEN.
+
+
+## TASK-MCP-NATIVE-SDK-INIT-DIAG-001 — official caller failure classification
+
+REQ-MCP-NATIVE-SDK-INIT-DIAG-001 / AC-MCP-NATIVE-SDK-INIT-DIAG-001 refine REQ-CLIENT-006 and AC-MCP-001/003/005/007. During the actual pinned official SDK2.2.0 McpClient.CreateAsync only, a caller-owned ILoggerFactory accepts only category ModelContextProtocol.Client.McpClient, Warning, EventId.Name LogSendingRequestFailed, and its native integer ErrorCode state entry. Capture at most8 closed RemoteRpcError/category+numeric-code events; saturation is explicit. Never invoke the formatter, inspect/retain arbitrary messages, EndpointName, Method, RequestId, exception/Data, state strings, payload/body/header/principal/credentials, or enable Trace. Unknown events/state shapes are ignored; no synthetic cause is substituted. An observed event proves a native RPC error; absent events do not prove timeout or success. The same actual native client/options/transport/token execute unchanged.
+
+Exact official source at commit6fa3825973949a9c4f0cd8af344e15a8db09dc35: McpClient.Methods.cs CreateAsync passes ILoggerFactory into McpClientImpl; McpClientImpl.cs creates ILogger<McpClient> and supplies it to McpSessionHandler. McpSessionHandler.cs logs LogSendingRequestFailed with integer errorCode at704–707 before raising its native remote protocol exception, and1186–1187 define its Warning structured event. Native .NET10 LoggerMessageAttribute.EventName defaults to the method name. Existing pinned2026-07-28/native five-second discovery probe and60-second initialization budget are unchanged.
+
+Ownership: IntegrationTests ClientApi Diagnostics/NativeMcpInitializeLogObservation.cs owns the bounded caller factory/logger; Helpers/McpOfficialClient.cs owns true CreateAsync start/stop and joins its factory cleanup after native session/transport/HTTP settlement; Diagnostics/McpInitializeHttpObservation.cs writes safe native SDK evidence alongside existing HTTP evidence only on original failure. Original error remains first; diagnostic observation/write/cleanup faults join without masking it. Successful calls emit no diagnostic output; recording stops before real operation calls. The factory remains a stopped silent owner until the native session drains. No public API, storage format, dependency version, production logger, negotiation, parser, topology, resource admission, deadline, retry or fallback change. Frontend N/A.
+
+Existing actual Aspire RF3 McpDiscoveryTests.AcMcp003UnsupportedOfficialProtocolRejectsThenCurrentCallerExecutes retains exact unsupported-version HTTP400 then true fresh current-revision connection and two genuine MCP operations, strengthened by full native SDK capability-result parity. This operation flow exercises failed initialization→joined cleanup→healthy official connection/operation, not logger DTO/property assertions. Original KL021 held Grant(SqlSdk) and lost-quorum(SqlSdk) initialization failures additionally require exact-source normal/scalar original logs and native error events; ordinary unsupported handshake regression does not establish remote-RPC event coverage.
+
+Ordered stages: contract before source; exact native API/source verification; private guarded source review; root join/build/format/native census; original failed-branch diagnostics; repair only proven owning cause; complete genuine SDK/MCP healthy/refusal/receipt/cold RF3 flows and original Linux artifacts. Root solely owns live integration/Git/CI; whole KL021 worker owns private source and evidence audit. Rollback removes this caller observation and parity enhancement together without changing native failures/options/cleanup. ADR: [ADR-039](../ADR/ADR-039-official-mcp-agent-api.md); qualification and event coverage remain OPEN.

docs/Features/CodeQuality.md

@@ -20,21 +20,22 @@ checkout changes. Unavailable code fixes require an owning-source repair, not a
 suppression. Recheck after repairs; fail on remaining errors/warnings or workspace
 load failures. Informational/hidden suggestions are advisory and require review.
 
-REQ-CQ-ROS-003 / AC-CQ-ROS-003: retain the canonical final format, strict Release
-solution build and mapped native TUnit/Aspire operation regressions. Roslynk
-diagnostics supplement these gates; they do not qualify runtime behavior, RF3,
-coverage or exact-source Linux delivery. New behavioral defects need complete-flow
-regressions in their owning slices. No product dependency, runtime protocol,
-storage format or database topology is changed by installing this development tool.
+REQ-CQ-ROS-003 / AC-CQ-ROS-003: retain the canonical final format and strict Release
+solution build for preserving source repairs. The owner clarified this task on
+2026-10-09 as Roslynk code-quality inspection and fixes only; do not execute test
+suites or expand this task into behavioral regression work. Runtime/RF3/coverage
+qualification is N/A to this scoped inspection and remains open in its owning
+workstreams. No product dependency, runtime protocol, storage format or database
+topology is changed by installing this development tool.
 
 TASK-CQ-ROS-001 maps these criteria to actual local tool/MCP operations (explicit
 manual-evidence exception for developer installation, no source-text tests),
-compiler diagnostics, canonical build/format and the affected existing TUnit
-suites. The lead owns root configuration, policy/docs and final integration;
+compiler diagnostics and canonical build/format. The lead owns root
+configuration, policy/docs and final integration;
 read-only workers inspect upstream APIs and the ordered ten-skill quality baseline.
 Ordered stages are pin/install/configure; load/diagnose; assign preserving repairs
-and meaningful regressions by finding; join/freeze source; format/build and run
-mapped suites; record actual results. Baseline findings and generated reports stay
+by finding; join/freeze source; format/build; record actual results. Baseline
+findings and generated reports stay
 in ignored artifacts or temporary storage. Delivery qualification remains open
 until the required original Linux evidence exists. Rollback removes only this
 local tool entry and MCP configuration, retaining product repairs and unrelated work.
@@ -46,9 +47,19 @@ flowchart LR
     MCP --> Workspace[Loaded KeyLoad solution]
     Workspace --> Findings[Compiler and analyzer findings]
     Findings --> Repair[Reviewed preserving source fixes]
-    Repair --> Gates[Canonical format build and native tests]
+    Repair --> Gates[Canonical format and build]
 ```
 
+Local Roslynk inspection on2026-10-09 loaded all27/27 projects to Ready and
+rechecked the solution with compiler errors, warnings and analyzers included.
+The initial27 errors were repaired; the recheck reported zero errors and zero
+warnings. Informational/hidden suggestions remain advisory, including existing
+namespace/folder differences and intentionally unused fluent assertion results;
+this result does not claim every style suggestion has been eliminated. The
+owner-scoped follow-up performs formatting and compilation only, without test
+execution or additional runtime qualification. Original diagnostic reports are
+kept outside the checkout.
+
 TASK-CQ-UNIT64-010 implements the owner's 2026-10-06 rule-specific correction:
 REQ-CQ-006 / AC-CQ-008 now require KLD0032 at an executable-unit boundary of64
 code lines. File400, aggregate type200, nesting3, token/trivia counting,

docs/implementation/status.json

@@ -210,7 +210,7 @@
     "localMovedContractTestsPassed": 27,
     "compiledUnitBenchmarkTypes": 0,
     "compiledComparisonBenchmarkTypes": 588,
-    "verificationStage": "stage42_native_roster_restore_origin_source_joined_claimed_cleanup_style_build_failure_repaired_fresh_linux_qualification_pending",
+    "verificationStage": "stage43_native_roster_analyzer_repairs_and_official_sdk_initialization_diagnostics_source_joined_fresh_linux_qualification_pending",
     "remaining": [
       "Delivered exact-current-source Linux complete normal/scalar/recovery/fullRF3 with original same-job source/image identities",
       "Complete current normal/scalar/recovery and genuine RF3 Linux qualification; native selection discovery passed, retain original failed and repaired cohorts separately.",
@@ -41288,6 +41288,46 @@
         "KL-001 clean Linux archive/license/source/native audit"
       ],
       "nativeUidAndImageAdmission": "pending actual source-bound native census and receipts; no authored method counts promoted"
+    },
+    "stageXLIIDeliveredCommit": "f3d7feb24e173cdc0b2fae94be7ec441372c0851",
+    "stageXLIIDeliveredRemoteVerified": true,
+    "stageXLIIIOriginalDevelopment": {
+      "sourceBase": "f3d7feb24e173cdc0b2fae94be7ec441372c0851",
+      "originalLinux": {
+        "run": 37946644265,
+        "attempt": 1,
+        "job": 113874581546,
+        "log": "/private/tmp/keyload-original-f3d7feb2-full-build-job-v1.log",
+        "sha256": "e6fa5495d886ac0022cc62e66f8ebbc9c66cf5ae1af9d15abed287c9381a6522",
+        "uniqueDiagnostics": [
+          "CA1819 native roster origin byte-array property",
+          "CA1062 four native roster serialization reference-argument guards"
+        ],
+        "uniqueDiagnosticCount": 5,
+        "outcome": "solution build failed before native functional execution"
+      },
+      "nativeSdkInitializationSourceJoinReceipt": "/private/tmp/keyload-r905-kl021-native-sdk-initialization-diagnostic-source-joined-20261009.json",
+      "nativeSdkInitializationSourceJoinReceiptSha256": "b3577fe359a063424f250317c14569abf4f9e9878a0eb42711dd719a2390d4f0",
+      "nativeSdkInitializationSourcePaths": 6,
+      "nativeRosterRepair": "Preserve current unqualified generated origin field ID 5 with ReadOnlyMemory<byte>, exact SHA256 comparison through Span, public reference guards, and the existing complete restore/write/replay/cold/refusal cases. Preserve concurrently authored Roslynk source repairs; no old-format reader or migration.",
+      "qualification": "source integration only; original failed Linux diagnostics retained, no fresh compiler or native runtime result admitted",
+      "actualOriginal104Tasks": {
+        "done": 17,
+        "in_progress": 87,
+        "pending": 0
+      },
+      "nativeOrdinaryParallelism": 50,
+      "heavyRf3Parallelism": 1,
+      "actual50OverlapQualified": false,
+      "concurrentDevelopmentTooling": "Authorized Roslynk source repairs and native logger semantic rename are preserved. This caller opened the absolute KeyLoad.slnx: all 27 projects loaded, no load diagnostics. Subsequent native status is Building27/27, and the diagnostic observation has not produced a result. This is not a clean-workspace, compiler, runtime, coverage or exact-source Linux claim.",
+      "remainingWholeTaskImplementation": [
+        "KL-042 coherent native cluster restore, bounded capture, joined cold restart, stable-operation CLI interruption/resume",
+        "KL-036 rejected replica-frame observation and complete genuine cleanup matrix",
+        "KL-021 fresh original official SDK initialization evidence and all native operation routes",
+        "KL-001 clean Linux published archive/license/source/native dependency audit"
+      ],
+      "nativeUidAndImageAdmission": "pending actual source-bound native census and original DLL/PDB/image/report receipts; no authored method counts or tool diagnostics promoted",
+      "nativeSdkInitializationPostJoinRename": "Concurrent authorized Roslynk inspection renamed NativeMcpInitializeLogObservation and its compiled references after original six-path join R905; original immutable receipt retained, current full-scope checkpoint retains the semantic rename."
     }
   },
   "TIME-PROVIDER-001": {

src/KeyLoad.Abstractions/Features/BackupRestore/Contracts/AtomicPartitionRosterRestoreOrigin.cs

@@ -15,7 +15,7 @@ public sealed record AtomicPartitionRosterRestoreOrigin(
     [property: Orleans.Id(AtomicPartitionRosterRestoreOriginFields.SourceIncarnation)] Guid SourceIncarnation,
     [property: Orleans.Id(AtomicPartitionRosterRestoreOriginFields.RestoredIncarnation)] Guid RestoredIncarnation,
     [property: Orleans.Id(AtomicPartitionRosterRestoreOriginFields.AppliedUpperBound)] long AppliedUpperBound,
-    [property: Orleans.Id(AtomicPartitionRosterRestoreOriginFields.EntryDigest)] byte[] EntryDigest);
+    [property: Orleans.Id(AtomicPartitionRosterRestoreOriginFields.EntryDigest)] ReadOnlyMemory<byte> EntryDigest);
 
 internal static class AtomicPartitionRosterRestoreOriginFields
 {