Repair native recovery and RF3 lifecycle evidence

Fix native FTS crash dispatch and preserve the materializer terminal fault in its real recovery flow. Isolate six heavyweight ANN correctness flows through native TUnit scheduling without changing bodies or production budgets. Keep RF3 capture consumers alive through join, capture actual official MCP schemas, correct query and graph fixture oracles, and complete the scoped comparison-helper transfer.

Release build, full native format and governance pass. Native process recovery passes235/235 with no skips or source/assembly drift. Complete normal/scalar, delivered-source Linux RF3 and functional coverage remain open; coverage producer/workflow contracts are accepted preparation only.

Author: KSemenenko

README.md

@@ -335,9 +335,12 @@ Discovery exposes static operation documentation. Each invocation checks current
 The original 104-task plan has **0 fully accepted, 104 in progress and 0 pending**.
 KL-075 now has its first scaling source stage; six-node, open-loop, shard-skew,
 fanout, recovery and movement acceptance remains open. The joined stage has
-compiler/analyzer failures under repair. The earlier local full unit suite passed
-**3,490 of 3,492 tests**, with two failures and no skips; this does not qualify
-the later source. The [original Linux source788 run](docs/implementation/runtime-qualification-37349838022.json)
+passed the local Release build with zero analyzer errors and warnings. The current
+native process-recovery suite passed **235/235**, with no skips. The latest full
+uninstrumented unit report, before the ANN test-scheduling correction, passed
+**2,762/2,763**, with one ANN construction deadline failure and no skips.
+Complete normal/scalar reruns and delivered-source Linux qualification remain
+open. The [original Linux source788 run](docs/implementation/runtime-qualification-37349838022.json)
 passes the official MCP SDK guidance case but fails the complete RF3 and release
 gates. [Checkpoint evidence](docs/implementation/partition-runtime-development-2026-10-05.json)
 keeps those failures and the remaining scalar, recovery, RF3 and scale gates explicit.

docs/ADR/ADR-007-replica-consensus-bootstrap.md

@@ -83,6 +83,21 @@ faults have source-review evidence only unless an exact original runtime receipt
 proves their execution; no forced fatal failure or successful settlement is
 invented.
 
+TASK-REP-MATERIALIZER-FAULT-ORACLE implements AC-REP-002/004/051 in the existing
+real ZoneTree lifecycle case and fixture. Preserve production fault propagation:
+JournalFlushed failure fences the waiter with RecoveryRequired, while repeated
+memoized disposal observes the same original UnknownWriteOutcome after terminal
+cleanup. Verify the borrowed protocol gate, physical owner closure and committed
+prefix reopen. Only the exact already-asserted terminal exception may be
+acknowledged by fixture cleanup; every other scenario or cleanup failure remains
+visible. Implement the test oracle, then its narrow fixture acknowledgment, review
+the normal/faulted paths, and run native recovery before exact-source Linux
+qualification. Root owns contract/integration; the recovery worker owns only
+ReplicaMaterializerLifecycleTests.cs and ReplicaMaterializerLifecycleFixture.cs
+under RecoveryTests/Features/ClusterReplication. No production, format, dependency
+or topology change is involved; reverting the test correction preserves every
+durable cut. Existing process-kill proof does not qualify power-loss or RF3.
+
 Local development execution, when useful, uses the canonical Aspire-owned test
 entry and is labeled development evidence. Only exact-source Linux GitHub
 Recovery/RF3 jobs qualify delivered behavior. No test-only result or historical

docs/ADR/ADR-019-managed-ann.md

@@ -4,12 +4,17 @@ Status: Accepted for the bounded first-party managed HNSW candidate stage on 202
 
 The accepted 2026-10-05 test-resource stage is REQ/AC-ANN-013 in
 [ManagedAnn](../Features/Search/ManagedAnn.md). Root freezes/reviews/joins; a Luna
-worker adds only the named Search test resource and native keyed TUnit attributes
-on the specified five heavyweight fixture methods. Test bodies, corpus sizes,
-product execution budgets and global runner concurrency remain unchanged. Verify
-the private base/post packet, full strict build/format/governance, Aspire normal
+worker changes only native TUnit attributes on the specified six heavyweight
+fixture methods to unkeyed `[NotInParallel]`, as refined on 2026-10-07. The
+unused named Search test-resource helper is removed. Only those six flows are
+globally isolated within their TUnit process; there is no assembly-wide
+serialization. Test bodies, corpus sizes, explicit concurrency tests, product
+execution budgets and global runner settings remain unchanged. Verify
+the private base/post packet, full strict build/format/governance, native TUnit normal
 and scalar suites and exact-source Linux originals before any qualification
-claim. Rollback removes only the resource key and attributes; there is no data,
+claim. The unchanged full R111 failure and focused pass indicate scheduling
+sensitivity without proving the failure's cause. Rollback restores only the
+prior test scheduling; there is no data,
 dependency, public API or production admission change.
 
 ## Context and decision

docs/ADR/ADR-033-code-quality.md

@@ -78,13 +78,17 @@ format, dependency, public API or topology changes belong to this quality stage.
 ## Complete functional unit contributor partition
 
 TASK-CQ-FUNCTIONAL-UNIT-INVENTORY-043 implements REQ-CQ-009 and AC-CQ-018/020/021.
-Keep ordinary unit and scalar suites complete, unfiltered and without coverage.
-Collect functional unit coverage separately through five bounded positive
-selector groups in each mode, with one exact current case inventory. Every
-allowed case belongs to exactly one group; classify every excluded BDN, load,
-stress, performance or comparison case explicitly. Namespace membership alone
-does not authorize a contributor. Bind the inventory to current test sources,
-the same Release compiler-input/DLL/PDB/MVID identities and actual native TRX.
+Keep ordinary unit and scalar suites complete, unfiltered and without coverage
+after the authorized physical transfer leaves their assemblies free of benchmark
+and comparison cases. Those checks stay with the Benchmarks-owned projects and
+workflow. Collect functional unit coverage separately through five bounded
+positive selector groups in each mode, with one exact post-transfer current case
+inventory. Every permitted functional case belongs to exactly one group;
+classify any residual nonfunctional cross-slice case explicitly and record the
+new owner for moved benchmark cases without duplicating selector inventories.
+Namespace membership alone does not authorize a contributor. Bind the inventory
+to current test sources, the same Release compiler-input/DLL/PDB/MVID identities
+and actual native TRX.
 
 Ordered stages: root freezes this contract and owning feature; a Luna worker
 prepares guarded source and meaningful merge-operation regressions; root joins,
@@ -98,3 +102,74 @@ Root owns workflow, inventory, identity and report joins. Roll out one coherent
 strict descriptor/validator/CI checkpoint; rollback restores that checkpoint's
 source/configuration pair, without an alternate reader or reduced qualification.
 No numeric coverage or module closure follows from preparing an inventory.
+
+
+A separate post-descriptor regression invokes the native merge entry point in
+`ProductAdmission` mode against the actual generated Product descriptor and TRX
+receipts. Product and admission modes share path/tool/bounds checks and
+`Read-FcNativeProductPlan`; admission emits only a bounded validation result and
+does not invoke collectors, merge reports or write coverage outputs. The
+regression admits original evidence, rejects a controlled modified copy only
+for its expected validation failure, verifies original bytes remain unchanged,
+and admits the originals again. It uses no authored TRX. Ordinary full unit/scalar
+operations do not claim to perform this separate admission regression.
+
+The Product descriptor also binds successful full normal and scalar unit
+`unitCensus` runs from the same evidence cohort and Release build. Both run with
+coverage disabled and bind original TRX/report hashes, exact identities and
+source locations, the captured source-manifest digest and test-image receipt.
+Normal/scalar census identity sets must agree with each other and with the exact
+current functional inventory. In each mode, its five instrumented groups are
+disjoint and their union equals both that mode's census and the inventory, with
+zero failed/skipped cases. Census files are bounded validation inputs only, never
+coverage merge inputs/counts. Product and ProductAdmission both revalidate the
+same descriptor/census through `Read-FcNativeProductPlan`; native merge
+execution remains unchanged.
+
+Each inventory case also records the original native TUnit `lineNumber` and
+`endLineNumber` alongside its exact current source path/hash. Require positive,
+ordered line bounds within that source file; both census reports and every
+instrumented report must match this exact method/argument source range. Missing
+or mismatched ranges reject rather than falling back to path-only ownership.
+
+
+The descriptor producer takes `-UnitRunStatusPath` pointing to
+`functional-coverage.unit-run-status.v1.json` inside the same evidence root,
+replacing the former single unit/scalar exit-code parameters. Its strict schema
+is `schemaVersion:1`, `sourceRevision`, `sourceManifestSha256`, and `runs`; each
+run has exactly `id`, `suite`, `filter`, `coverageEnabled`, `exitCode`, and
+`resultsDirectory`. Require exactly twelve unique runs: `unit-census`,
+`unit-scalar-census`, `unit-functional-01` through `unit-functional-05`, and
+`unit-scalar-functional-01` through `unit-scalar-functional-05`. The two census
+filters are empty and coverage is false; each coverage filter equals its exact
+inventory selector and coverage is true. Each results directory equals its run
+ID and is confined to the evidence root. Capture each integer exit code from
+the original native TUnit process; all twelve must be zero. Recovery/RF3 retain their
+explicit existing exit-code inputs. Require current source/image parity and
+original bounded native reports for every row; the status file alone cannot
+prove successful execution. Read at most 64 KiB, within the configured manifest
+limit, and reject unknown, duplicate, missing, skipped or malformed entries.
+No alternate directory discovery or prior unit-status schema is accepted.
+The fixed 64 KiB bound accommodates ten ASCII selectors of at most 4,096
+characters and the twelve closed metadata rows. Keep the per-selector bound,
+exact schema and configured manifest limit; the former 16 KiB aggregate cannot
+represent every admitted selector set. This is a private evidence-format bound,
+not a change to operation deadlines, test outcomes or coverage thresholds.
+
+Bind `unitRunStatus` and per-unit/scalar/census `statusId`, consuming all twelve
+rows once with exact directory confinement; recovery/RF3 inputs stay separate.
+The existing `NativeCoverageMergeTests` case uses new CodeQuality/Helpers
+`NativeCoverageProductEvidenceRejection.cs` and
+`NativeCoverageProductEvidenceFiles.cs` for its required post-descriptor phase.
+Set `KEYLOAD_NATIVE_PRODUCT_ADMISSION_REQUIRED=true` and
+`KEYLOAD_NATIVE_PRODUCT_DESCRIPTOR_PATH` together; missing, inconsistent or
+invalid required inputs fail. CI validates the bounded
+`native-product-admission-phase.v1.json` receipt after the complete native
+admit/controlled-denial/immutability/re-admit/cleanup flow. Both absent selects
+only ordinary real backup/restore and cannot qualify the separate phase.
+
+TASK-CQ-FUNCTIONAL-UNIT-INVENTORY-043 joins temporary-directory creation to the existing observed admission/cleanup lifetime: the caller retains the exact owned path before creation and attempts bounded cleanup even when creation fails. Check copied native TRX/descriptor bytes against their own format bounds and the configured per-file bound before writing. Preserve original native failure, all cleanup errors, the existing whole-operation case and the required post-descriptor receipt. No runtime fault proof is inferred from source review.
+
+TASK-CQ-FUNCTIONAL-UNIT-INVENTORY-043 inventory validation preserves native multi-case declaring classes and byte-preserving benchmark transfer namespaces. Distinct declaring classes still obey the frozen positive selector identity contract. The exact physical ComparisonTests source path/hash establishes moved-case ownership; preserved UnitTests namespaces are not functional coverage authority. Case identities remain unique and all functional census/positive-group parity and exclusion checks remain mandatory.
+
+The 2026-10-07 report-display amendment to TASK-CQ-FUNCTIONAL-UNIT-INVENTORY-043 records the declared CLR `className` from original TRX separately from exact original MTP `nativeReportClassName` on each functional inventory row. Native TUnit tree selectors use the former; fixture display suffixes remain untouched in the latter. The linked CodeQuality contract freezes the extra field's bounds, one-to-one report/TRX/source joins, unchanged moved-case shape and mandatory successful census/group parity. Ordered stages are contract freeze, private two-script producer repair and native draft reconciliation, one coherent inventory/producer/workflow join, strict build/format/parser checks, and original complete Linux coverage plus ProductAdmission qualification. Root owns integration; the Luna worker owns only `functional-coverage.native-merge.contributors.ps1` and `functional-coverage.native-merge.functional-report.ps1` within the existing stage. Rollback removes the coherent amendment without introducing a fallback alias reader. Public APIs, persisted formats, dependencies and all existing thresholds are unchanged; failed draft evidence remains unqualified.

docs/ADR/ADR-034-cluster-comparisons.md

@@ -151,3 +151,31 @@ Keep original measurement artifacts immutable; no legacy reader, previous-format
 path, alternate topology, weaker bound or host-process fallback is authorized.
 Source implementation, local development and a pushed commit alone do not mark
 this decision Implemented or establish a performance winner.
+
+## Exact clean source checkout regression
+
+TASK-BC-SOURCE-001 implements REQ-BC-SOURCE-001 / AC-BC-SOURCE-001 in the owning
+feature and retains AC-IMAGE-006. Native `verifySourceCheckout` must reject
+unignored untracked files as well as tracked changes before Dockerfile checks,
+Docker/registry allocation, receipts and GitHub outputs. Use Git's existing
+porcelain status with `--untracked-files=all`, retaining repository ignore rules,
+revision equality, bounded child execution and the existing exact diagnostics.
+
+Ordered stages: root freezes this contract; a Luna worker adds the real
+`SourceCheckoutIdentityTests.CleanSourceIdentityRejectsUntrackedInputAndRecoversWithoutChangingHead`
+operation and its `TemporaryGitCheckout` fixture under
+`KeyLoad.ComparisonTests/Features/BenchmarkComparisons/UnitContracts/{Cases,Fixtures}`;
+root reviews and joins the minimal `prepare-images.mjs` change, builds the
+solution, then verifies this case through Aspire in Benchmarks and retains the
+original native Git/image results. A real committed temporary checkout must
+admit, reject an added untracked source only for the expected dirty diagnostic,
+recover after removing that owned file, and preserve HEAD/tracked bytes. A
+generated ignored file remains admissible. Existing genuine image export/import
+and preflight gates remain mandatory; no Git-only result establishes image
+identity or GitHub qualification.
+
+No schema migration or rollout path is introduced. If qualification fails, fix
+the narrow source/check pair while retaining original evidence; do not keep an
+alternate permissive reader. Root owns docs, integration, source evidence and
+delivery; worker edits are confined to the three owned paths. No dependency,
+Dockerfile, RF3, receipt-field or public operation change is authorized here.

docs/ADR/ADR-039-official-mcp-agent-api.md

@@ -298,3 +298,24 @@ request cannot pin that cut. No fake transport, direct-store proof, fixture chan
 new provider or runtime contract. This adds no persisted/public format change;
 rollback removes only these tests/helper overload together. A failure or blocked
 cluster does not qualify the EventStreams capability.
+
+## Native official-client schema evidence
+
+TASK-MCP-NATIVE-SCHEMA-EVIDENCE supports existing REQ/AC-CLIENT-006 and AC-MCP-001.
+Root freezes the bounded diagnostics contract in ClientApi. A Luna worker owns
+only new `IntegrationTests/Features/ClientApi/Helpers/NativeMcpSchemaEvidence.cs`
+and additive capture calls in existing `McpDiscoveryTests`,
+`GraphIncomingMcpSchemaTests` and `PartitionQueryMcpSchemaTests`. Root reviews,
+joins, builds and executes those unchanged assertion flows through actual Aspire
+Docker RF3 and the official C# MCP client, then retains original GitHub artifacts.
+
+Capture only the three exact tool input schemas before the existing assertions:
+at most 64 KiB UTF-8 per object, with at most 1 KiB safe name/context/filename/size/
+SHA-256 sidecar. Use the existing repository-root helper and unique owned files
+under uploaded `artifacts/qualification/mcp-schema-evidence/`; reject unknown
+names, invalid objects, excess size and failed writes. No credential, caller
+payload, private catalog, production logger, alternate schema or synthetic
+response is introduced. Public API, persistence and dependencies are unchanged.
+Original failed assertions remain failures. Fix their owning schema/oracle only
+after actual payload evidence establishes the defect; no compatibility reader
+or permissive integer/nullability fallback is authorized.

docs/ADR/ADR-074-aspire-owned-test-entry.md

@@ -32,6 +32,17 @@ and rejection, transferred discovery inventory, solution build, formatter,
 governance and Aspire functional suites. Failed gates remain open; reverting
 this boundary requires owner direction.
 
+TASK-TEST-PIPELINE-EXCLUSIVE-HELPERS completes that ownership boundary without
+behavior changes. Move the byte-identical benchmark-only
+`TestOrchestrationConfigurationKeys.cs` and `WorkflowDatabaseGroups.cs` into
+ComparisonTests `Features/BenchmarkComparisons/UnitContracts/Contracts/` and
+`UnitContracts/Models/` respectively, preserving their namespaces. Remove their
+two linked Compile entries from `KeyLoad.ComparisonTests.csproj`; the SDK includes
+the new owned paths. Keep the genuinely shared `TestElapsedClock` link. Root owns
+contract, join, solution build and evidence; a Luna worker owns only those two
+file relocations and the comparison project change. No new tests are needed for
+a byte-preserving move; retain existing discovery/assertions and required gates.
+
 ## Decision and boundaries
 
 `KeyLoad.AppHost --KeyLoadTests:Suite=<suite>` composes one actual Aspire

docs/ADR/ADR-078-native-full-text-projection.md

@@ -218,3 +218,20 @@ records the full Release build and formatter, actual Aspire native unit26/26 and
 process-recovery10/10 results, source/binary/report hashes, and the real package
 signature check. These bounded filtered development suites do not qualify the
 complete Linux/RF3 release gates or close KL-029/039/097.
+
+## Native-text recovery dispatch correction
+
+TASK-FTS-RECOVERY-DISPATCH implements the existing REQ/AC-FTS-003/004/005
+process-cut contract. The private CrashHost protocol has exactly five arguments:
+canonical source directory, receipt path, native fault stage, replacement flag,
+and mode. `NativeTextCrashScenario.TryRunAsync` reads the mode from the end of
+that array before the ordinary commit-stage fallback. The former forward index
+missed the native mode and sent the receipt path into commit-stage parsing.
+
+Root freezes this protocol, repairs only that index in the owning CrashHost
+Search helper, reviews it, builds current Release source and runs all ten existing
+first/replacement native-cut cases through Aspire recovery. Their real kill,
+complete canonical digest/bytes, recognized cleanup, rebuild and healthy search
+oracles remain unchanged. No package, canonical format, public operation,
+migration or alternate dispatcher is introduced. Retain original failed and
+passing native receipts; local execution alone does not close Linux/RF3 gates.