Start all cold RF3 voters before readiness barriers

Reuse the original Aspire-owned replacement identities and start all three
stopped voters before waiting for their full health. Count the actual native
physical-owner metadata reads in the independent ANN byte-budget oracle and
rebind only its four original source rows from current MTP/PDB observations.

Validation: full Release solution build with 0 errors and 0 warnings; canonical
full formatter; four ANN operation flows in normal and scalar; current 3297-case
native census with 1706 compiled declarations; governance and diff checks.
The original cold RF3 flows require fresh Linux execution. Whole-task acceptance,
full delivered-source RF3/recovery and numeric functional coverage remain open.

Author: KSemenenko

docs/ADR/ADR-117-native-tunit-ci-entry.md

@@ -354,3 +354,9 @@ Ordered ownership: this appendix and ADR117 precede the scripts/TestInfrastructu
 Before execution the owner must discover the current Integration image and verify this exact native UID/type/method/argument identity against original discovery and current source/DLL/PDB; a missing or changed identity refuses. Record prepared9 and executed1 separately with original source/input/image/receipt/TRX/caller/cleanup provenance. One successful initiating SDK instance is local development proof, never nine-case or Linux acceptance. After its complete original receipt/checkpoint/healthy Release/joined cleanup succeeds, the complete original nine normal/scalar flows and all Unit/process/Linux/coverage gates remain mandatory and OPEN. No product, public transport, persisted ID, default, deadline, quota, protocol fallback or benchmark workload changes.
 
 Rollback removes only this narrow caller option and additive regression/appendices; original admission, failures, discovery and image receipts stay immutable. Source preview and real Node composition are distinct from compiled TUnit and operation qualification.
+
+## TASK-FEED-COLD-VOTER-START-001
+
+REQ/AC-FEED-005 and REQ/AC-TEST-007 retain the original cursor/live-cold requirements in [ChangeFeeds](../Features/ChangeFeeds.md#task-feed-cold-voter-start-001) and the matching TestInfrastructure appendix. This test-owned lifecycle refinement addresses native all-three-killed ordering: accept Start for all three original replacements before asking the first to become fully healthy. Use the original ContainerRestartOwnership through BeginContainerRestartAsync, then reuse it through RestartContainerAsync; the original receiver, source/image/receipt checks, health predicate, failure ledger, cancellation and joined shutdown remain unchanged.
+
+Ordered implementation contract: feature/infrastructure/this ADR first; root native-preview/applies only IntegrationTests/ChangeFeeds/Helpers/FeedLiveRf3Cold.cs; compile the actual affected image; execute both original complete FeedLiveRf3Tests identities under the unchanged two-minute operation bound and actual fixture Aspire RF3/SDK/official MCP/Q1 callers; retain source/PE/PDB/image/UID/TRX, full cold/page/policy/replay/healthy and resource settlement proof; commit/push and authenticate current-source Linux gates. Other task owners keep independent slices. This is not an Implemented or qualified ADR status. No production contract, storage, provider or topology changes require a migration. Reversal removes only this undelivered ordering repair and appendices; original failed evidence and every mandatory full suite/coverage gate remain.

docs/Features/ChangeFeeds.md

@@ -223,3 +223,11 @@ REQ/AC-FEED-002/005 and AC-REP-004 preserve every original41-event reference/rev
 Correct only the unsupported cross-call cut equality: the complete empty continuation must retain exact known through/tail/first/hasMore/changes and a nonempty actually consumed cursor, and its fresh cut must independently include the original acknowledged tail receipt. Do not infer a cross-node monotone cut beyond that receipt, copy a cursor, synthesize metadata or accept missing events. Strengthen both existing ChangeFeedObservedWorkTests Args without changing their native case identity: after actual observed cancellation/deadline, no-partial/no-effects and complete original literal healthy two-event page, perform a genuine canonical ConfigurePrincipal for an unrelated principal. Compare its complete original result; require the independently captured store position to advance without adding an outbox event or changing root/collection authority. Resume the SAME healthy cursor and compare all seven page fields against literal empty changes/through2/tail2/first1/hasMore=false, its opaque returned cursor and the independent actual new store position. The resumed read must leave the complete canonical image/cut unchanged. An incorrectly frozen old cut fails this control.
 
 Ordered ownership: append this feature/ADR010 contract; native-preview/apply only existing SnapshotInstallFeedAssertions and ChangeFeedObservedWorkTests, with bounded feature-local ChangeFeedReadCutAssertions. No product/public contract, format/alias/Id, deadline, quota, topology, signed operation or fixture readiness change. Root joins once after the prior immutable image tests settle, builds affected images, retains native discovery/source/PE/PDB and executes full36 Unit normal/scalar plus all original7 process and5 RF3/Linux scopes. Strict48 task qualification, complete product coverage and all other acceptance gates remain mandatory and OPEN. Rollback removes only this coherent oracle/control extension; the original Linux failure remains immutable.
+
+## TASK-FEED-COLD-VOTER-START-001
+
+REQ/AC-FEED-005 and REQ/AC-TEST-007 preserve the original complete cursor/revocation and live snapshot/tail flows. Authenticated Linux run38054816445 at source1c28e failed the unchanged two-minute cold reconnect in FeedLiveRf3Cold.RestartAsync. The native source kills all three original Aspire voters, then asks the first restart to reach full health before either remaining voter receives its Start. This ordering prevents the stopped majority from joining that health barrier; the historical timeout and subsequent routing failure remain failed evidence.
+
+Under [ADR-117](../ADR/ADR-117-native-tunit-ci-entry.md#task-feed-cold-voter-start-001) and ADR-125, first freeze this contract, then change only IntegrationTests/ChangeFeeds/Helpers/FeedLiveRf3Cold.cs: serially accept BeginContainerRestartAsync for all three original killed voters before the existing serial RestartContainerAsync/health stages. Those calls reuse the same ContainerRestartOwnership, accepted replacement identities and original receipt/image/source checks. Keep every kill, failure observation, health predicate, deadline and joined shutdown. Root owns the guarded native patch, compiler, original-case execution and Git/Linux delivery; the other task owners continue independently.
+
+The original OriginalCursorReconnectsAcrossColdRf3AndRechecksRevokedPersistedAccess and ConcurrentSnapshotAndCommittedTailRemainGapFreePrivateAndRevocable identities must exercise their actual fixture-owned Aspire RF3, SDK/official MCP/both Q1 callers, same-volume recovery, original cursors, complete literal pages/receipts, persisted revocation/repair and healthy continuation under unchanged bounds. A startup failure or partial case is not a cold-flow pass. Backend production, frontend, public contracts and storage formats are N/A because this changes only the existing test-owned restart ordering. Existing full Unit/process/Linux/RF3/coverage gates remain required and OPEN. Reversal removes only this undelivered ordering change and its additive trace while retaining original failures; no migration or compatibility path is added.

docs/Features/CodeQuality.md

@@ -2104,3 +2104,11 @@ The current coherent compilation contains 3297 authentic MTP cases bound to 1706
 
 
 The original local execution cohort passed 66/66 selected operation cases and a separate 5/5 required selection controls in normal, plus 71/71 operations/controls in scalar, with native50 and unchanged per-run source/image bindings. All 12 full/group normal/scalar discoveries independently admitted the complete 3297-case census and five functional group counts (574/580/574/574/573) in that same semantic cohort. The original canonical formatter then rejected 17 import-order findings; actual native Sort Usings actions repaired those exact 17 files. The final full Release solution build passed with zero errors/warnings and the final canonical full formatter passed with unchanged final compiled source. The post-execution source delta is exactly those 17 import-order actions and includes no Unit test source; post-sort rerun of the original 66/5/71 selections is not claimed. Separately, all eight original real Orleans connection-grain operations passed in both normal and scalar against the final built image, with unchanged source/image/entry bindings and original native TRX. These are authentic separate local development cohorts. Full delivered-source Linux suites, SDK/official-MCP RF3, source-bound numeric functional coverage, fault/resource/endurance/performance and whole-task acceptance remain open. No task promotion follows.
+
+### TASK-CQ-ASD-ORIGINAL-FOUR-REBIND-001
+
+REQ-CQ-009 and AC-CQ-018/019/039 govern the source-only successor of TASK-ASD-NATIVE-PHYSICAL-READ-BYTES-001. The four original AnnSeedReadBudgetTests operations retain their native identities, classifications, requirement/acceptance mappings, group ownership and selectors. Root must obtain a successful current full solution build, actual complete MTP census and native PE/PDB compiled-source observation before updating only their observed source hash and declaration ranges in the reviewed inventory. Every other row and all five group memberships remain byte-for-byte equivalent as data; no case is added, retired, excluded or moved. Validate the guarded joined inventory with the canonical native-census validator before delivery. ADR-033/125 and the existing current-image inventory contract cover this metadata repair; no new runner, producer or coverage exception is introduced.
+
+The 2026-10-10 Stage46 local build passed with zero errors/warnings and unchanged 6835 source inputs. Actual MTP discovery observed all 3297 cases and the canonical compiled-image observer verified all 1706 declared Unit source files. Both actual four-case ANN executions passed, normal and scalar, against the same final image with native50, observed overlap4 and unchanged source/image/entry inputs. These results cover exact native physical read bytes, the one-byte-below refusal without mutation, bounded lookahead without a partial result and the original real deadline followed by healthy capture. Fresh group rediscovery, delivered-source Linux/RF3 execution and numeric functional coverage are separate evidence; earlier 12 discoveries retain their original cohort. The FeedLiveRf3Cold startup-order repair is source-present and runtime qualification remains pending. Root owns integration and original receipts; the independent feature owners continue without waiting for this metadata checkpoint. No whole-task promotion follows.
+
+Stage46 final local checkpoint: canonical full verify-no-changes passed without source drift; the guarded four-row inventory joined at SHA256 6ce9df3553af4690458a95125696a4a775d860a76ab102910ef52ddb5edeecb9 and the unchanged canonical native-census validator admitted all3297 current cases against actual1706 compiled-source declarations. No case/group/selector membership changed and no fresh12-group execution or numeric coverage is claimed. Both original ANN operation profiles passed4/4; the cold all-three restart repair still requires the complete original Linux RF3 flows. See TEST-PIPELINE-001.currentStageXLVIDevelopment for original build, formatter, discovery, image and TRX receipt hashes.

docs/Features/Search/ManagedAnnSeed.md

@@ -172,3 +172,13 @@ No background thread or original capture is abandoned. Root runs full Release,
 static checks and actual Aspire normal/scalar cases and the unchanged complete
 seed suite, retaining original evidence. No product format or transport change;
 rollback removes the test scheduling repair, not a native cancellation check.
+
+### TASK-ASD-NATIVE-PHYSICAL-READ-BYTES-001
+
+REQ-ASD-001/003 and AC-ASD-001/003 retain the complete canonical read-cut, current persisted authority and exact inclusive ReadBytes contract. Original Linux run38054816445/source1c28e failed MetadataVectorAndDocumentReadsAreChargedExactlyOnce (expected3535, observed4121) and ScanLookaheadFailureNeverReturnsPartialSeed (expected2037, observed2623) in both profiles. Native source confirms the actual fixture enables physical-owner admission, so the same budgeted Resource read checks the unpublished target, committed physical catalog, placement row and directory before the collection definition. The independent oracle omitted those real native accesses; an unexplained constant or relaxed assertion cannot repair that omission.
+
+Under existing ADR-019/035/058/125, freeze this contract first and extend only the private MeasureSourceBytes oracle in UnitTests/Search/Cases/AnnSeedReadBudgetTests.cs. Measure the original target-stage key, both actual catalog accesses, placement row and directory with the native stored-byte observer, alongside every existing principal/resource/head/applied/vector/document/eligible-lineage charge. Each actual access is counted; the two catalog reads stay distinct. Use native canonical keys without calling the production collector for an expected value. Preserve all four original complete flows: the literal visible corpus, exact and one-byte-under limits, lookahead refusal without a partial seed or mutation, and genuine deadline followed by a fresh healthy capture. No production, public transport, alias/Id, budget, clock, authorization or topology changes are needed; those surfaces are N/A for this test-oracle repair.
+
+Root owns native preview/apply, actual affected compilation, unchanged normal/scalar flow execution and delivery. Rebind any changed source/PDB inventory ranges only from actual native compiled observations; preserve all original identities, required non-contributors, five class-owned groups and selectors. Full Release/formatter, exact-source Linux normal/scalar, recovery/RF3, functional coverage and resource/endurance/performance gates remain mandatory and OPEN. Reversal removes only this unqualified oracle amendment and additive trace while retaining original failures. Existing architecture contracts suffice; no new dependency, persistence format, migration or compatibility path is introduced.
+
+Stage46 local development evidence: the exact four original AnnSeedReadBudgetTests operations passed in normal and scalar (4/4 each) against the successful current full Release image. Both original native TRX runs retain native50/observed overlap4 and zero source/image/entry drift. The independent oracle counts the actual unpublished-target, two distinct physical-catalog reads, placement row and directory values; exact and one-byte-below limits, hidden/stale source accounting, lookahead refusal and the original real deadline/healthy continuation remain unchanged. Full formatter and canonical current3297-case census/PDB-source admission passed after updating only these four original source rows. Linux, full functional coverage, public ANN projection and RF3 acceptance remain open; KL-031 is not closed by these local operations. Original receipt hashes are recorded in TEST-PIPELINE-001.currentStageXLVIDevelopment.

docs/Features/TestInfrastructure.md

@@ -1200,3 +1200,9 @@ Ordered ownership: this appendix and ADR117 precede the scripts/TestInfrastructu
 Before execution the owner must discover the current Integration image and verify this exact native UID/type/method/argument identity against original discovery and current source/DLL/PDB; a missing or changed identity refuses. Record prepared9 and executed1 separately with original source/input/image/receipt/TRX/caller/cleanup provenance. One successful initiating SDK instance is local development proof, never nine-case or Linux acceptance. After its complete original receipt/checkpoint/healthy Release/joined cleanup succeeds, the complete original nine normal/scalar flows and all Unit/process/Linux/coverage gates remain mandatory and OPEN. No product, public transport, persisted ID, default, deadline, quota, protocol fallback or benchmark workload changes.
 
 Rollback removes only this narrow caller option and additive regression/appendices; original admission, failures, discovery and image receipts stay immutable. Source preview and real Node composition are distinct from compiled TUnit and operation qualification.
+
+## TASK-FEED-COLD-VOTER-START-001
+
+REQ/AC-TEST-007 and the original ChangeFeeds REQ/AC-FEED-005 preserve fixture-owned Aspire RF3 and the complete public cursor/live-cold operation gates. [ChangeFeeds](ChangeFeeds.md#task-feed-cold-voter-start-001) and [ADR-117](../ADR/ADR-117-native-tunit-ci-entry.md#task-feed-cold-voter-start-001) freeze the original source1c28e/Linux reconnect failure and the native all-three kill followed by first-voter health-before-peer-start ordering.
+
+Order and ownership: root freezes these appendices before changing only FeedLiveRf3Cold; serial BeginContainerRestartAsync accepts each original voter replacement, then the existing serial RestartContainerAsync/health barriers reuse those same owners and identities. Preserve original cancellation, failure aggregation, images, readiness, membership, receipts, cleanup and two-minute case scope. No manual Docker, parallel dictionary writes, retries, additional provider, fresh fixture or widened deadline. Run the same two complete native FeedLiveRf3Tests identities through the canonical caller and actual owned resources; retain original startup/operation/cleanup failures without promoting a partial flow. Full Linux, source/image/native identity, recovery, SDK/official MCP RF3 and coverage remain required. Rollout is the guarded source checkpoint and fresh Linux execution; reversal removes only this additive undelivered repair and trace while retaining immutable originals.