Repair CI source inventory and preserve retained topic read boundaries

Author: KSemenenko

docs/ADR/ADR-025-event-revision-feed-positions.md

@@ -116,3 +116,8 @@ Verification: private isolated source/build/output lane only; original build/tes
 ### TASK-KL084-NATIVE-PUBSUB-EMISSION-032
 
 The same registered serializer measures and admits the complete native row before allocation. Native buffer size hints are not emitted byte counts: `SerializeToArray` supplies the original native allocation protocol, followed by exact admitted-versus-emitted length verification. Only the owned counting writer actual byte-admission refusal maps to ResourceExhausted with its full original cause; serializer errors remain untouched. The full native CAS/quota/cancellation/disposal/refusal→unchanged state→healthy replacement/restart operations are required; capacities and default provider semantics are unchanged. The isolated native macOS development normal/scalar controls passed both cases after original failures; Linux integrated, provider callback/tail, process-kill recovery and RF3 qualification remain open.
+
+
+### TASK-EVENT-VECTOR-CODEC-RESPONSIBILITY-033
+
+The bounded event-vector phase additions retain the original GrainRequestCodec API. Its exact native payload verification responsibility moves to feature-local `ClusterRouting/Serialization/GrainRequestPayloadVerification`; the façade borrows the same codec, engine and captured maximum token length. Evaluation remains token-length → native signature verification → original scope validation → configured MaxBatchBytes → native payload validation → DecodedGrainRequest. No new authority, configuration capture, allocation, alias, field ID, fallback or exception order is introduced. Existing signed-request negative/healthy operation tests remain the verification gate; source extraction and private compilation are not Linux/RF3 qualification.

docs/ADR/ADR-033-code-quality.md

@@ -441,3 +441,10 @@ RF3 and admitted merged product coverage remain separately required.
 ## Native unit-image producer/consumer join
 
 TASK-CQ-UNIT-IMAGE-PRODUCER-044 implements REQ-CQ-009/AC-CQ-044. Root freezes the exact existing unit sidecar contract, emits it via Get-FcTestIdentitySnapshot, then exercises the actual strict Read-FcTestIdentityManifest through the existing owned bounded native-process runner. The complete prepare/read/tamper/reject/restore/read/create-only flow preserves original bytes, errors, joined exit/readers/disposal and every current source/PE/PDB binding. Root updates the exact normal/scalar contributor identity oracle alongside the eight genuine maintenance flows, builds/formats, runs focused native normal/scalar operations and publishes one coherent checkpoint for Linux qualification. No permissive reader, historical label fallback, database format, dependency, topology or numeric coverage claim belongs to this repair; rollback restores the coherent producer/consumer pair and retains the original reports.
+
+
+## Current Query source inventory and KL-079 binder admission
+
+TASK-CQ-CURRENT-QUERY-INVENTORY-081 in CodeQuality maps REQ-CQ-009 to AC-CQ-018/019/039. Before implementation, freeze the explicit current 189 Query paths, preserving the original 103 and all contributor, source/image, collector and coverage gates. The shared closed task-script list adds only the delivered task-acceptance.kl079-binding.ps1. The independent existing native ProductionSourceManifestScriptAssertions oracle adds that same one literal name and retains exact sorted names, complete field shape, file/link/size bounds and actual SHA-256 checks. Unknown names remain refused by preparation and verification. No schema, runtime, dependency, topology or source-exclusion change is authorized.
+
+Root stages: update the accepted contract and matching closed count/name; exercise existing native full preparation/refusal/restoration/healthy controls and actual current-source prepare/verify after coherent build; retain original failed Linux run 38041208373 and dispatch fresh exact-source qualification. The scripts own only coverage evidence; workers continue their separate feature scopes. Rollout and rollback keep the inventory and its exact admission together. Static equality or successful preparation is supporting evidence, never a passing functional suite, measured coverage or completed task.

docs/ADR/ADR-072-authorized-sql-model-views.md

@@ -173,3 +173,12 @@ Root alone joins, builds/analyzes, discovers native identities and executes curr
 REQ-SQLVIEW-001/003/005 and AC-SQLVIEW-TOPIC-001 retain the original full publish, SQL/AST projection, replay/conflict, purge, stale-generation and healthy boundary flow. After genuine PurgeTopic through position1, the native default after-position0 MUST refuse HistoryUnavailable with the complete raw store image and commit position unchanged. The positive native oracle MUST explicitly start after position1 and return the sole retained position2 record before comparing the complete SQL result. Use the existing ReadEventSourceRequest.AfterPosition contract through a test-local overload; keep the original default reader unchanged. No production history fence, SQL limit, scan/read/result budget, deadline, generation, API or test identity changes.
 
 Root owns the two existing QueryExecution test files and these requirement/ADR records. Stages: contract first; guarded native preview/apply; coherent build/formatter; execute the same original complete cases in normal/scalar; retain original failed report and current source/DLL/PDB/native UID/result artifacts. Linux recovery and Aspire RF3 remain mandatory and unqualified by this local repair. Rollback only this explicit native oracle and its additional negative/no-effect assertions together. The separate strict one-record scan fixture failure is unresolved and is not hidden by this repair.
+
+
+### TASK-KL095-TOPIC-STRICT-SCAN-FLOW-081
+
+REQ-SQLVIEW-004/005 and AC-SQLVIEW-004/005/TOPIC-001 preserve the original one-record scan fixture, two genuinely published records, LIMIT 1 refusal and original cancellation token. Assert complete native bytes and cut after cancellation and again after the separate healthy flow. That original owner cannot perform a positive one-record purge: native purge validates the retained record, identity and purged-identity absence against the same global scan budget. Retain the original failed report; do not increase that owner's limit, change production budgets or describe its failed purge as success.
+
+The same original TUnit identity additionally drives a separate real ZoneTree owner with a fixed 32-record budget. Publish the original two-record command plus 31 independently identified native events, retain both complete command receipts, and require the genuine 33-record complete-history scan to refuse BudgetExceeded even with LIMIT 1, with every native byte and cut unchanged. Perform actual PurgeTopic through position 8 under that unchanged 32-record configuration. The exact retained positions 9..33 and complete literal EventData must agree with the native source page and complete ordered SQL output; default after-position 0 remains HistoryUnavailable. Reads and exact replay of all three original publish/append/purge commands preserve every post-purge byte, receipt and cut. Both owned stores are joined and disposed by their original fixture lifetimes. This 33-record correctness fixture is not scale/performance evidence.
+
+Root owns existing TopicSqlNativeRecoveryTests and feature-local Helpers/TopicSqlScanBudgetFlow.cs. Stages: this contract and ADR-072 first, fresh guarded native patch/new-file admission, coherent solution build/format/diagnostics, same original case in normal/scalar, original source/DLL/PDB/UID/TRX retention and exact-source Linux qualification. No public or persisted contract, deadline, quota/default, SQL limit semantics, authorization, topology or selector changes. Rollback the case extension/helper together; existing Topic RF3 and process-recovery gates remain mandatory and open.

docs/ADR/ADR-117-native-tunit-ci-entry.md

@@ -310,3 +310,31 @@ The create-only private outputs are the exact observed KL079 strict-task object,
 Then root joins/rebuilds/pushes the exact-source proposals and the original normal/scalar task execution runs every declared Unit, process and fixture-owned Aspire RF3 SDK/official MCP/both Q1 operation. Full functional coverage runs with native contributors/collector and unchanged final verifier. Case execution alone cannot promote coverage. Missing native current census, partial scalar results, missing RF3 pages/receipts/cold results or failed/unsettled observations keep closure OPEN. Native50 ordinary/exclusive-heavy ownership and original timeouts/Args/authorization/bounds/cleanup stay exact.
 
 No public/persisted/product protocol or migration change is added. Root alone writes live sources/builds/tests/Git. Rollback removes only this proposal helper and appendices; native original archives/receipts and every existing strict contract remain immutable. This source packet is parser/preview/reconstruction only, with no compiler/runtime/coverage PASS.
+
+
+## TASK-KL029-NATIVE-LOCAL-RF3-ADMISSION-008
+
+REQ/AC-FTS-001..007 and the original KL029 projection/rebuild acceptance retain all mapped Unit/process and nine RF3 operation instances. The isolated native compiled discovery actually observes nine original cases, including four ProtectedNativeTextMaintenanceReplaysBilingualUpdateDeleteAcrossAllPublicPaths arguments (Sdk/Mcp/SdkSql/McpSql); discovery is development evidence and cannot qualify Linux runtime or coverage.
+
+Ordered stages and ownership: this TestInfrastructure/ADR117 contract precedes the exact selected-filter append in scripts/TestInfrastructure/run-tests.mjs and Integration ClusterReplication/LocalRf3ImageSelection. Admit ONLY the existing canonical KL029 complete filter:
+
+`/*/*/(NativeTextAsyncRf3Tests)|(NativeTextMaintenanceRf3Tests)|(NativeTextRf3LeaderLossTests)|(NativeTextRf3Tests)|(NativeTextWaitRf3Tests)/*`
+
+Keep every earlier selector and its rejection flow. The original NativeTUnitSelectionTests RF3 parameter now exercises this exact positive native argument/environment composition and all original ambient GitHub/image/coverage/benchmark/suite/missing/unsupported-filter refusals, plus explicit partial/wildcard/additional-class/trailing-space refusals. Its original native Node process and cleanup remain joined. No synthesized case, changed UID/Args or blanket Search filter.
+
+The original LocalRf3ImageTestSession still owns actual AppHost image preparation, bounded receipt/config/input verification, exact image identity on all three started containers, genuine RF3 startup/readiness, discovered SDK/official MCP/Q1 callers, original cancellation and shutdown, output tasks and exact-tag cleanup only after genuine settlement. AppHost LocalRf3ImageRequest already requires a nonempty explicit filter; no third product/transport policy changes. No ambient fake GitHub identity, unrelated image, provider or topology, increased deadline/budget, registry-receipt fallback or benchmark execution. Native50 ordinary and existing exclusive-heavy ownership stay unchanged.
+
+Root joins guarded source and original mapped positive/rejection tests; the KL029 owner then runs the same nine real operation cases in normal/scalar isolated local images, preserving initiating/cleanup failures and full original results/receipts/cold oracles. Exact-source Linux normal/scalar Unit/recovery/RF3, source/DLL/PDB/image/UID/process/cleanup and coverage remain mandatory and OPEN. Local scalar caller configuration is not proof of scalar Docker-server intrinsics. Rollback removes only this exact filter admission and its test additions/appendices; all prior selectors, original failures and native evidence remain immutable. No public/persisted/product contract changes.
+
+
+## TASK-KL094-NATIVE-LOCAL-DISTINCT-OWNER-ADMISSION-010
+
+REQ/AC-XFER-001..005 retain all original cross-owner, durable receipt, authorization, bounded retry, recovery and public-caller gates. This additive TestInfrastructure/ADR117 contract admits only the complete authored native case filter:
+
+`/*/*/RemoteTransferDistinctOwnerTests/ActualDistinctOwnersRetainAcceptReceiptAcrossTwoColdRestartsAndBDoesNotResurrectAcknowledgedMessage`
+
+Ownership/order: these appendices precede the closed filter addition in scripts/Features/TestInfrastructure/run-tests.mjs and Integration ClusterReplication/Helpers/LocalRf3ImageSelection.cs. The existing NativeTUnitSelectionTests native RF3 argument verifies original Node selection, native argument/environment composition, every ambient GitHub/image/coverage/benchmark/suite/missing-filter refusal, and four distinct-owner partial/class-wildcard/additional-class/trailing-space refusals. Preserve all existing cases, Args, filters, counts and native50 ordinary admission. This is exact local development admission, not broad Messaging or wildcard catalog selection.
+
+The existing LocalRf3ImageTestSession owns genuine fixture AppHost image preparation, current immutable LocalRf3ImageIdentity/source digest/config/invocation/receipt validation, original linked cancellation and joined output/shutdown/exact-tag cleanup. The protected two-RF3 fixture borrows its actual prepared Selection for the same original six containers, owner roots/options/ports/current persisted subjects, real SDK/official MCP/Q1 operations and two joined same-volume cold restarts. All six image identities must validate against the same original prepared receipt. No old image, manual Docker, fabricated environment/GitHub identity, retry, clock/deadline/default/capacity change or new dispatcher.
+
+The original GitHub strict image/provenance branch is unchanged. Root integrates guarded source; private source/image builds and focused positive/negative native tests are development evidence only. Original exact-source Linux normal/scalar Unit/process/RF3, native discovery/UID/source/DLL/PDB/image/cleanup and complete qualification remain mandatory and OPEN. This authored filter is not a native UID or passing operation. Rollback removes only this closed admission, additive regression checks and appendices, retaining all earlier selectors/evidence and original failures.

docs/Features/CodeQuality.md

@@ -2075,3 +2075,10 @@ REQ/AC-CQ-039..042 and ADR-033/117 retain the original collector, exact source/i
 ### TASK-CQ-FUNCTIONAL-UNIT-INVENTORY-045: complete movement, session and telemetry flows
 
 Preserve every prior3045 native identity, disposition, mapping, required control, exclusion and benchmark move. Bind additions and actual current source/PDB ranges only after the coherent native build and full census. Admit genuine native movement terminal/abort/cold command/read operations, original-issued process recovery flows, malformed applied-authority rejection→restoration→healthy indexed reads and real persisted-credential HTTP/exporter flows under their owning movement, DocumentStorage and Authorization criteria. The native wire-reader and typed resource/options composition controls remain required non-contributors. Keep all five group owners and bounded selectors; independently execute the full and every selected normal/scalar census before admission. These discovery and scoped runtime observations do not close whole plan tasks or establish numeric product coverage.
+
+
+## TASK-CQ-CURRENT-QUERY-INVENTORY-081
+
+REQ-CQ-009 and AC-CQ-018/019/039 retain exact source, collector, compiled-image and original-report admission. Actual Linux run 38041208373 at da3e3f7406f038c4d29ff1d23592efb59e703364 built both normal/scalar images successfully but stopped before test execution: the frozen Query inventory contained 103 paths while the current product contained 189. Add the 86 already implemented Query paths to the explicit sorted contract and set its matching closed source count to 189. Preserve all 103 existing paths, every contributor/case, bounds, collector, thresholds, classifications and complete-suite requirements. Never substitute an unrestricted glob, omit executable sources or report unrun tests as passed.
+
+The shared exact task-script admission also adds only task-acceptance.kl079-binding.ps1, whose KL-079 source/image/native-case binder was delivered in that same checkpoint. Keep the other three admitted names and reject every unknown task-acceptance prefix, wrong case, suffix and path. Preparation and original-manifest verification must both hash this fourth actual script. Root owns the contract/shared admission, existing CodeQuality/Assertions/ProductionSourceManifestScriptAssertions.cs and these ADR-033 records; existing ProductionSourceManifestOperationTests and ProductionSourceManifestSettlementTests retain real prepare, reject, original-byte restoration, healthy re-admission and joined process flows. Verify actual current production prepare/verify and the focused normal/scalar controls after coherent build, then dispatch fresh exact-source Linux KL-079 qualification. Original failed run/logs remain immutable; no acceptance or coverage percentage follows from this inventory repair alone. Rollback restores the contract, exact count and script admission together; published evidence is never rewritten.

docs/Features/EventStreams.md

@@ -420,3 +420,8 @@ Verification: private isolated source/build/output lane only; original build/tes
 ### TASK-KL084-NATIVE-PUBSUB-EMISSION-032
 
 The same registered serializer measures and admits the complete native row before allocation. Native buffer size hints are not emitted byte counts: `SerializeToArray` supplies the original native allocation protocol, followed by exact admitted-versus-emitted length verification. Only the owned counting writer actual byte-admission refusal maps to ResourceExhausted with its full original cause; serializer errors remain untouched. The full native CAS/quota/cancellation/disposal/refusal→unchanged state→healthy replacement/restart operations are required; capacities and default provider semantics are unchanged. The isolated native macOS development normal/scalar controls passed both cases after original failures; Linux integrated, provider callback/tail, process-kill recovery and RF3 qualification remain open.
+
+
+### TASK-EVENT-VECTOR-CODEC-RESPONSIBILITY-033
+
+The bounded event-vector phase additions retain the original GrainRequestCodec API. Its exact native payload verification responsibility moves to feature-local `ClusterRouting/Serialization/GrainRequestPayloadVerification`; the façade borrows the same codec, engine and captured maximum token length. Evaluation remains token-length → native signature verification → original scope validation → configured MaxBatchBytes → native payload validation → DecodedGrainRequest. No new authority, configuration capture, allocation, alias, field ID, fallback or exception order is introduced. Existing signed-request negative/healthy operation tests remain the verification gate; source extraction and private compilation are not Linux/RF3 qualification.