Add bounded native read-cut leases and live index ownership preflight

Checkpoint all current source, tests, contracts and original qualification receipts. Full Release build, formatter and governance pass; 13 native read-cut Aspire development tests pass. NativeText WAL-length and fixture failures remain recorded and under repair; no full acceptance closure is claimed.

Author: KSemenenko

docs/ADR/ADR-077-offline-native-data-epoch.md

@@ -5,6 +5,16 @@ full acceptance instruction. Source and runtime qualification pending. Owner:
 KeyLoad integration lead. Related REQ-STORAGE-007/021..024, AC-STORAGE-007 and
 AC-EPOCH-001..006; EventStreams AC-EVENT-008/010, TimeSeries AC-SERIES-013/016.
 
+Private RF3 control preflight additionally consumes the existing Storage.IO
+regular-file primitive from AppHost under TASK-CRS-C1-APPHOST-REGULAR and
+AC-CRS-004 in NativeCqrsRequestV2. Root owns the internal AppHost friend and
+project-reference additions. Inspect/OpenWithIdentity binds bounded owner-file
+reads to a real regular native handle without following links or blocking on
+FIFO payloads. This adds only a trusted pre-start caller; the primitive's ABI,
+locking/error contract, database formats, stopped upgrade protocol and required
+Linux qualification remain unchanged. Rollback removes the private-control
+consumer after owned AppHost resources and readers have joined, never user data.
+
 ## Problem and supported formats
 
 The exact previous executable at

docs/Features/ClientApi.md

@@ -1,5 +1,15 @@
 # ClientApi
 
+TASK-MCP-RF3-CATALOG-INVENTORY preserves REQ/AC-CLIENT-006 and AC-MCP-001.
+Luna query_wave owns the private McpCallerProtocol tool-count inventory and
+discovery assertions only if the actual current canonical tool names are absent.
+Derive the exact count/names from the real server operation catalog, retain
+bounded paging, uniqueness, schema and annotation checks, and independently
+compare the complete declared catalog. Original run37242346547 observed62 tools
+against the obsolete56-count oracle. Do not infer a passing discovery result
+from editing that count. Existing ADR-039 remains sufficient; root reviews the
+exact diff and runs the official MCP client through the actual Aspire RF3 gate.
+
 REQ-SQLC-003 / AC-SQLC-003P preserves AC-MCP-002/003 in the Accepted
 [ADR-065 public/native oracle stage](../ADR/ADR-065-full-sql-client-compatibility.md).
 UnitTests ClientApi canonical command/read/polymorphic corpus and NEW

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -292,3 +292,36 @@ The32-arm limit includes every distinct observed, temporarily pending or retired
 Implementation order and ownership: cluster_wave Luna/high prepares only new Server/Features/ClusterRouting/RequestCqrsProbe* helpers as a private patch against the reviewed native phase interface; root owns NodeOptions, silo-only DI registration, AppHost validation/mount composition, fixture joins and combined gates. query_wave Luna/high prepares only new IntegrationTests/Features/ClusterRouting/RequestCqrsProbe* control helpers against these exact records; actual fault test entry points are a later bounded join after both helpers are reviewed. lifecycle_wave prepares the failed scalar18 original evidence bundle without source edits. Workers must not change shared files, public contracts, canonical data, credentials, thresholds, packages, tests of another scope, CI or Git state. Return base/post hashes and exact private patches; no shared build/test execution. Root reviews and integrates each bounded stage, runs the real Aspire caller and commits checkpoints with truthful pending RF3/Linux acceptance. Native migration control is excluded from this schema and retains its separately required native idle-migration join.
 
 TASK-CRS-C1-CONTROL-REBASE, accepted 2026-10-05, continues the same frozen control contract after the owner's feature-layout migration. Review the existing private Server, IntegrationTests and AppHost packets before preparing replacements; preserve their verified work rather than duplicating it. Cluster worker owns only Server probe helpers, lifecycle worker now owns only IntegrationTests probe control helpers, and query worker owns only AppHost probe helpers. Place pure models and contracts under the canonical slice Models/Contracts folders and executable responsibilities under their actual feature-local folders. Preserve every schema, quota, permission, native-phase, lifetime, retirement, image and provenance requirement above. The rebased packets remain private until root has reviewed their complete diffs and base/post inventory. Shared options, registration, hosting, fault-test entry points, gates and Git actions remain root-owned; the rebased helper source alone does not qualify a real RF3 fault.
+
+TASK-CRS-C1-CONTROL-UNIT maps the private-control portion of AC-CRS-004 to new
+RequestCqrsProbeCodecTests and RequestCqrsProbeRecordFileTests in the ClusterRouting
+unit slice. Exercise the actual source-generated private codec with all four
+valid kinds, write/read arm exclusivity and every selected phase/action; reject
+unknown/duplicate/case-changed fields, integer enums, null/missing values,
+invalid IDs/principal bounds, invalid UTF-8, truncated/trailing/nested data and
+record byte excess. Exactly8192 bytes of a valid record plus legal whitespace
+is accepted,8193 is rejected. File cases use actual owned0600 regular files and
+the existing native no-follow file API; linked/nonregular files are rejected
+without opening or blocking on their payload. Preserve original fixed safe
+errors and controlled private-canary absence from error text. No fake grain,
+silo, provider, caller authority, image or GitHub metadata is created. These
+mechanism controls prove private metadata/file bounds only; actual native
+phase, public privacy, producer settlement and RF3 scenarios remain mandatory.
+Cluster worker owns only the new unit Cases/Helpers/Models files as a private
+patch against the reviewed Server R4 helper packet. Root integrates dependencies,
+executes the actual Aspire caller, preserves originals and commits the stage.
+
+TASK-CRS-C1-APPHOST-REGULAR closes the private owner-file opening portion of
+AC-CRS-004 under ADR-077's existing regular-file contract. AppHost preflight
+must use the existing OfflineRegularFile.Inspect/OpenWithIdentity primitive for
+each owner.json, retaining the inspected native identity through bounded reading.
+Reject nonregular/link inputs before payload reading, enforce0600 and1..8192
+bytes, read exactly the inspected length and reject any trailing growth. Keep
+the fixed safe AppHost configuration error, strict owner schema, private root
+and image validations unchanged. No new OS binding, shared-mode workaround,
+public endpoint, canonical record or persisted format is introduced. Root owns
+the internal AppHost friend/project-reference join and all composition changes.
+Query worker revises only its six private AppHost helper files from the reviewed
+R2 packet, with original base/post hashes, without checkout writes or gates.
+Actual no-follow/FIFO mechanisms and complete Aspire/RF3/Linux gates remain
+required; static source repair does not qualify a started topology.

docs/Features/Messaging/DueCoordination.md

@@ -6,6 +6,32 @@ UTC due arithmetic, caller/creator checks, occurrence identities, queue limits
 and atomic transitions remain the authority. No separate durable due index or
 storage-format transition is introduced.
 
+TASK-DUE-RF3-AUTH-ORACLES preserves REQ/AC-DUE-002/003/004 and
+REQ/AC-JOBS-004/005 after original run37242346547 at5fa61f2. Luna lifecycle_wave
+owns a private overlay of DueFaultRf3SeedWriter, DueNoQuorumRf3Run,
+RecurringSagaRf3Support, RecurringSchedulePolicyRf3Tests and
+DueRecurringRf3Assertions, plus a feature-local pure creator model and identity
+writer if required. Root owns these docs, source joins and all gates.
+Configure the leader/cold-wave schedule and saga using a real persisted scoped
+principal/API key created by the private profile administrator. The administrator
+may configure resources and identity; it must not substitute for the retained
+schedule/saga creator or receive an authorization bypass. Bind the exact three
+queue scopes, required capabilities and actual payload/header policies and
+field grants; preserve every canonical identity, deadline, replay and cold/fault
+assertion. Keep credentials only in the private owned fixture, never a receipt.
+For the no-quorum case, keep the restricted creator for all database work and
+use the existing profile administrator only for the restored/survivor Status
+topology assertions. Preserve exact leader, voter, caught-up and single-effect
+checks. Protected schedule redaction paths are JSON pointers: the independent
+oracle is payload:/secret and headers:/secret, with unchanged projected bodies,
+ordered paths, cross-client parity and no-disclosure checks. No product change,
+new fault, clock, role supplied by a client, corpus/timing reduction or weakened
+assertion is authorized. Existing ADR-092/094 remain sufficient; no new wire,
+storage, trust boundary or topology is introduced. Implement setup authority,
+restricted-work/admin-status separation, then exact projection oracles; review
+all base/post hashes before root joins and runs serialized Aspire RF3. Source
+and compiler success alone do not close these criteria or the full118-case gate.
+
 TASK-DUE-RF3-C adds the genuine no-quorum public recurrence gate for AC-DUE-003.
 TASK-DUE-RF3-BUILD preserves AC-DUE-002/003/004 and ADR-094 while making the
 existing S1 and S2 Messaging RF3 fixtures compile under the unchanged repository

docs/Features/Messaging/RecurringSaga.md

@@ -5,6 +5,22 @@ Root accepts S1 on 2026-10-04 for KL-100 under
 durable schedules, stable occurrences, saga CAS and atomic timeout messages;
 general workflow replay or external exactly-once execution is not advertised.
 
+TASK-JOBS-RF3-PROJECTED-DELIVERY preserves REQ/AC-JOBS-003/004/005 and
+AC-DUE-003 after original run37242346547. Luna query_wave owns only private
+SagaTimeoutRf3Assertions and DueSagaRf3Assertions, plus only their two receive
+helper callsites in SagaTimeoutRf3Tests and SagaDueRf3Tests to pass the actual
+already-owned identity.Secret for the no-disclosure oracle. The existing creator has
+protected field use/write grants but lacks read permission; receiving a timeout
+must therefore return the independently expected empty payload/header objects,
+while retaining exact request/message identity, one delivery, lease metadata,
+ACK/replay parity and the empty subsequent receive. Add direct no-disclosure
+checks on the official MCP receive reply for the protected payload/header and
+credential; preserve all existing projected inspection and one-transition
+checks. Do not grant new read authority, weaken field policies, change product
+projection or omit the receipt/lease oracle. Existing ADR-092/094 suffice since
+this corrects the fixture's contradictory read expectation only. Root reviews,
+joins and runs the actual Aspire RF3 clients before recording runtime evidence.
+
 ## Frozen S1 contracts
 
 Generated native v1 records use sequential IDs from0 and feature-owned literal

docs/Features/Messaging/RemoteTransfers.md

@@ -1,5 +1,14 @@
 # RemoteTransfers within Messaging
 
+TASK-XFER-RF3-RECEIPT-VALUE preserves REQ/AC-XFER-002/003/005 after original
+run37242346547. Luna query_wave owns only the SDK/official MCP ACK comparison
+inside RemoteTransfersRf3Tests. Compare every field of both independently
+deserialized public receipts using the existing canonical public JSON serializer;
+ImmutableArray backing-array identity is not receipt-value equality. Preserve
+command IDs, mutation count/content, token, exact duplicate replay, target ACK
+and empty-receive checks. No production, public wire or native format change;
+existing ADRs suffice. Root owns integration and actual Aspire RF3 verification.
+
 Root accepts the KL-094 implementation contract on 2026-10-04.
 Decision: [ADR-088](../../ADR/ADR-088-remote-queue-transfers.md).
 Scope is durable queue-to-queue outputs within one tenant/database and the same

docs/Features/Search/GraphRetrieval.md

@@ -5,6 +5,29 @@ the same-partition exact branch of KL-056. [ADR-090](../../ADR/ADR-090-graph-sea
 implements architecture sections26.2–26.4. This contract retains the original
 SQL, distributed ranking, performance and RF3 qualification requirements.
 
+TASK-GSEARCH-RF3-RANK-FAILOVER preserves REQ/AC-GSEARCH-003/006 and ADR-090
+after original run37242346547. Luna cluster_wave owns only a private overlay of
+GraphSearchRf3Tests, SqlGraphSearchRf3Tests, GraphSearchRf3LeaderLossTests and
+a feature-local bounded survivor-status helper if needed. Preserve exact corpus,
+policy, projected results, expansion, public SDK/official MCP parity and faults.
+The independent graph branch sorts shortest hops then full EntityRef and feeds
+one-based ordinal ranks to weightedRrfV1. Equal-hop alpha and beta therefore
+contribute1/(60+1) and1/(60+2); adding one-hop delta precedes two-hop gamma,
+giving ranks3 and4. Do not use hop distance as the final fused ordinal rank.
+Derive the SQL fixture's complete expected order from its declared corpus, never
+from production ranking output. Before the single post-leader-loss mutation,
+use both real surviving administrator SDK Status calls under the existing finite
+eventual-observation contract to witness a successful current quorum, compatible
+RF3 routing and an agreeing non-null survivor leader. Keep the continuously
+running voter identities and existing scoped kill/restart/catch-up assertions.
+This witness is test ordering, not a product retry or an authorization repair:
+original report says OwnershipLost and does not establish its root cause.
+Issue one unchanged mutation/command only after the witness; never turn an
+uncertain outcome into a new-ID retry or swallow the actual write error.
+Root owns joins, verification and the exact original evidence. Existing ADR-090
+and cluster fault contract suffice; no new public/data/topology contract.
+Private review and compiler success cannot close the required real RF3 gate.
+
 ## Versioned public contract
 
 G1 adds an explicit `GraphSearchRequest` and `GraphSearchResult`; it does not

docs/Features/Search/OnlineGenerationLifetime.md

@@ -50,6 +50,36 @@ replacement task. Any observation deadline cancels that source, resumes its
 actual posting barrier and joins the original task before disposing the lease
 or projection; a second timeout-abandoned wait is not cleanup evidence.
 
+TASK-LEASE-LIVE-PREFLIGHT, accepted 2026-10-05, refines AC-LEASE-001/002/003
+after the actual unfiltered Aspire unit61b failure. Capacity preflight currently
+hash-opens the existing published WAL while its native index still owns that
+file; replacement therefore fails before reaching its posting barrier. Inside
+the existing physical gate, capture only the manager's at-most-three actual
+generation references. An exact manager-owned, published generation with a
+still-open native index receives a bounded live ownership/layout/size preflight
+without reopening native payload files. Verify its root, leaf, source-node and
+scope against the retained verified generation and owner/manifest metadata;
+reject unknown, linked, nonregular or foreign paths and retain all file, depth,
+generation and aggregate-byte ceilings. Runtime generation references cannot
+be supplied by a caller, inferred from a sharing exception, or substituted with
+an arbitrary trusted-leaf list. Every other generation keeps the complete
+existing checksum validation. Closed publication, reopen, retirement, deletion
+and restart retain full inventory checks; no format or provider sharing mode
+changes. Native mutation/census ownership remains in the physical gate, while
+manager admission is never held across callbacks or awaited work.
+
+Query worker owns only a private patch for the consumed NativeTextProjectionLifecycle,
+NativeTextFiles/NativeTextGenerationFiles capacity join and feature-local live
+preflight helpers, plus the real Search overlap regressions. Root reviews the
+exact live-object provenance and every cold validation call before applying it.
+Keep the existing corpora, deadlines, byte/file limits, native provider and
+old-reader/result assertions. Cleanup resumes the actual barrier even if old
+lease disposal fails, cancels and joins the original replacement task, then
+reports every distinct failure. Exercise real published-reader replacement,
+invalidation, unknown-path denial and closed/restart corruption controls through
+the actual Aspire caller. This source repair does not qualify L1, L2 or RF3;
+full suites and exact-source Linux evidence remain required.
+
 Frontend/new SDK/MCP syntax N/A: unchanged public search surfaces consume this
 manager. Migration N/A: no canonical record or persisted index format changes.
 Rollback stops the capable node and rebuilds disposable indexes; no canonical

docs/Features/StorageRecovery/NativeReadCuts.md

@@ -37,6 +37,15 @@ An elapsed-budget error reported after successful cleanup must not retain a
 closed handle. Scalar cut construction precedes native iterator creation, so a
 failed allocation cannot lose an iterator created just before attachment.
 
+TASK-CUT-ELAPSED-IDENTITY preserves AC-CUT-002/003 after the original Aspire
+read-cut69 run (12/13 passed). An elapsed limit is one lease-lifetime failure;
+observing that same expired limit during traversal and joined disposal must
+retain the same exception identity instead of manufacturing two independent
+failures. Independent native, callback and cleanup failures remain separate.
+Root owns the minimal Work helper repair and the unchanged idle-expiry test;
+the required oracle remains exactly BudgetExceeded, released admission and a
+healthy following real native lease. No timeout, bound or assertion is weakened.
+
 TASK-CUT-R2-FAILURE-JOIN refines AC-CUT-003 before joining the private L2-A
 packet. Luna query_wave owns only read-cut Lifecycle cleanup/disposal and new
 StorageRecovery test helpers/cases in its private overlay. A synchronous cleanup