Repair native recovery fixtures and retain bounded startup diagnostics

Preserve all current authorized source changes; qualification runs in GitHub Actions.

Author: KSemenenko

docs/Features/ClusterReplication.md

@@ -57,9 +57,10 @@ each source canonical/replica owner, journal and metadata holder keeps the actua
 combined wait pending until released. Existing source snapshot import and private
 transfer crash cases remain the primary regression and retain all assertions.
 
-The two permanent-holder elapsed checks retain their five-second lower and
-six-second upper observation bounds. Run only those individual wall-clock
-measurement cases with TUnit's keyless method-level `NotInParallel`, which the
+The two permanent-holder elapsed checks and StorageRecovery's two missing-required-
+file arguments retain their five-second lower and six-second upper observation
+bounds. Run only those individual wall-clock measurement cases with TUnit's
+keyless method-level `NotInParallel`, which the
 pinned1.72.10 package documents as exclusive execution. Exact Windows evidence
 shows the failed check overlapped74 distinct cases with16 active at peak; timer
 or continuation delay is a supported inference, without a threadpool trace.
@@ -69,6 +70,29 @@ This is intrinsic readiness timing qualification, not a loaded-system latency
 claim. Source review, native case discovery and full exact-SHA CI must verify
 that the same bounds and all original crash cases remain.
 
+TASK-RUNTIME-MAC-FIXTURE-W6 refines AC-REP-004 / AC-STORAGE-012 after
+exact323d60499 / CI37044499074. All11 new macOS readiness cases fail during
+construction at ReplicaSnapshotFiles.RejectLinks' reparse-point rejection,
+before snapshot-data or readiness predicates. The fixture allocates an unresolved
+system temp path; macOS temp aliases are the source-supported cause, while the
+native report does not expose that run's exact TMPDIR. Reuse CrashHost's existing
+ReplicaFixturePaths.NewDirectory for the fresh owned root, as other real replica
+fixtures already do. It resolves existing directory ancestors using native .NET
+ResolveLinkTarget before the private root is created; production RejectLinks
+remains unchanged and fail-closed. Preserve one root, shared incarnation, both
+target stores and required source stores, closure order, actual exclusive holders,
+waits/assertions and owned cleanup. No second resolver, guard bypass, dependency,
+public contract or persistence migration is introduced. The worker owns only
+ReplicaFileReadinessStores; root owns contract/diff/evidence integration. All11
+formerly red native cases plus original snapshot/tail/process recovery across
+three OSes are the regression matrix. AC-REC-FUP-001 requires the existing
+physical-temp helper and unchanged fail-closed guard; AC-REC-FUP-002 requires the
+same genuine source/target stores, incarnation, holders, assertions and cleanup.
+Either criterion fails on setup rejection, changed ownership or leaked work;
+all11 native cases and original snapshot/tail cases must pass. ADR035/036/033 cover this preserving private
+fixture reuse; rollback reverts only the allocator call. Environmental path or
+cleanup failures require source lifetime review rather than a synthetic injector.
+
 ## Actors, entry points and failure boundaries
 
 Actors are authenticated SDK/MCP callers, the node-local replica host, fixed voters, the membership provider and the recovery operator. Current source is composed by [ServerApplication](../../src/KeyLoad.Server/Features/ClientApi/ServerApplication.cs): it starts the node-local [PartitionHost](../../src/KeyLoad.Server/Features/StorageRecovery/PartitionHost.cs) and Orleans silo, whose [replica service](../../src/KeyLoad.Orleans/Features/ClusterReplication/PartitionReplicaGrainService.cs) routes peer operations. Aspire declares three Docker nodes with separate data mounts. This source is not yet qualified as a delivered RF3 deployment: current tests do not force request-activation migration and then verify storage ownership and a durable caller-visible outcome. Public HTTP/.NET transport belongs to ClientApi; required official MCP parity is pending. Frontend is N/A because replica consensus has no independent UI. Shared contracts stay in Abstractions and the exact ClusterReplication/StorageRecovery slice owners above.

docs/Features/StorageRecovery.md

@@ -23,6 +23,24 @@ either path, then restore the actual store files and prove subsequent reopen
 and commit. Missing required ownership/journal files must still fail, and the
 existing held-file/cancel/pre-cancel/permanent-lock tests remain intact.
 
+TASK-RUNTIME-WIN-ELAPSED-W6 refines AC-STORAGE-012 using exact323d60499 /
+CI37044499074. Both missing-required-file arguments catch the expected exact
+FileNotFoundException, then exceed the unchanged six-second observation cap.
+They overlap the concurrent native suite; the report does not identify the
+precise scheduler delay. Apply method-level keyless TUnit NotInParallel only to
+AcStorage012_MissingRequiredOwnershipFileStillFails, preserving both arguments,
+five-second lower/six-second upper assertions,25ms polling and no-file-creation
+checks. Existing permanent-holder timing isolation and every other case remain.
+No helper, timeout, retry or product change is authorized. Root owns accepted
+criteria/evidence; the disjoint worker owns only KilledProcessFileReadinessTests.
+Both formerly red native cases and full three-OS recovery must pass at the
+delivered SHA; source isolation is not proof against external VM preemption.
+AC-REC-FUP-003 maps to these two argument cases and requires their unchanged
+exact exception/no-create/5s lower/6s upper assertions. A timing failure, broader
+serialization or weakened assertion fails this criterion.
+ADR035/036/033 lifetime/test contracts suffice; rollback removes only this
+attribute, retaining all failure evidence.
+
 The common synchronous probe is internal test infrastructure shared with
 ClusterReplication's existing store barrier. That caller retains one
 five-second deadline across target stores and, only at typed snapshot/transfer

docs/Features/TestInfrastructure.md

@@ -162,6 +162,63 @@ not claim its unexecuted failure path qualified. ADR-035/036/039 existing
 privacy/lifetime contracts suffice; no product/public/dependency boundary changes.
 Rollback reverts only this additive diagnostic join and its helpers/tests.
 
+## Accepted comparison-host startup diagnostics
+
+AC-REC-FUP-004 records the preserving W6 fixture follow-up: the exact delivered
+SHA, complete GitHub job/report artifacts, native failure identities and report
+hashes remain in the runtime ledger. Unit/Recovery/RF3/Comparison must all execute;
+failed or unexecuted cases cannot count as green. Local development build,
+formatter and governance are source validation only. Full native artifact review
+and source lifetime/predicate audit cover environmental branches which cannot be
+injected without prohibited service doubles. StorageRecovery owns AC-REC-FUP-003;
+ClusterReplication owns AC-REC-FUP-001/002. Existing ADR035/036/033 apply.
+
+REQ-TEST-009 / AC-TEST-009 (TASK-RUNTIME-HOST-DIAGNOSTICS-W5) refines the
+private real-process AC-HOST-003/007 fixture after exact8b475d4 /
+CI37042082081 repeats four Windows20-second failures. One existing deadline
+covers both native exit and redirected-output drain; current failure evidence
+does not distinguish them. Source configuration order is not a diagnosis.
+
+Before the existing timeout cleanup, retain only a closed ProcessExit/OutputDrain
+stage, actual available exit state/code, closed capture-task states, capped
+capture lengths and boolean matches for existing static validation markers.
+The receipt is at most8KiB and keeps the original TimeoutException message
+prefix. No raw child output, exception text, arguments, environment, paths,
+endpoints, credentials or unknown values are logged. Diagnostic observation
+failure becomes a fixed unavailable marker and cannot replace the original
+startup timeout or caller cancellation.
+
+Each actual StreamReader still uses4096-character reads, retains32768 characters
+maximum and drains the remainder. Synchronize partial-buffer observation; retain
+the same20-second shared startup deadline and five-second cleanup behavior.
+Do not add retries, serialization, sleeps, client/config reorder, product changes
+or new detached work. Preserve all four configuration/ordering assertions and
+the real cleanup test. Environmental failure/cancellation additionally needs
+source lifetime review and the actual GitHub failure receipt; a successful run
+does not qualify its unexecuted failure branch.
+
+```mermaid
+flowchart LR
+    Host[Actual CLI child] --> Exit[Native exit wait]
+    Host --> Capture[Bounded readers drain to EOF]
+    Exit --> Drain[Capture completion wait]
+    Exit --> Failure[Existing startup timeout]
+    Drain --> Failure
+    Failure --> Receipt[Closed stage and pre-cleanup facts]
+    Receipt --> Cleanup[Existing owned cleanup]
+```
+
+Slice ownership: one worker owns only UnitTests/Features/BenchmarkComparisons/
+ComparisonHostProcess.cs and new cohesive capture/diagnostic/test helpers;
+root owns shared documentation and integration. New genuine native-shaped
+projection/privacy and real-stream prefix/EOF cases map AC-TEST-009.1–003;
+the existing real host cases map009.4. Exact delivered-SHA full GitHub
+unit/recovery/RF3/comparison plus native receipt review map009.5. All tests
+remain TUnit/MTP and CI-only. Existing ADR035/043 private fixture ownership,
+privacy and lifetime contracts suffice; no public/data/dependency/deployment
+migration is authorized. Rollback reverts only this additive private diagnostic
+packet and its source docs; coverage and full goal remain unqualified.
+
 ## Platform, dependency та release qualification
 
 B3 keeps the exact task lifetime above while satisfying enabled CA1031: a private

docs/implementation/runtime-qualification-20261002.md

@@ -1,6 +1,18 @@
 # Runtime qualification, 2026-10-02
 
-## Main runtime baseline: 8b475d4
+## Main runtime baseline: 323d60499
+
+[Run37044499074](https://github.com/managedcode/KeyLoad/actions/runs/37044499074) retains all12 source-checked native reports. Full build, formatter, governance and118 analyzer cases pass on all three OSes; units are **805/805 on each OS**. **Native Docker/Aspire RF3 passes41/41**, including real .NET/MCP clients, Chrome and five new safe-diagnostic regressions. Recovery is **136/136 Linux**,125/136 macOS and134/136 Windows. [Exact native hashes, failures, previous-case transitions, job URLs and artifact metadata](runtime-qualification-37044499074.json) retain the complete scope.
+
+Prior checkpoint stages7/8 and Windows target-WAL reopening now pass. All11 new macOS replica-readiness cases fail during fixture construction at ReplicaSnapshotFiles.RejectLinks; two Windows missing-required-file cases exceed the preserved6s observation cap. These remain real failed gates, with fixture path and scheduling review required before a preserving repair. The four prior Windows startup timeouts pass without a demonstrated source-cause repair; the additive startup diagnostic still requires its own delivered-SHA CI.
+
+Both comparison completion predicates still fail with the runner in Waiting; retained smoke/TimeSeries reports are unqualified and measured profiles skipped. Native RF3 success leaves the environmental restart failure branch unexecuted. Numeric coverage, actual activation movement, server-resource costs, endurance and power-loss gates remain open. No local runtime qualification ran.
+
+## W5/W6 source follow-up
+
+[Source join](runtime-source-w5-w6.json) retains all six source hashes, accepted feature/task ownership, native red baseline and authored source chronology. It reuses the existing physical-temp resolver for the macOS readiness fixture, isolates only two Windows intrinsic missing-file timing cases, and adds closed bounded startup exit/drain diagnostics. All25 projects pass an enabled Release development build with0warnings/0errors; canonical formatter and static governance pass. No local runtime tests ran. Four new startup projection/real-stream methods and preserved recovery cases require the next delivered-SHA GitHub run; the full goal remains in progress.
+
+## Previous main runtime baseline: 8b475d4
 
 [Run37042082081](https://github.com/managedcode/KeyLoad/actions/runs/37042082081) retains all12 source-checked native reports. Full build, formatter, governance and118 analyzer cases pass on each OS. Units are805/805 on Linux/macOS and801/805 on Windows: four real comparison-host startup cases reach their unchanged20-second deadline. Recovery remains119/121 Linux/macOS and118/121 Windows. **Native Docker/Aspire RF3 passes36/36**, including real .NET/MCP SDK calls and Chrome administration. Comparison remains2/4 with measured profiles skipped. [Exact reports, failure identities, job URLs and artifact hashes](runtime-qualification-37042082081.json) are retained.