Preserve document content and integrate scoped partition runtime gates

Author: KSemenenko

.github/workflows/AGENTS.md

@@ -65,7 +65,7 @@
 - CI website generation MUST NOT wait for unrelated ordinary CI/RF3 execution from another run. Push/manual CI runs use their own run identity; PR keeps its existing ref-based cancellation. Website qualification and deployment use separate bounded job concurrency groups with cancel-in-progress=false, preserving source/latest-evidence freshness and all gates. This implements the owner-authorized independent website action without canceling database or test work.
 
 ## Separate database matrices, 2026-10-04
-- Owner correction requires one named job matrix per database in Benchmarks. Each target has its own three checks and thirty canonical node/scenario workloads with readable database/node/scenario names. All nine groups depend only on actual plan/image inputs and run independently without a max-parallel cap; steps within each isolated cell remain sequential. Aggregate joins every group and preserves authenticated failed/null results. This supersedes the shared preflight/CRUD/specialized grouping above without changing native topology, cell isolation, required suites or immutable evidence.
+- Owner correction requires one named job matrix per database in Benchmarks. Each target has its own three checks and thirty canonical control node/scenario workloads, plus the ADR-103 thirty-six exact profile-qualified scale cells, with readable database/node/scenario/profile names. Preserve all original control identities and authenticated failed/null publication semantics; scale qualification remains a separate complete-profile admission. All nine groups depend only on actual plan/image inputs and run independently without a max-parallel cap; steps within each isolated cell remain sequential. Aggregate joins every group and preserves authenticated failed/null results. This supersedes the shared preflight/CRUD/specialized grouping above without changing native topology, cell isolation, required suites or immutable evidence.
 
 ## Feature-local executable artifacts
 - This module uses the root-approved fully colocated executable-artifact convention: keep each feature-owned script, website module or workflow with its canonical feature/artifact and its existing entry point. C# Grains/Models folders are N/A here because this module contains executable web, shell or YAML artifacts. Preserve source-bound historical receipts; update live consumers when solution source paths move.

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       matrix:
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
+    timeout-minutes: 120
     steps:
       - name: Download source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

README.md

@@ -332,6 +332,14 @@ Discovery exposes static operation documentation. Each invocation checks current
 
 > **KeyLoad is a development preview.** Try it, build with it and [tell us what breaks](https://github.com/managedcode/KeyLoad/issues), but don't trust it with production data yet.
 
+The original 104-task plan has **0 fully accepted, 103 in progress and 1 pending**.
+The latest local checkpoint passes the Release build, formatter and governance
+checks; its full unit suite passes **3,490 of 3,492 tests**, with two failures
+and no skips. The [original Linux source788 run](docs/implementation/runtime-qualification-37349838022.json)
+passes the official MCP SDK guidance case but fails the complete RF3 and release
+gates. [Checkpoint evidence](docs/implementation/partition-runtime-development-2026-10-05.json)
+keeps those failures and the remaining scalar, recovery, RF3 and scale gates explicit.
+
 | Ready to try (in source, covered by tests) | Still in progress |
 |---|---|
 | Documents, typed rows, graphs, queues, events, time series, blobs and search behind one permission model | Full SQL (joins, foreign keys) and a native SQL client protocol |

benchmarks/KeyLoad.BenchmarkScenarios/Features/BenchmarkComparisons/Benchmarks/EmbeddedBenchmarks.cs

@@ -129,6 +129,12 @@ internal void Initialize(PartitionRef partition)
                 [new(Wildcard, Wildcard, Capability.All)], [Wildcard])
             { ClusterAdministrator = true },
                 DatabaseEngine.Credential(PrincipalId, PrincipalId, BenchmarkCredential));
+            var shardId = store.Identity.NodeId;
+            var catalog = new BootstrapPhysicalShardCatalogRequest(1, 0, shardId, store.Identity.Incarnation,
+                [shardId.ToString(GuidFormat)]);
+            Database.Apply(Database.CreateNativeOperation(OperationKind.BootstrapPhysicalShardCatalog,
+                PhysicalShardCatalogIdentity.CreateBootstrapCommandId(shardId), PrincipalId,
+                TimeProvider.System.GetUtcNow(), NativeSerialization.Serialize(catalog))).Get<bool>();
             Submit(OperationKind.ConfigureResource,
                 new ConfigureResourceRequest(TenantId, DatabaseId,
                     new(CollectionId, ResourceKind.Collection, CollectionId)));

docs/ADR/ADR-017-migration-tokens.md

@@ -83,3 +83,24 @@ Removal or rollback of the test must retain qualification artifacts; product
 outcomes/locators retain the compatible forward-reader rollout contract above.
 The ADR remains accepted with implementation and all required gates open until
 the genuine prior-frame case and complete related source qualification pass.
+
+## Accepted transaction-local witness reuse, 2026-10-05
+
+REQ/AC-MTOKEN-007 fixes the source-review gap where Batch authorization still
+compared a literal epoch while receipt and per-effect outbox token creation
+repeated placement reads. Root first freezes the feature contract, then joins
+CommandAuthorization, AtomicCommandCommit, OperationDispatcher and
+AtomicMutationApplication in the existing apply path. Authorization returns only
+its validated same-transaction Batch witness; receipt and all outbox effects
+reuse one typed token. Other mutation groups resolve one token per group. No
+request/transaction cache or public/native format change is introduced.
+
+The genuine document paired-size read counters account for exactly three new
+placement point reads, with unchanged single before-image decode and no final
+staged image read. Native epoch, same-ID replay, domain-failure, composition,
+messaging, recovery and RF3 tests remain required through Aspire. Root retains
+original failures, source-bound receipts and actual gate outcomes before stage
+delivery. Rollback joins authorization/issuance/outbox callers coherently and
+cannot restore an invented epoch or discard scoped outcomes; recover forward if
+acknowledged metadata already exists. No movement-created epoch or acceleration
+claim follows from source/counter changes alone.

docs/ADR/ADR-019-managed-ann.md

@@ -184,3 +184,21 @@ The source owner is restricted to `PackedAnnCandidateHeaps.cs` and
 patches, review, normal/scalar unchanged-corpus observations, strict gates and
 qualification. This is an unmeasured repeated-check optimization candidate,
 not a deadline diagnosis or speed claim. Rollback restores the five checks.
+
+## Accepted reciprocal insertion invariant, 2026-10-05
+
+REQ/AC-ANN-018 and TASK-ANN-RECIPROCAL-INSERTION in ManagedAnn freeze a narrow
+source-proven correction. Ascending private construction inserts a source once
+per layer; distinct prior reciprocal targets cannot already contain that new
+source at that layer. Remove only the target membership scan and unused helper,
+preserving the graph, candidate deduplication, scores, actual distance/edge work,
+cancellation, original deadlines and admission. Work counters must report the
+comparisons actually performed, without fabricated replacement charges.
+
+The Luna owner supplies the guarded source packet and independent native
+adjacency regressions. Root compares complete successful controls, retains
+original incomplete Linux normal/scalar observations, and owns the join and
+all strict/Aspire gates. A partial failed build cannot prove graph equivalence
+or speed. Migration is N/A: R1 remains an internal immutable candidate with no
+serialized/public contract; R2/R3 require separate accepted contracts. Rollback
+restores only the removed scan and helper.

docs/ADR/ADR-039-official-mcp-agent-api.md

@@ -91,7 +91,7 @@ then the existing capability/partition grain with a reloaded persisted principal
 ## Frozen catalog and wire contract
 
 ADR-098 adds its direct and SQL graph-path tools as additive version-one reads;
-AC-MCP-001 independently verifies the complete 66-name catalog, typed schemas
+AC-MCP-001 independently verifies the current complete 68-name catalog, typed schemas
 and effect hints. The two PMAP tools use strict generated request/result schemas:
 bind is `{ commandId, request }` with version, expectedRevision, complete
 partition and physicalShardId, while read is `{ request }` and returns the full

docs/ADR/ADR-047-embedded-benchmark-host.md

@@ -1,5 +1,15 @@
 # ADR-047: public embedded benchmark scenarios and typed executable
 
+The 2026-10-05 native placement prerequisite preserves REQ-BC-022 / AC-EM-002/003's
+real embedded microbenchmark contract: its setup must bootstrap a native physical
+catalog using that actual local store's NodeId/Incarnation and one explicit local
+voter before the existing ConfigureResource/Batch seed. Use the existing Core
+native operation factory and persisted bootstrap command, outside measured
+methods, with the same TimeProvider.System clock and owned cleanup. Root owns
+the BenchmarkScenarios setup join and real fixture/generated-consumer regressions
+through Aspire. This is the existing embedded control, not RF3 or comparison
+topology qualification; its three measured methods and inputs remain unchanged.
+
 Status: Accepted; implementation and qualification pending.
 Related: REQ-BC-022, AC-EM-001..004, AC-CQ-007/008, ADR032/033/035.
 

docs/ADR/ADR-060-native-internal-serialization.md

@@ -2,6 +2,17 @@
 
 Status: Accepted. Date:2026-10-03. Owner: serialization integration lead.
 
+Accepted2026-10-05 TASK-DSTORE-EXACT-TEXT repairs the existing exact caller-owned
+document-string requirement under REQ/AC-DSTORE-008. Root separates validation
+from PutDocument text rewriting: the same native canonical writer validates into
+a discard sink and the record retains the original validated string. Public
+JsonData.Validate output, canonical fingerprint digests, record aliases/field IDs,
+and native data epochs remain unchanged. No automatic existing-record rewrite;
+patch/redaction retain their derived-text contracts. Run real-store exact-text,
+replacement/replay and invalid atomicity regressions, unchanged canonical golden
+tests, and actual Aspire RF3 SDK/official MCP Unicode/restart cases before
+qualification. This is a repair of the frozen contract, not a new data format.
+
 ## Decision and contracts
 
 Implement REQ-IS-001..009 / AC-IS-001..009 using Orleans10.3.1 generated codecs, stable aliases and explicit immutable field IDs across all owned internal concrete DTOs. Use pooled native sessions and raw ReadOnlyMemory<byte> codecs; reject incomplete/trailing/malformed input and validate required semantic fields before effects. Do not use Orleans' optional JSON codec or a runtime JSON fallback. JSON DOM adapters represent structural ordered fields and original numeric lexemes; native DOM materialization is a concrete boundary, not a persisted JSON subtree.
@@ -506,3 +517,10 @@ recovery228/228 passes with unchanged complete source/runtime inventories.
 No tolerance, product cache, runtime switch or allocation bound was changed.
 This is local development evidence; exact delivered-source Linux and RF3
 qualification and comparative performance remain required.
+
+TASK-DSTORE-EXACT-TEXT retains the original literal JSON in the existing native
+operation-ownership, restored-record, canonical-retry and embedded-fixture
+oracles. Only their obsolete normalized-document expectation changes; all
+native authority, corruption, revision, canonical digest and no-second-effect
+checks remain. This is the REQ/AC-DSTORE-008 contract already frozen above,
+not a change to canonical fingerprint bytes or stored aliases/field IDs.

docs/ADR/ADR-068-native-benchmark-gate-repair.md

@@ -80,7 +80,8 @@ matches provider/upload proof. Accepting queued as running is forbidden.
 Keep bounded attempt-page discovery and all existing source/job/attempt/main/
 workflow and existing canonical-or-legacy URL checks. Corroborate only the discovered ID through the
 authenticated exact jobs/{id} endpoint. A still-queued same-identity/null-result
-record permits at most3 captures separated by1000ms. Any mismatch, terminal/
+record originally permitted at most3 captures separated by1000ms; the accepted
+G2 cache-window contract below replaces that insufficient refresh bound. Any mismatch, terminal/
 unknown state or network/parse failure rejects immediately; final queued state
 rejects. Only exact in_progress/null-result authority permits native allocation.
 No reselection, workload retry, invented runtime evidence or queued success.
@@ -142,7 +143,8 @@ data migration. This ADR remains Accepted.
    isolated-current-job.mjs and the necessary existing isolated-github-api.mjs /
    isolated-github-job.mjs joins. Use existing captureApi/requestNative byte,
    network, rate and original-child lifetime bounds. NEW private constants fix
-   captures3/delay1000; no shared GH/transport/workflow changes. Preserve original
+   captures3/delay1000 was the original G1 contract; G2 below owns the narrow
+   current-job transport extension. No unrelated GH/workflow changes. Preserve original
    pages and every exact request/response under current-job-refresh-NN files;
    final job.json and environment ID appear only after strict fresh validation.
    Existing validateJobIdentity remains authoritative, including optional attempt
@@ -174,14 +176,78 @@ Kurrent rollout/rollback must be frozen before that stage's implementation.
 
 Source review covers actual transport joining and absence of doubles. First-author
 pure policy tests cover stale/valid/wrong-ID/source/attempt/terminal/error records;
-Actual source review verifies the fixed three captures, two bounded waits, immediate
+Actual source review verifies the accepted G2 capture/deadline bounds, immediate
 transport failure and absence of writes before final validation. Pure classifier
 tests do not execute refresh exhaustion or authenticate HTTP. Actual GitHub
 current-job startup must cover authenticated transport/exhaustion and original
 same-ID running proof. Neither source/static checks nor supplied JSON authenticate
 the provider. Every worker escalates contract/scope/lifecycle drift. This ADR stays
 Accepted until all required implementation and genuine verification exist.
 
+## Accepted G2: native current-job cache revalidation
+
+REQ-NGR-001 / AC-NGR-001 / TASK-NGR-G2 addresses the retained genuine Benchmarks
+run37320853130 attempt1 failure before workload setup. Two executing cells received
+three exact queued responses with the same ETag and advertised
+`Cache-Control: private, max-age=60, s-maxage=60`. These originals support a stale
+provider-cache hypothesis; they do not authenticate running state or permit a
+failed/null workload substitute. The site correctly rejected the incomplete
+producer. Preserve that historical failure and every original capture.
+
+Before code, freeze this ordered contract: first author captured-record/header
+policy and actual-caller regressions; then extend only the existing current-job
+helper, API/transport joins and native HTTP stream cancellation seam. Send
+`Cache-Control: no-cache, max-age=0` only to the authenticated same discovered
+`jobs/{id}` route. General metadata/download requests keep their existing header
+and rate behavior. Do not add a query cache-buster, choose another job/run/route,
+accept queued, drop a required cell or fall back to an older producer.
+
+The initial current-job request retains the existing120,000ms metadata deadline.
+After the first exact queued/null-result response, one monotonic60,000ms window
+owns all further1,000ms cadence waits, native requests and permitted rate waits;
+at most61 captures include the initial request. Each next native timeout is the
+minimum of the existing bound and the positive remaining window. Do not start a
+request/wait after exhaustion. Rate delays must fit both the existing accumulated
+rate budget and the remaining window; otherwise reject. Network, parse, auth,
+identity, terminal and unknown-state failures reject immediately at their existing
+boundary. Only the unchanged exact in_progress/null-result proof authorizes
+job.json/environment-ID finalization and database/timing allocation.
+
+The current-job scope owns one cancellation signal, observes SIGTERM/SIGINT
+during polling as well as HTTP, cancels the same original native child, and joins
+its exit/readers before releasing files or returning. Preserve the existing
+one-second TERM-to-KILL grace and original byte/file/privacy bounds. Abort is not
+a successful capture or a replacement request. Timers/listeners are disposed and
+original failures remain observable. The60s window bounds admitted work; actual
+owned-child termination/join is retained after deadline, never WaitAsync-style
+abandonment or timeout-as-settlement. No credential/raw response diagnostic text.
+
+Ownership: root freezes these docs, reviews/joins source, owns Aspire gates,
+receipts, commits/pushes and exact-source GitHub evidence. One gpt-6-luna/high
+worker owns scripts/Features/BenchmarkComparisons/isolated-current-job.mjs,
+isolated-github-api.mjs, isolated-github-transport.mjs and only the necessary
+optional-signal join in isolated-github-stream.mjs, plus focused UnitTests
+Features/BenchmarkComparisons IsolatedCurrentJob-prefixed cases/helpers. Keep
+default callers byte/behavior compatible, fixed closed headers, original
+authenticated transport and canonical-or-legacy URL/source/attempt/name checks.
+Any required additional boundary is returned for freeze before implementation.
+
+Tests retain captured identical-ETag queued/header sequences and the separate
+authentic running record unchanged. No retained artifact currently shows that
+same-ID transition. An explicitly constructed pure policy transition fixture
+may test queued-to-running control flow, but is not provider/runtime evidence.
+Actual same-ID queued-to-running proof remains pending real GitHub startup.
+Tests map persistent queued to exact cutoff;
+wrong ID/name/SHA/run/attempt/workflow/URL,
+terminal/auth/parse states to rejection; cancellation while waiting and in the
+real native child to joined cleanup; rate delays to both budgets; and the actual
+captureCurrentJob caller to finalization only after strict running proof. Pure
+records do not authenticate GitHub or qualify workload success. Local tests run
+through the Aspire-owned entry under the root's later local-development
+authorization; actual Linux GitHub startup must retain fresh source/job/provider
+originals before G2 is qualified. Roll back the helper/optional transport joins and
+tests together; no public schema, data, engine, image or website policy migration.
+
 ## Accepted Kurrent metadata stage A
 
 The exact pinned1.4.0 DLL (SHA2560f19cb40551bd5b7548ea1ef3afb2e4326d9b2dc05ac4b0eef7baf3ffde816c2)