Repair native acceptance admission and retired-owner routing

Author: KSemenenko

.github/workflows/build-and-tests.yml

@@ -9,7 +9,7 @@ on:
         description: 'Acceptance task; all runs complete qualification and all task lanes'
         type: choice
         default: all
-        options: [all, KL-011, KL-014, KL-015]
+        options: [all, KL-011, KL-014, KL-015, KL-021]
 permissions:
   contents: read
 concurrency:
@@ -225,7 +225,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        task: ${{ fromJSON(inputs.task == 'KL-011' && '["KL-011"]' || inputs.task == 'KL-014' && '["KL-014"]' || inputs.task == 'KL-015' && '["KL-015"]' || '["KL-011","KL-014","KL-015"]') }}
+        task: ${{ fromJSON(inputs.task == 'KL-011' && '["KL-011"]' || inputs.task == 'KL-014' && '["KL-014"]' || inputs.task == 'KL-015' && '["KL-015"]' || inputs.task == 'KL-021' && '["KL-021"]' || '["KL-011","KL-014","KL-015","KL-021"]') }}
         profile: [normal, scalar]
     steps:
       - name: Download source code

README.md

@@ -363,7 +363,8 @@ qualification remains open.
 
 Native TUnit now defaults to 20 parallel tests. GitHub also runs separate
 normal/scalar-caller acceptance lanes for strict indexes, the server/SDK and
-security/telemetry. Focused task runs retain their complete declared operation
+security/telemetry, plus strong/session and follower document reads. These four
+tasks run in eight isolated Linux jobs. Focused task runs retain their complete declared operation
 scope; full build, unit, recovery, RF3 and coverage gates remain mandatory.
 
 Complete product functional coverage remains **unmeasured**. The

docs/ADR/ADR-082-native-cqrs-streams.md

@@ -368,3 +368,12 @@ Ownership: IntegrationTests ClusterRouting Helpers native startup admission owne
 
 
 Native admission ownership clarification: the existing lifecycle schema stays unchanged. `BindObserver` retains only the last bound original node observer; scalar `a`/observer-cancellation fields describe that observer alone and never certify all three resource admissions. The independent native owner's `AdmittedNodeCount == 3` assertion requires all three original callback tasks to complete successfully and their actual observers to join; `NativeAdmissionOwnersJoined` verifies owner cleanup separately. Preserve this distinction in any original failure interpretation. The quality repair uses one shared original subscriber admission loop for canonical control and exact-resource modes, retaining the same single-reader guard, original pending task, transitions, cancellation and joined disposal. Direct caught lifetime disposal retains every primary/disposal failure and closed lifecycle notification; no analyzer suppression or deadline change is allowed.
+
+
+### TASK-CRS-C1-OFFLINE-FAILURE-EVIDENCE-001 (frozen before private code)
+
+REQ/AC-CRS-004/005 and REQ/AC-CRS-DIAG-004 retain the actual current-format three-voter offline no-outcome inspection after owned RF3 shutdown. Original fe8e813c50ca93d4ed53e9e4eb32ceda03cc403d/run37855042382/attempt1 KL015 normal has32/32 passed original cases; scalar has30/32, with both held-revocation cases failing only when the genuine offline inspector returns exit2 at AuthorityOutcomeInspect. Original native admissions/captures completed and held/revocation observations are present. Original exit2 suppresses every nonfatal child cause; neither a storage defect, lock holder nor SIMD incompatibility is established. Both task jobs also retain original tooling failures and remain unqualified.
+
+Freeze a private failure-only stderr record at most256 UTF8 bytes, one record per original child, with exact prefix/version, actual phase enum ReadInput/ValidateRequest/OpenStore/ReadOutcome/DisposeStore/WriteReceipt, closed error-kind enum and optional existing KeyLoad ErrorCode or directly nested allowlisted native code1,2,5,9,11,13,16,20,22,24,28,35,40. No exception text/type name, path, identity, credentials, payload or arbitrary field. First initiating failure is frozen before store disposal; later cleanup cannot overwrite it. Original fatal exception priority and initiating plus output/disposal failure retention remain. Native V2 input/success receipt, failure exit2, stdin/receipt/capture bounds, deadlines, original task/lock joins and empty success stderr stay unchanged. Failure output never constitutes a success receipt.
+
+The Integration oracle validates the exact closed record before including that static diagnostic in its failure; it continues to require exit0, exact canonical no-effect/majority outcomes and complete native child settlement. Existing real wrong-node/incarnation, malformed input and corrupt scoped-outcome/locator child flows assert the actual closed failure shape and phase, retain all joins/unchanged bytes, then perform their real healthy child/store continuation. This is mechanism evidence only; current scalar RF3 must rerun to expose its actual cause before any behavioral repair. Root owns review/join/build/native/Linux delivery. Rollback removes only these private observations and their regression amendments; product protocol, persistence, authorization and timebounds are unchanged.

docs/ADR/ADR-106-partition-owner-movement.md

@@ -769,3 +769,19 @@ REQ-MOVE-NATURAL-ISSUED-EXPIRY-003: Only then first-issue the previously unissue
 AC-MOVE-NATURAL-ISSUED-EXPIRY-001 maps `ActualIssuedRetireGrantExpiresWithoutMutationThenFreshAckAndFamiliesCompleteBothColdOwners`, the actual native whole terminal fixture, centrally validated lifetime boundaries, exact old grant/outcome/no-effect oracle and complete healthy continuation. Original negative and cleanup failures remain visible. Actual Linux normal/scalar evidence mandatory; Darwin loopback setup failure is not operation evidence. Public parent/RF3 and natural process expiry qualification remain distinct open whole-task gates. This source packet is unbuilt/unexecuted until the root's explicit coherent image verification.
 
 Implementation contract: the movement agent authors the disjoint terminal fixture/options/assertion packet; root checks every source guard and joins docs before its owning Cases/Helpers files and `Features/ResourceExecution/Configuration/NativeMovementProcessOptions.cs`. Root builds/formats the coherent image, binds the new case to the actual native census, commits/pushes the whole stage and authenticates Linux normal/scalar original whole-flow outcomes. No new production execution path or persistence format is involved. Rollout is the normal test source cohort; rollback removes the dedicated natural-expiry case, its optional fixture branch/helpers and options together, preserving the existing expired-envelope negative and full terminal/recovery/RF3 requirements.
+
+
+## TASK-KL036-RETIRED-CONTROLLED-BRIDGE-001
+
+REQ-MOVE-RETIRED-BRIDGE-001: after actual retirement, a fresh authenticated persisted control operator and original caller policies admit only the existing protected-document command/read bridge. Resolve the canonical published destination through the actual native RequireMoveDirectory.ControlOwner and ResolveRegisteredPlacement. The ordinary source-only ReadPlacementWitness remains unchanged and denies model execution on retired source. Keep retired phase/full expected-control equality, original operator, actual local control owner/incarnation, complete source/destination identity, exact published placement epoch/revision and resource/mutation/field policies. No source model write, copied outcome authority, receipt inference, ownership bypass or new/unknown effect admission is authorized by this correction.
+The canonical control owner remains distinct from the source placement of later moves. RequireMoveDirectory proves local control ownership; complete expected-control equality retains the original source placement; registered placement resolution and exact destination incarnation/epoch/revision prove the current published destination. Do not require a later source placement to equal the fixed control owner. Capture, grant observation, admission and acknowledgement share this same guard.
+REQ-MOVE-RETIRED-BRIDGE-002: first-issued natural-expiry qualification must observe the original native owner's actual EvaluationClock UTC reaching the exact issued absolute expiry; timer completion alone is insufficient. Recompute the remaining duration after each actual clock observation, round delay representation upward to milliseconds, and await only under the original whole-flow90s cancellation/deadline. Do not alter original phase/body/grant/nonce/expiry, introduce a new deadline, advance the clock, or weaken expired-original no-effect assertions. Fresh distinct cleanup-family first issuance and complete both cold owners remain mandatory.
+
+AC-MOVE-RETIRED-BRIDGE-001: actual protected replacement after full publication/retirement reaches genuine source Admit→destination effect→source ACK/final result, replays exact original control-owned receipt, and performs both cold-owner literal read with unchanged replay images/cuts/outcomes. Reuse ActualRetiredOwnersApplyAndRetainTheOriginalDocumentReceiptAcrossColdReopen and all ten genuine Install/Retire five-cut process continuations.
+AC-MOVE-RETIRED-BRIDGE-002: unknown/revoked/wrong subject, current denied mutation/read policy, foreign original source token, changed published placement/control/destination and corrupt metadata fail closed before effects; complete source/destination images/store positions/journal commit/apply/outcome bytes remain unchanged. Restored original policy retains original USER epoch denial; new native command ID/healthy actual protected read/command completes both cold owners. Reuse ActualRetiredOwnersDenyUnknownSourceThenReadLiteralTargetWithoutChangingEitherStore and ActualRetirementColdOwnerRevocationAndRestorationKeepOriginalEpochBoundOutcome, with new narrow placement/policy negatives as needed. The denied-subject original replay uses its actual first-issued batch ownership epoch, not a new source-only placement read.
+AC-MOVE-RETIRED-BRIDGE-003: actual issued first Retire grant applied but unsettled reaches its genuine expiry under unchanged whole90s. Exact unchanged original dispatch is denied, every image/position/commit/apply/own result/retained grant stays unchanged, and actual distinct ACK/families/terminal/receipt and both cold owners complete. Required natural expiry case must pass both current Linux normal and scalar; the original normal pass/scalar failure is retained, not relabeled success.
+
+Implementation order: docs/ADR first; exact owning bridge placement selection and guard preservation; actual first-epoch denied-subject fixture and owner-clock condition loop; genuine policy/placement negatives plus existing full cold/process healthy continuations; root-only native format/build/Linux RF3 verification. Native/public aliases/IDs, serialization and original receipts remain unchanged. Status is private source repair, unqualified until current native/Linux/process/RF3 evidence. Original fe8 run37855042382 attempt1 artifact11584188901 API/ZIP SHA19e0af23f6cec9361097981eabc7eed87a309c1838ad9971623793e6e56e29eb:13 OwnershipLost cases in both modes; natural-issued expiry passed normal and failed scalar; recovery275/275 pass.
+
+R7 source review also preserves the actual signed NativeCommandPayload wrapper: the wrong-subject fixture decodes its canonical Value solely to retain the actual original ownership epoch; the protected replacement oracle independently reissues its literal expected CommandRequest with the same actual source owner, command ID, subject and original evaluation time and compares the complete signed native envelope bytes. A raw CommandRequest is not the signed native envelope. No production codec, MAC, receipt or outcome expectation changes.
+The existing complete published-read flow now performs genuine persisted no-grants principal creation, revoked epoch increment, restored epoch increment with retained denial, and native read/command permission failures. It compares both entire raw images, store positions and journal last/committed/applied indices after every denied operation. A changed published row revision is denied by both source validation and destination native receiver; the original frame remains valid. Existing literal healthy reads and both cold owners follow; command/process full receipt flows remain unchanged. These are authored unexecuted regressions.