Fix native text lease settlement and RF3 acceptance fixtures

Author: KSemenenko

docs/ADR/ADR-019-managed-ann.md

@@ -74,3 +74,16 @@ quality, work/deadline limits and all existing tests remain mandatory. A unique
 DotProduct candidate copy may remove redundant membership work with actual
 charges and identical selection/ties. Root reviews the private Luna patch and
 retains full normal/scalar/Linux evidence before any qualification claim.
+
+The 2026-10-05 [prepared-value refinement](../Features/Search/ManagedAnn.md#accepted-prepared-value-refinement-2026-10-05)
+accepts REQ/AC-ANN-010 and TASK-ANN-R1-PREPARED-VALUE. Replace per-candidate
+prepared-object allocations only in privately owned packed neighbor work with a
+finite-checked-carrier readonly value. One shared helper retains the exact current
+metric reduction and untrusted validation remains mandatory. Implement numeric
+extraction, private value, consumed diversification/overflow joins and independent
+exact-score/allocation regressions in that order. Query worker owns its private
+Search implementation packet, cluster worker owns its independent real-store test
+packet, and root owns complete review, joins, full checks,
+Aspire native/scalar corpus gates and original exact-source evidence. No data,
+wire, capability or format migration is introduced; rollback reverts the value
+joins. This ADR remains unqualified until its original full acceptance is proven.

docs/ADR/ADR-082-native-cqrs-streams.md

@@ -34,6 +34,17 @@ ANN algorithm work owns disjoint Search files and may proceed in parallel. Root
 
 ## Migration, delivery and rollback
 
+The 2026-10-05 TASK-CRS-CANCEL-FAILURE-JOIN prerequisite is frozen in
+[NativeCqrsRequestV2](../Features/ClusterRouting/NativeCqrsRequestV2.md),
+REQ/AC-CRS-JOIN-001. An owning Communication cancellation-callback failure must
+not skip the original native producer join. Source repair and independently
+controlled native tests precede canonical patch release, full owning checks,
+GitHub publication and verified NuGet availability; root then updates KeyLoad
+and qualifies actual Aspire consumer behavior. Source/test workers own disjoint
+private Communication scopes; root owns package/docs/delivery/consumer joins.
+Original failure identities, fatal priority, stream backpressure and public shape
+remain unchanged. No data migration, replacement or consumer workaround is allowed.
+
 C0 changes only test infrastructure; canonical data epoch6, signed request envelope, RPCv1, discovery, HTTP/SDK/MCP responses and RF3 topology remain unchanged. No database migration is needed. The new test-only package is pinned to the current native Orleans family and adds no product dependency.
 
 C1 explicitly versions its RPC shape and homogeneous cold rollout independently of data-format upgrades in NativeCqrsRequestV2. Existing source still lacks application-RPC cohort validation until that implementation is qualified. The accepted peer-envelope/MAC upgrade prevents cross-version replica acknowledgements; separate discovery-MACv2 preserves authenticated observation of old versions. No mixed-node rolling compatibility or runtime legacy fallback is approved. Two compatible surviving RF3 voters remain the required failure topology; a reachable authenticated incompatible voter fails public admission/readiness with a bounded cache-detection delay.

docs/Features/ClusterRouting/NativeCqrsRequestV2.md

@@ -20,6 +20,110 @@ flowchart LR
 
 ## Requirements and acceptance
 
+TASK-CRS-CANCEL-FAILURE-JOIN, accepted 2026-10-05, is an owning-dependency
+prerequisite of AC-CRS-004 and the explicit node producer-drain contract. Current
+Communication CreateCore awaits CancelAsync before awaiting its real producer;
+an actual registered cancellation callback can throw and skip that producer join.
+Repair ManagedCode.Communication in its owning repository, never in KeyLoad.
+Observe cancellation and then unconditionally await the original producer task,
+retaining distinct original cancellation/producer failures without flattening
+their identities and preserving the existing fatal-runtime priority. Retain an
+iteration cancellation together with a later cleanup failure when both occur;
+ordinary cancellation, capacity-one backpressure and native terminal shape stay
+unchanged. Cancellation errors cannot become a reason to abandon native work.
+
+REQ-CRS-JOIN-001 / AC-CRS-JOIN-001: a real Create producer with a throwing
+registered cancellation callback remains joined by early enumerator disposal;
+the disposal cannot complete while that original producer's controlled finally
+is still active, and the callback failure is observable afterward. Healthy
+subsequent creation, ordinary cancellation and existing fatal-aggregate cases
+remain passing. Use real native Create, tokens and controlled tasks; no fake
+enumerator or abandoned observation wait. Always release and join original work
+in fixture cleanup, preserving observation plus cleanup failures.
+
+Luna lifecycle_wave owns a private source repair to Communication/Cqrs/CqrsStream
+and one cohesive cleanup helper; Luna cluster_wave independently owns new owning
+CQRS tests. Root owns README, canonical patch10.2.11 over published10.2.10, complete
+review, owning build/full TUnit/format checks, scoped commit/push, successful
+GitHub release, actual NuGet-feed/package verification and only then KeyLoad's
+central package update and Aspire consumer regressions. Both workers read the
+owning AGENTS.md and preserve its timestamps, constants, logging and API rules.
+No public stream, binary alias/field ID, database format or dependency replacement
+is introduced. Rollback retains the previous published package and its explicit
+failed-join evidence; no local package or project reference qualifies delivery.
+
+TASK-CRS-C1-PRIOR-CHECKPOINT, accepted 2026-10-05, retains AC-CRS-002 and
+ADR-077/091's actual cold native6-to-native7 migration evidence after original
+run37242346547. One ten-document command does not produce the required native
+replica checkpoint at the default threshold1024. Luna cluster_wave owns a private
+patch for RequestCqrsRf3Epoch7Scenario, RequestCqrsRf3Epoch7WaveRunner,
+RequestCqrsRf3Wave and a new feature-local RequestCqrsRf3CheckpointSeed helper.
+Add an explicitly selected threshold16 only to that scenario's original prior
+wave through the existing AppHost KeyLoad:SnapshotThreshold configuration;
+ordinary waves and product defaults remain1024. Preserve cancellation-last
+signatures and existing native image proof, explicit RF3 membership, readiness,
+owned stop/dispose, exclusive lock joins and failure preservation.
+After the unchanged ten-document seed and exact SDK/MCP replay, issue at least20
+distinct real public SDK commits into a separately configured fixture collection,
+with independent stable command IDs and expected revision0. Validate their actual
+receipts and records and wait for all three real voters to apply the last receipt
+before capturing prior observations and stopping the original wave. Preserve
+every original seed document/revision and receipt oracle. Conversion runs only
+after owned shutdown and exclusive locks; original non-null snapshot, threshold,
+length/hash inventory, topology, byte-identical private profile, mixed-version
+rejection, restart, later-write and both-client assertions remain unchanged.
+No synthetic hard state, copied snapshot pointer, lowered oracle, shared corpus
+expansion, invented prior-image feature or new test authority is allowed. Root
+reviews the complete patch and qualifies it through the real Aspire RF3 caller.
+
+TASK-CRS-C1-MCP-REJECTION-EVIDENCE, accepted 2026-10-05, refines
+AC-CRS-002/004 after the original follower-restart initialize HTTP400. The
+original capped shared-fixture logs did not retain a transport stage for the
+separately owned C1 wave. Luna cluster_wave owns a private patch for feature-local
+RequestCqrsRf3Diagnostics helpers/pure records, RequestCqrsRf3Wave and
+RequestCqrsRf3Epoch7WaveRunner; root joins other C1 wave callers if required.
+Subscribe to the actual Aspire wave's ResourceLoggerService before starting its
+resources and join every owned subscription before deleting or disposing its
+owner. Parse only the existing fixed MCP rejection message into defined
+McpTransportStage and McpTransportMethodCategory values; retain at most32 closed
+records per actual node, a server-test-derived wave GUID and closed node identity.
+Never retain raw log lines, exception text, HTTP headers/body/target, credentials,
+private profile or user data in this artifact. Preserve ordinary public MCP
+behavior and the official SDK; no branch guess, client fallback or hidden retry.
+The diagnostics ownership correction may extract a cohesive WaveStartup helper
+inside the same ClusterRouting/Helpers scope to keep existing numeric limits.
+Luna query_wave owns that private correction after the source packet is frozen;
+root reviews it and runs the integrated warnings-as-errors build. Disposable
+ownership must transfer explicitly or settle in unconditional finally, and the
+CTS must dispose directly after its original subscriptions join. Preserve every
+original failure and stop-before-subscription-before-app-disposal ordering; no
+analyzer suppression, relaxed numeric policy or interface-removal bypass.
+
+On an actual C1 failure, retain a uniquely named bounded JSON under the existing
+qualification artifact directory, associate its path with the original test
+failure, and preserve both original and diagnostic/stop/disposal failures through
+ServerFailureObserver. Do not overwrite another wave's receipt. Source/image/run
+provenance remains the original verified image proof and TUnit artifacts.
+Captured node/wave/stage/category evidence may identify a rejecting check; if
+multiple events prevent unique correlation, report that limit rather than
+inventing a request correlation or declaring the MCP cause fixed. Verify the
+actual follower-restart case through the same Aspire RF3 caller before making a
+runtime claim. No public contract, authorization, data or topology change occurs.
+
+REQ-CRS-DIAG-001 / AC-CRS-DIAG-001: feature-local TUnit tests use the actual
+Aspire ResourceLoggerService and three ContainerResource identities to publish
+the existing fixed transport message and inspect the resulting bounded artifact.
+They verify defined stage/category values, distinct wave identity, the32-record
+limit per node, and exclusion of oversized, repeated-marker, numeric-enum,
+unknown-value and trailing-content lines. Retained JSON contains only the
+version, wave, node and closed stage/category fields. Tests join the actual
+subscription owner before reading/removing its uniquely owned artifact and
+verify repeated disposal observes the same completion. No parser copy, fake
+logger stream or weaker test-only parser entry is permitted. Luna lifecycle_wave
+owns only a private patch for new ClusterRouting/Cases diagnostics tests and a
+cohesive Helpers support file in IntegrationTests; root owns source integration,
+the warnings-as-errors build and the real Aspire test caller.
+
 | Requirement | Measurable acceptance | Automated evidence |
 |---|---|---|
 | REQ-CRS-001: one versioned native stream replaces the request Task RPC | AC-CRS-001: genuine native Orleans calls execute the signed read and command through exactly one independently keyed request grain and the existing capability grains. The new interface/method aliases and generated progress record round-trip with the native Communication converter. The retired request Task method and unused envelope-alias constant are absent; there is no runtime fallback or second dispatcher. | RequestCqrsRoutingTests; real Aspire SDK/MCP RF3 operations |

docs/Features/Search/GraphRetrieval.md

@@ -7,7 +7,7 @@ SQL, distributed ranking, performance and RF3 qualification requirements.
 
 TASK-GSEARCH-RF3-RANK-FAILOVER preserves REQ/AC-GSEARCH-003/006 and ADR-090
 after original run37242346547. Luna cluster_wave owns only a private overlay of
-GraphSearchRf3Tests, SqlGraphSearchRf3Tests, GraphSearchRf3LeaderLossTests and
+GraphSearchRf3Tests, SqlGraphSearchRf3Assertions, GraphSearchRf3LeaderLossTests and
 a feature-local bounded survivor-status helper if needed. Preserve exact corpus,
 policy, projected results, expansion, public SDK/official MCP parity and faults.
 The independent graph branch sorts shortest hops then full EntityRef and feeds

docs/Features/Search/ManagedAnn.md

@@ -196,3 +196,49 @@ current-source patch. Preserve numeric limits and existing tests. Review owned
 carrier/uniqueness invariants, run full Release/format/governance and unchanged
 Aspire normal/scalar/related recovery/RF3; retain original failures and exact-source
 Linux results. No acceleration or qualification claim precedes those results.
+
+## Accepted prepared-value refinement, 2026-10-05
+
+TASK-ANN-R1-PREPARED-VALUE refines the existing owned-score path without changing
+its score formulas, work accounting or admission. The current diversification and
+reciprocal-overflow loops allocate one PreparedSimilarity object for each examined
+candidate. Use a private-constructor readonly PreparedPackedSimilarity value,
+created only from an actual finite-checked PackedAnnVectors carrier and ordinal.
+Its internal API is Create(PackedAnnVectors, int ordinal, DistanceMetric) and
+Score(PackedAnnVectors, int ordinal), returning the exact double similarity.
+It retains only that owned query slice, metric and one query norm; no norm array,
+new retained vector copy, normalization, approximate formula or public bypass.
+
+REQ-ANN-010 / AC-ANN-010: its scores equal SearchEngine.Similarity exactly in the
+same native/scalar invocation mode for all three metrics, zero, subnormal, large
+finite values and dimensions1/4096. Invalid ordinal, metric, dimension and
+untrusted nonfinite input still fail through the original typed validation.
+Mutating input buffers after Copy cannot affect the value. A warmed synchronous
+loop of actual packed-value construction and scoring must allocate zero bytes
+as measured on that same thread; setup, persisted corpus and assertions remain
+outside that interval. This is an allocation oracle, not a latency claim.
+
+Keep one canonical implementation of the existing ordered metric reductions in
+a feature-local execution helper consumed by both PreparedSimilarity and the
+new packed value. Preserve the exact widen, reduction, tail, zero and square-root
+order. PackedAnnNeighborSelection uses the value in diversification and overflow;
+the existing budgeted PackedAnnLayerSearch score join charges the identical work
+before scoring. Ordinary untrusted search and other prepared-query ownership stay
+unchanged. No public DTO, native alias/field ID, canonical record or persisted
+index format changes are permitted.
+
+Root freezes this contract and ADR-019, and owns integration and gates. Luna
+query_wave owns a private exact-base patch for PreparedSimilarity,
+PackedAnnNeighborSelection, PackedAnnLayerSearch and new cohesive Search/Execution
+numeric/value helpers only. Luna cluster_wave independently owns new
+PackedAnnPreparedValueOracleTests and cohesive feature-local test helpers for the
+exact-score, invalid-input, ownership and allocation criteria. Implement
+the shared numeric helper, finite-owned value, consumed loop joins, then independent
+public-oracle/allocation tests. Preserve every existing test, corpus, deadline,
+option, graph order, budget charge and error. Root reviews the complete diff,
+builds/formats/governs the full solution and runs Aspire native/scalar metric and
+the unchanged ANN corpus/recall/filter/deadline gates before qualification.
+Rollback reverts the computational joins; there is no data migration. Public
+SDK/MCP/frontend additions are N/A because this internal optimization preserves
+their existing exact operation contracts. Comparable GitHub measurements and
+remaining ANN projection/public/RF3 acceptance are still mandatory.

docs/Features/Search/OnlineGenerationLifetime.md

@@ -80,6 +80,53 @@ invalidation, unknown-path denial and closed/restart corruption controls through
 the actual Aspire caller. This source repair does not qualify L1, L2 or RF3;
 full suites and exact-source Linux evidence remain required.
 
+TASK-LEASE-LIVE-SIZE, accepted 2026-10-05, corrects the actual native-text71
+failure while preserving REQ/AC-LEASE-001/002/003. The retained manifest describes
+the fully closed publication inventory; a manager-owned reopened native WAL may
+have a different current length. Live preflight must inspect every tracked native
+file without reopening it, reject nonregular/linked files and any current file
+over MaximumDiskBytes, and retain the existing per-generation and aggregate
+actual-byte census. It must not compare a live file length with its closed
+manifest length. Retained manifest scope, records and file metadata must still
+match the manager's verified publication. All cold generations, publication,
+reopen, retirement, deletion and restart keep exact lengths and checksums.
+Luna query_wave owns only a private NativeTextLiveGenerationMetadata correction;
+root reviews and joins it before the same original native tests run through
+Aspire. No provider, sharing mode, ceiling, deadline or persisted format changes.
+
+TASK-LEASE-COLD-FIXTURE, accepted 2026-10-05, preserves the original native
+capacity and retirement oracles. Luna lifecycle_wave owns only a private patch
+for NativeTextGenerationCapacityTests and NativeTextGenerationLifetimeTests,
+with a feature-local cleanup helper if the numeric policy requires extraction.
+Sort the independently created expected generation leaves ordinally before the
+existing exact ordered comparison. Every borrowed lease must settle before its
+owning projection's shutdown even when an earlier operation fails; retain every
+primary and cleanup failure through ServerFailureObserver. The restart fixture
+must first preserve its real borrowed retired generation by the existing owned
+foreign-file failure, settle that lease, then run and observe failed projection
+shutdown so both native indexes are actually closed. Only after closure may it
+remove the fixture-owned foreign file, create the third leaf through the
+unchanged cold WriteOwner call, and restore that same owned foreign entry.
+Restart must still reject the entry before deleting any of the three generations,
+preserve every original generation, and succeed after removing only that entry.
+Keep the original old-reader, revisions, three-leaf bound, denial, healthy retry
+and real provider assertions. Do not pass fabricated live slots into cold calls
+or weaken full cold inventory validation. Root runs the unchanged acceptance
+suite and captures actual source/runtime and terminal results.
+
+TASK-LEASE-CANCEL-SETTLEMENT, accepted 2026-10-05, addresses the actual Aspire
+native-text72b failure in SaturationAndCancellationReleaseNativeLeaseForHealthySearch.
+The final aggregate physical census in NativeTextProjection.Release must use the
+same completed-operation rule as NativeTextSettlement.Refresh: an incomplete
+or cancelled operation settles without consulting its exhausted caller budget,
+while retaining all real file, byte and generation ceilings and distinct cleanup
+errors. A successfully completed operation retains its existing budget checks.
+Luna query_wave owns a private patch to NativeTextProjection.Release only,
+unless the unchanged original regression identifies a further owning defect.
+Do not suppress cancellation globally, hide physical failures, change deadlines,
+or weaken tests. Root reviews the joined change and reruns the original 36-case
+native-text selection through the Aspire AppHost; full qualification stays open.
+
 Frontend/new SDK/MCP syntax N/A: unchanged public search surfaces consume this
 manager. Migration N/A: no canonical record or persisted index format changes.
 Rollback stops the capable node and rebuilds disposable indexes; no canonical