Checkpoint all current due coordination, index lifetime and epoch recovery work

Owner-requested full working-tree checkpoint. Native Graph 10.0.10 is published and consumed. Latest completed unit baseline: 3197/3204; recovery: 284/295. New combined Release build, full format and Aspire/Linux qualification are still pending; no acceptance criteria are marked closed.

Author: KSemenenko

Directory.Packages.props

@@ -13,7 +13,7 @@
     <PackageVersion Include="ManagedCode.Communication.Orleans" Version="10.2.9" />
     <PackageVersion Include="ManagedCode.TimeSeries" Version="10.0.3" />
     <PackageVersion Include="ManagedCode.Storage.FileSystem" Version="10.0.13" />
-    <PackageVersion Include="ManagedCode.Orleans.Graph" Version="10.0.9" />
+    <PackageVersion Include="ManagedCode.Orleans.Graph" Version="10.0.10" />
     <PackageVersion Include="ManagedCode.Orleans.Identity.Core" Version="10.0.3" />
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
     <PackageVersion Include="ModelContextProtocol.Core" Version="2.2.0" />

docs/ADR/ADR-019-managed-ann.md

@@ -65,3 +65,12 @@ The second original Aspire cohort also passed17/19 and hit the unchanged build w
 The third original Aspire cohort remains17/19 and hits the same cap in reciprocal-link work. Root accepts the [bounded dual-heap search refinement](../Features/Search/ManagedAnn.md#accepted-bounded-dual-heap-refinement-2026-10-04), replacing repeated frontier/worst scans while preserving exact extraction/tie order and the diversified neighbor-selection rule. Three explicitly reserved int[E] heap arrays replace the old bool[E] processed array/cache; private admission formulas include every array before allocation. Root and independent review must prove map/remove/reset invariants and unchanged test outcomes. Reciprocal work, recall and deadline qualification remain open; the three original failures are retained and no cap/AC reduction is authorized.
 
 The fourth original report reaches and passes all10 Cosine/Euclidean cells, but remains17/19 because DotProduct builds exceed the unchanged work cap. Root accepts [simple DotProduct neighbor selection](../Features/Search/ManagedAnn.md#accepted-dotproduct-neighbor-selection-refinement-2026-10-04) for both new and overflowing reciprocal edges, with unchanged exact dot scores and deterministic ties. This selects Algorithm3 for that nonmetric similarity while preserving diversification for the two qualified metric controls. It removes pair-diversity work without changing bounds or ACs; the potential bridge/recall cost must pass the unchanged five DotProduct cells. Whole-source guard failure from concurrent benchmark edits and separate unchanged ANN/runtime proof remain explicit; all results are local development evidence.
+
+Unit44b's four ordinary build-deadline failures lead to the accepted
+[packed-owned validation refinement](../Features/Search/ManagedAnn.md#accepted-packed-owned-validation-refinement-2026-10-04),
+REQ/AC-ANN-009 and TASK-ANN-R1-OWNED-SCORES. Only privately copied finite vectors
+may use the internal trusted scorer; untrusted validation, metric arithmetic,
+quality, work/deadline limits and all existing tests remain mandatory. A unique
+DotProduct candidate copy may remove redundant membership work with actual
+charges and identical selection/ties. Root reviews the private Luna patch and
+retains full normal/scalar/Linux evidence before any qualification claim.

docs/ADR/ADR-091-epoch7-interpretation-fence.md

@@ -24,6 +24,24 @@ without explicit scope for the particular user stores. Implementation remains
 Accepted until mapped real process, SDK/MCP RF3 and exact-source Linux evidence
 exists. Missing probe artifacts fail the gate and must not skip tests.
 
+The C1 RF3 correction is TASK-CRS-C1-EPOCH7 in
+[NativeCqrsRequestV2](../Features/ClusterRouting/NativeCqrsRequestV2.md). Its fixed
+genuine RPC1 baseline is native6, so current readers use the existing explicit
+all-three-Prepare-before-Publish stopped-copy upgrade. A separate owned mixed
+copy with published native7 node1 and untouched native6 node2/3 is permitted only
+as a cross-epoch loss-of-compatible-quorum fault wave; current node1 must fail serving
+and settle completely before homogeneous native7 serving. Preserve original
+profile/data/image proofs, C1 receipt workload and node identity, then verify
+current cold restart and current writes through both real clients. This does not
+qualify a same-epoch protocol-only fault or authorize old readers over native7,
+rolling conversion, relabelled images, stale rollback or user-store migration.
+Two compatible current voters retain the legitimate RF3 majority when the prior
+signing purpose cannot authenticate as a current observation. The negative
+fixture must not assert unavailable serving for that valid majority or invent
+an authenticated mismatch; it uses one current voter and two genuine prior voters.
+Root owns the shared preparation seam, docs and all gates; Luna lifecycle_wave
+owns only the private feature-local C1 fixture patch and obsolete-helper removal.
+
 ```mermaid
 flowchart TB
   Contract[New persisted interpretation] --> Data[Strict epoch7 admission]

docs/ADR/ADR-094-orleans-due-coordination.md

@@ -26,6 +26,10 @@ Implementation contract:
    the existing bounded ManagedCode Communication CQRS consumer. No direct Apply,
    synthetic privileged scheduler principal, copied dispatcher or hosted timer
    outside Orleans is allowed.
+   The actual service-source DSL gap in the owning Graph package is repaired and
+   published under [GrainServiceGraph](../Features/ClusterRouting/GrainServiceGraph.md),
+   REQ/AC-SGRAPH-001..003, before the consumer package/runtime join. Coordinator
+   client entry, AllowAll and fabricated native Graph context are prohibited.
 4. Tests cover finite sweep/cursor/byte/deadline/corruption/cancellation bounds,
    current creator authority and stable unknown-response retry. Actual Aspire
    RF3 SDK/official MCP tests must observe autonomous emission/expiry, duplicates,

docs/ADR/ADR-095-online-generation-leases.md

@@ -0,0 +1,37 @@
+# ADR-095: Bounded native index generation leases and retirement
+
+Status: Accepted for KL-039 L1; implementation and qualification pending.
+Date:2026-10-04. Integration owner:root. Coding owner:Luna query_wave.
+
+The current native manager holds one lifetime semaphore and immediately deletes
+the previous generation on publication. It cannot preserve overlapping readers.
+Adopt [OnlineGenerationLifetime](../Features/Search/OnlineGenerationLifetime.md),
+REQ/AC-LEASE-001..004: finite generation/lease/build ownership, fully verified
+publication, reference-counted retirement, retained cleanup failures and joined
+shutdown. Preserve selected native provider, canonical scope validation and all
+original physical budget/settlement gates.
+
+Implementation contract: root freezes the interface-preserving manager contract;
+query_wave owns Server Features/Search Storage/Lifecycle manager, lease and
+settlement helpers, the existing generation capacity and restart retirement
+preflight joins, and new independent real-native UnitTests. Keep1builder,
+2leases,1retired/1current generation and3physical generations including staging
+as upper bounds; actual provider safety may tighten concurrent readers. Root
+reviews the private patch, integrates the actual production caller, runs serialized
+Release/format/governance and Aspire unit/recovery/RF3, commits the completed stage
+and retains exact-SHA Linux original results before qualification.
+
+L2 still must atomically pin/capture a canonical base cut, build while canonical
+writes proceed, replay ordered deltas, validate/cut over and recover catalog/pins.
+Do not call L1 a completed online index. No public wire/canonical data epoch or
+index manifest transition occurs. Rollback stops the node and reconstructs only
+its disposable owned index; original canonical data remains authoritative.
+
+```mermaid
+flowchart TD
+  Lease[Owned reader lease] --> Ref[Generation reference]
+  Publish[Verified replacement] --> Retire[Mark prior generation retired]
+  Ref --> Zero[Last reference settles]
+  Retire --> Zero
+  Zero --> Cleanup[Close then remove verified owned files]
+```

docs/ADR/ADR-096-global-branch-windows.md

@@ -0,0 +1,35 @@
+# ADR-096: Bounded comparable global modality windows before fusion
+
+Status: Accepted for KL-057 R1 kernel; implementation and qualification pending.
+Date:2026-10-04. Integration owner:root. Coding owner:Luna lifecycle_wave.
+
+Current fusion tie-breaks only the entity Id and only sees one partition. Adopt
+the internal kernel and actual local-adapter contract in
+[GlobalBranchWindows](../Features/Search/GlobalBranchWindows.md), REQ/AC-RANK-001..004.
+Global modality windows precede ranks/RRF, complete identities define tie order,
+duplicates must agree, scores share exact profile/corpus/statistics witnesses,
+and missing/approximate/truncated sources cannot masquerade as exhaustive output.
+
+Implementation stages: root freezes internal contracts; lifecycle_wave owns new
+Query Search Contracts/Models/Queries/Validation, the narrow SearchRankFusion join
+and new independent UnitTests centralized/layout/bounds/completeness oracles in
+a private patch. Root reviews the actual production caller, integrates, executes
+Release/format/governance and Aspire unit/RF3, commits and records original exact
+source Linux evidence. Later KL-037 stages must supply a real shard catalog,
+native bounded fan-out, per-partition read-cut vector, current persisted policy
+and strict text statistics generation before multi-shard claims.
+
+No public client/persisted/replica format changes are accepted by R1; generated
+internal aliases/IDs are frozen before any future inter-grain publication. Existing
+native RF3 replicas remain replicas. Single-partition strict text remains valid
+only within its current local scope. Rollback changes no canonical data; global
+qualification and KL-057 closure require actual independent physical-shard results.
+
+```mermaid
+flowchart TD
+  Scope[Common score and statistics scope] --> Windows[Expected logical windows]
+  Windows --> Complete{Every required window complete?}
+  Complete -->|yes| Merge[Bounded global modality merge]
+  Complete -->|no| Failure[Explicit failure or declared incomplete result]
+  Merge --> Fusion[Stable full-identity RRF]
+```

docs/ADR/ADR-097-native-read-cut-leases.md

@@ -0,0 +1,47 @@
+# ADR-097: Provider-owned native read-cut leases
+
+Status: Accepted for KL-039 L2-A; implementation and qualification pending.
+Date:2026-10-04. Integration owner:root. Coding owner:Luna query_wave.
+
+Adopt [NativeReadCuts](../Features/StorageRecovery/NativeReadCuts.md),
+REQ/AC-CUT-001..004, as the canonical contract. A native runtime snapshot pin is
+preferable to unbounded copying or holding the canonical gate throughout an
+index build. Keep one provider-owned finite lease, copied callback bytes, exact
+scalar identity and joined shutdown. The existing gated-view interface remains
+unchanged and cannot escape; the new capture entry is internal to the provider.
+
+Implementation contract: root owns this ADR/spec and all shared joins; query_wave
+owns disjoint StorageRecovery Models/Validation/Queries/Lifecycle native helpers,
+the provider facade/runtime joins, the minimal pre-mutation InstallSnapshot
+admission check in ZoneTreeCheckpointManager, and real-provider UnitTests. Implement capture,
+bounded visitation, disposal, then mapped consistency/budget/lifetime tests.
+Review exact file hashes, full Release build, format/governance, serialized Aspire
+normal/scalar/recovery/RF3 and exact-SHA Linux results before qualification.
+
+Pinned ZoneTree1.9.8 snapshot creation and iterator advance are synchronous and
+non-cancellable. Check and charge before/after; do not claim an interruptible
+deadline or abandon original work. No canonical format, native WAL, public wire,
+RF3 topology or acknowledged-write authority changes. Leases are disposable on
+restart/migration and retain no signing material. Rollback drains the actual
+leases after stopping admission and removes only runtime helpers.
+
+Whole-tree replacement must reject ResourceExhausted while a native cut is leased.
+InstallSnapshot checks under its existing write gate after health/stale validation
+and before staging, fault callbacks or publication. No waiting or poison-on-failure
+replacement path is entered for this rejection. The gate also excludes a new
+capture until replacement completes. Ordinary Compact does not replace the native
+tree and remains allowed. Prove unchanged current health/identity after rejection,
+successful installation after disposal, and exact old-cut reads after compaction.
+
+L2-B remains responsible for same-cut outbox/policy/applied metadata and retention,
+ordered delta catch-up, validated catalog switch and interrupted-build recovery.
+Neither this primitive nor L1 leased generations alone closes the original
+concurrent-write/online-index/restart acceptance criteria.
+
+```mermaid
+flowchart TD
+  Gate[Existing canonical read gate] --> Lease[Native immutable runtime cut]
+  Lease --> Scan[Off-gate bounded scan]
+  Scan --> Drain[Close admission and join original traversal]
+  Drain --> Dispose[Dispose iterator before tree shutdown]
+```

docs/Architecture.md

@@ -11,6 +11,16 @@ and graph relationships -> queued actions. Logical resources organize one databa
 derivation stage through the existing atomic command and SQL CALL. Full
 declarative SQL and client protocol remain mandatory under ADR-065.
 
+Current parallel implementation contracts are [DueCoordination](Features/Messaging/DueCoordination.md)
+under ADR-094 (leader hints through fresh authorized Orleans CQRS requests),
+[OnlineGenerationLifetime](Features/Search/OnlineGenerationLifetime.md) under
+ADR-095 (bounded native index leases and retirement, original KL-039), and
+[GlobalBranchWindows](Features/Search/GlobalBranchWindows.md) under ADR-096
+(bounded per-modality merge before RRF, original KL-057). Each remains open until
+its mapped acceptance evidence exists. [NativeReadCuts](Features/StorageRecovery/NativeReadCuts.md)
+under ADR-097 supplies the next provider-owned L2-A snapshot lifetime primitive;
+delta retention/catalog cutover and actual multi-shard fan-out remain required.
+
 ```mermaid
 flowchart LR
     Caller[Agent SQL SDK MCP] --> Request[One authorized Orleans request]

docs/Features/ClusterRouting/GrainServiceGraph.md

@@ -0,0 +1,39 @@
+# GrainServiceGraph within ClusterRouting
+
+Accepted dependency-repair contract for ADR-094 and REQ/AC-DUE-002/004.
+ManagedCode.Orleans.Graph10.0.9 admits only IGrain sources in its fluent and
+attribute configuration. The native due service is an IGrainService system
+target. Giving its coordinator client entry or fabricating caller context would
+weaken the intended service-to-coordinator boundary.
+
+| Requirement | Acceptance |
+|---|---|
+| REQ-SGRAPH-001: native service-source policy | AC-SGRAPH-001: the owning Graph package exposes AddGrainServiceTransition<TService,TGrain>(params string[] targetMethods), constrained to the actual Orleans GrainService implementation and IGrain target. It adds only the actual service type, explicitly any native callback source method, and the supplied target methods. Empty/null/blank input fails before changing the existing graph; all previous method rules remain effective. |
+| REQ-SGRAPH-002: real caller enforcement | AC-SGRAPH-002: a native Orleans-hosted service callback outside a client request reaches the explicitly permitted application-grain method, a different target method is rejected, and direct client entry remains denied. The observed source is the actual service implementation, never CLIENT, UNKNOWN, the base Grain, a fabricated context or a reflection-order guess. Existing application-grain, system-target and async-stream regressions pass. |
+| REQ-SGRAPH-003: published ownership and consumer join | AC-SGRAPH-003: repair source and focused regressions live in the sibling Orleans.Graph repository; its canonical patch release passes required checks and GitHub publication and is available from the real NuGet feed. Only then update KeyLoad's central package reference and use the native API for RecurringDueGrainService to IRecurringDueCoordinatorGrain.ProcessDueAsync plus the existing coordinator-to-request and request-to-leaf edges. Actual Aspire SDK/MCP autonomous RF3 and complete required Linux gates remain mandatory. |
+
+The new Graph method is an additive startup configuration API. No KeyLoad public
+operation, native replica/request wire contract, serialization alias, persisted
+format or topology changes. The explicit any-source-method rule represents native
+service callbacks without a current incoming method; it does not infer an exact
+method or allow another source type, target method or client. Existing runtime
+caller resolution is preserved unless the real hosted regression demonstrates a
+defect, which must be repaired and tested in the owning Graph repository.
+
+Root owns planning, final review, actual dependency delivery, central package and
+Server DI/Graph joins. Luna cluster_wave prepares a private Graph patch for the
+two existing builder files and new real hosted/builder regressions. It first
+records this contract and an owning-repository ADR, then implements the additive
+method and independent allowed/denied/client and additive-rule tests. No consumer
+copy, local-package release claim, project reference, AllowAll, client entry,
+filter bypass, guessed caller or context impersonation is permitted.
+
+Build, formatter, TUnit, commit/push, successful Release and verified package
+availability are ordered owning-repository gates; root runs/reviews them and
+retains exact source/run/package receipts. KeyLoad source integration follows
+publication. Rollback retains the existing package and leaves autonomous due
+coordination unregistered until a capable published package is available. Source
+presence or a local build does not close any of the three acceptance criteria.
+
+Frontend and new SDK/MCP syntax N/A: this is native internal routing configuration.
+Related original task is KL-100; it remains open through complete S2 qualification.