Complete tenant admission flows and qualify row access control

Record KL-065 Linux 78-case acceptance. Add bounded tenant turns, original borrowed-clock and due-work flows, stricter native coverage admission, and exact task-selection identities. Preserve the original failed cohort and distinct successful continuation evidence.

Author: KSemenenko

AGENTS.md

@@ -616,3 +616,9 @@ A bounded website qualification candidate contains the20-project historical runt
 ## Native API repair autonomy, owner direction 2026-10-09
 
 - The owner authorizes routine intent-preserving compiler repairs using the actual existing native API: select its existing namespace/import or canonical constructor argument representation instead of generating duplicate types, new constructors or misplaced methods. Do not repeatedly ask the owner to reconfirm these already selected existing-API choices. Preserve public/persisted contracts, operation semantics, authorization, bounds, meaningful full-flow tests and all required qualification gates. Genuine ambiguity between different valid contracts or a new consequential decision remains subject to the existing scope and permission rules.
+
+## Native Orleans cluster communication, owner correction 2026-10-11
+
+- Database cluster communication, including partition movement, MUST use native Orleans grains or Grain Services and actual Orleans silo discovery. Do not implement custom TCP/socket listeners, HTTP peer RPC, or silo addresses inferred from public HTTP endpoints and fixed ports. Public SDK/SQL/MCP transports retain their defined client contracts; they are not cluster coordination transports.
+- Tests which qualify cluster or partition-movement behavior MUST start the actual Orleans cluster through the existing Aspire-owned topology and exercise its real native calls and public SDK/MCP operations. A manual loopback network, direct journal submission in place of Orleans execution, or a separate substitute cluster cannot qualify that behavior.
+- Replace the custom movement transport and its exclusive network helpers together with the native implementation and meaningful complete operation flows. Preserve server-authenticated peer identity, native MAC/fingerprint bytes, current membership and physical owner checks, node-local storage ownership, RF3 acknowledgement, admission limits, cancellation and joined shutdown. Retain original failures as evidence without keeping a rejected runtime fallback.

README.md

@@ -77,7 +77,7 @@ That's what we're building: **one place for context, one place for the work that
 
 | Original tasks | Accepted | In progress |
 |---|---|---|
-| **104** | **17** | **87** |
+| **104** | **18** | **86** |
 
 ```mermaid
 flowchart LR
@@ -90,9 +90,9 @@ flowchart LR
 
 **Accepted** = original task criteria passed for a recorded source. **In source** = implemented, with qualification open. Later changes require fresh checks.
 
-KL-035 and KL-079 remain open for fresh Linux qualification after regressions. The [current qualification record](docs/implementation/qualification-stage58-current-joined.md) separates implemented source, local checks and remaining acceptance gates; earlier evidence remains in the [original qualification record](docs/implementation/qualification-stage57-kl035-kl079.md).
+KL-035 and KL-079 remain open for fresh Linux qualification after regressions. The [current qualification record](docs/implementation/qualification-stage59-current-joined.md) separates implemented source, local checks and remaining acceptance gates; earlier evidence remains in the [original qualification record](docs/implementation/qualification-stage57-kl035-kl079.md).
 
-SIMD is enabled throughout the current execution path. The latest completed full Linux run at `ffab3ee4` passed all 328 process-recovery tests; its Unit suite passed 3,271 of 3,383 tests, with 112 failures under repair. Persisted team row policy, its native authentication decoder, bounded visibility caching and event streaming are implemented. The original full-text replay checks now preserve the complete original checkpoint while validating the actual current source cut; their owning build, scoped formatter and four original native test identities passed locally, with runtime qualification open. Complete Linux/RF3 acceptance and product functional coverage remain open. See the [implementation status](docs/implementation/status.json) for current acceptance gates and original evidence.
+SIMD is enabled throughout the current execution path. The latest completed full Linux run at `f0d869c` passed all 349 process-recovery tests; its Unit suite passed 3,461 of 3,478 tests, with 17 errors under repair. KL-065 passed its complete 78-case task acceptance lane: 45 Unit, 25 process recovery and 8 Aspire RF3 cases. Persisted team row policy, its native authentication decoder, bounded visibility caching and event streaming are implemented. The original full-text replay checks now preserve the complete original checkpoint while validating the actual current source cut; their owning build, scoped formatter and four original native test identities passed locally, with runtime qualification open. Complete Linux/RF3 acceptance and product functional coverage remain open. See the [implementation status](docs/implementation/status.json) for current acceptance gates and original evidence.
 
 | Workstream | What it does and why | State | Remaining work |
 |---|---|---|---|

docs/ADR/ADR-033-code-quality.md

@@ -473,3 +473,38 @@ REQ-CQ-009 / AC-CQ-039, AC-CQ-040 and AC-CQ-045 retain the closed schema, five c
 Original evidence is `/private/tmp/keyload-stage58-main-focused-runtime-r1-20261011`: actual Unit 150 executed, 146 passed and four original failures, separate Blob process recovery 8/8 passed, with 8680 source inputs/all Release images unchanged. The enrolled 38-instance subset is 34 passed/four error; its three cold identity and one movement socket failures remain immutable. Any separately repaired cold successor has its own source/image/runtime receipt and cannot rewrite that original. Native report UIDs are preserved separately from the independently matched TRX GUIDs. Recovery identities never enter Unit totals. This is current-source declaration enrollment, not coverage percentages, full CLI discovery, Linux/RF3 qualification or task closure. The mandatory full native census remains OPEN.
 
 Owner paths: `scripts/Features/CodeQuality/functional-coverage.unit-test-inventory.json`, this feature contract and ADR-033. Original per-case observations, Root source/image/JSON/TRX SHA bindings and the exact canonical selector review are retained in the sealed R28 packet. Unknown/missing/stale report admission and all runtime/coverage gates remain fail closed.
+
+
+### TASK-CQ-NATIVE-REPORT-UID-001 — same-original native identity ownership
+
+Related REQ/AC-CQ-039..045. Before implementation freeze the original Unit execution native UID as a call-local admitted mapping in `functional-coverage.native-merge.admission.ps1`; `functional-coverage.native-merge.functional-report.ps1` owns duplicate-ID refusal, exact required-map matching, and independently grouped source-line numeric type validation. The original report has already passed bounded raw-digest, source/image, success and source-span admission before the map is retained. Contributor group reports must match it before any coverage input is published. Non-Unit suites retain their existing identity/status/authorization checks and gain duplicate native-ID refusal; RF3 exact native identities stay unchanged.
+
+No descriptor/inventory/public schema, source selector, threshold, cap, TRX GUID representation or compatibility reader changes. The map is collected locally and exported only after complete report validation; failed admission never exposes a partial native-ID map. Supporting actual-report tamper/refusal/restoration commands are separate from mandatory full current-image TUnit/merge/Linux evidence. Root owns integration and final gates; original report/cohort/failure receipts remain immutable. Rollback reverts only this correction while preserving original evidence.
+
+The SAME existing NativeImagesProduceClosedManifestAndRejectTamperingWithoutReplacingEvidence deepens its actual joined PowerShell reader with an explicitly controlled original two-instance report fixture, raw digest/catalog/bounds admission, five tamper refusals, no partial map and exact byte restoration/healthy admission. Fixture status is not current execution/coverage evidence; no new test UID or contributor. Native ConvertFrom-Json -DateKind String preserves original JSON timestamp strings after the existing raw unique-key check; no bytes, caps, parser/provider or version are substituted. Complete owning TUnit/merge gates remain open until executed.
+
+
+### TASK-CQ-SOURCE-SCAN-001 — fresh bounded native source enumeration
+
+REQ-CQ-009 / AC-CQ-039..044 retain every current compile receipt, PE/PDB/source SHA, duplicate/refusal and independent before/after drift capture. Source enumeration borrows native DirectoryInfo.EnumerateFileSystemInfos at each freshly visited owned directory, removing the redundant per-entry PowerShell provider Get-Item lookup. It does not cache a directory, source, policy or image identity. The exact entry/source limits, ReparsePoint refusal before obj/bin skipping, file/directory and .cs checks, relative path validation, ordinal sorting and all byte hashes remain unchanged. Both original Unit source captures and production source-tree completeness checks use this same current native entry information. No quota, timeout, schema, classification or full census change is allowed.
+
+The existing NativeImagesProduceClosedManifestAndRejectTamperingWithoutReplacingEvidence remains the owning complete regression: prepare native products/test images; reject duplicate/swapped native report identities, failed report, stale source and unknown fields; restore exact originals; refuse tampered manifest/image/settings; re-admit the full unchanged image and preserve create-only evidence. Read-only scanner diagnostics are supporting cost/identity evidence, never test or census PASS. Original R31 remained interrupted without a terminal report; no timeout cause is inferred.
+
+### TASK-CQ-NATIVE-SOURCE-LINKS-001
+
+REQ-CQ-009 / AC-CQ-039, AC-CQ-040 and AC-CQ-045: the original current Linux TUnit report may carry the generated sourceLinks.rawUrl metadata alongside lineUrl/rangeUrl. Admit exactly the existing two required fields and this one optional nonempty string; reject every other key, a missing required field or a malformed/empty rawUrl. These links are diagnostic metadata, never source, revision, image, UID or coverage authority. Preserve original native report bytes, every complete identity/status/source/span and PE/PDB receipt check, contributor classification and unchanged coverage gates. The existing whole production-source manifest operation must exercise the actual three-link schema through its retained controlled native report, refusal mutations and exact healthy readmission. Original Linux selected report admission is supporting evidence only; full census, complete covered contributors and numeric thresholds still require their genuine original owning workflow.
+
+### TASK-CQ-CURRENT-NATIVE-TASK-BINDINGS-001
+
+REQ-CQ-009 / AC-CQ-039,040,043 bind the exact original f0 Linux native discovery: KL-014 unit retains all seven declared instances and adds the three already implemented credential status whole operations; KL-015 native-telemetry retains all twelve and adds the real ClientRemoteLink argument instance. Filters, maximum parallelism50, typed signatures, source paths, native identity checks, original reports and all required operations remain unchanged. Discovery is identity evidence, not execution PASS. A complete new selected task cohort must execute every declared instance before current-source task acceptance; historical accepted receipts remain immutable.
+
+
+## TASK-CQ-TENANT-PEER-ENROLLMENT-001 — current native operation classification
+
+REQ-CQ-009 / AC-CQ-039,040,043,045 preserve the complete original Unit inventory, five bounded disjoint selectors, zero exclusions and80/70/90 thresholds. After authentic current native identity/source/image observation, admit the actual TenantAdmissionWholeFlowTests operation as functional in its already matching unit-functional-05 group. Its genuine Core governor/inbox owns busy-tenant fair turns, exact original persisted results/models/receipts, no-effect capacity/cancellation/stop refusal, joined selected producer, immutable replay and same-root cold continuation under REQ/AC-RESOURCE-TENANT-001 and -SHUTDOWN-001. Add only that reviewed KeyLoad.Core product contributor; all prior contributors remain unchanged.
+
+ReplicaBorrowedClockOperationTests is required-control under REQ/AC-TIME-PEER-001: genuine request expiry/MAC/reply/nonce replay with complete unchanged canonical rows/cut, without dispatching the accepted ReadBarrier to a native Leader. The reply uses the fixture's literal EmptyRead. It is retained in ordinary census and excluded from functional coverage groups/product contributors. Current-source admission must preserve its original actual native identity rather than infer it from source names or TRX GUIDs.
+
+The five existing DueWorkDiscovery instances retain their original identities/classification/group assignments and require fresh source/span bindings after the already joined deterministic Unit clock repair. Preserve the complete original seventeen Linux failures and all historical reports unchanged. These metadata updates do not establish full CLI census, successful covered contributor execution, coverage percentages, RF3, latency or task closure. Missing, duplicate or mixed-source identities refuse before publication. Root owns actual current native discovery/image receipts and coherent guarded integration; no selector widening or quota/deadline change is permitted.
+
+Actual local native dotnet JSON discovery exit0 observed exactly seven instances against the current1972-source Unit image with compiledSourceBindingComplete=true: two new instances and five retained DueWork identities. Inventory now contains3053 functional and427 required controls; canonical contributors retain all61 previous entries plus the genuine tenant Core operation. This is selected discovery/current-image evidence only, not test execution PASS, complete CLI census, coverage or Linux qualification. Original discovery/process/image receipts and exact UID/source-span proof remain immutable in the R40 sealed packet.

docs/ADR/ADR-042-admission-resource-ownership.md

@@ -154,3 +154,24 @@ this narrow classifier/reservation integration and matching regressions; no data
 rewrite, migration or alternate representation exists. Until actual required
 native gates pass, this accepted repair is source work pending qualification.
 Full admission/mixed-load/performance and other feature gates remain open.
+
+
+## TASK-KL076-TENANT-TURNS-001
+
+REQ-RESOURCE-TENANT-001 / AC-RESOURCE-TENANT-001 supersedes only global FIFO between tenants: the existing two-lane inbox preserves FIFO within each authenticated tenant and dispatches one command per tenant turn in each lane. The original configured control burst, reservation ceilings, fresh persisted principal, single consumer/commit gate, original cancellation and consumer-owned completion/release remain unchanged. Tenant comes from the immutable actual admitted lease, never caller roles or payload claims. Empty tenant queues are removed, and queue owners are bounded by outstanding admitted commands. No public/persisted contract, default, provider or dispatcher changes. Modeled bytes are not process RSS.
+
+The finite native operation flow queues busy A and B, proves B's independent literal fair turn and A's per-tenant order, cap-refusal complete no-effects, accepted-response cancellation retaining ownership, joined real producer release, healthy subsequent work, exact original receipt replay and same-root cold records. Existing control-burst/single-tenant FIFO/shutdown/cancellation operation tests remain mandatory. Core ResourceExecution owns CommandInboxLanes, AdmittedCommand and feature-local CommandTenantLane; Unit ResourceExecution owns TenantAdmissionWholeFlowTests and its genuine fixture/assertions. Root integrates guarded docs before code and executes final whole-source/Linux gates. No numeric UID or runtime PASS is assigned from source. SDK/official MCP sustained overload, physical CPU/RSS/disk liveness, compaction/reindex/transitive budgets and full KL-076 acceptance remain OPEN.
+
+
+TASK-KL076-WAIT-CANCELLATION-002 retains the first actual tenant operation failure and corrects only its authored CLR wait oracle: pre-cancelled original Task.WaitAsync must throw exact TaskCanceledException with the same original caller token, while synchronous admission cancellation remains exact OperationCanceledException. The admitted completion stays pending and the complete reservation/raw state/journal image remains unchanged until the original native producer settles. No product cancellation, deadline, lease, result or cold contract changes. The original full flow/UID and all independent literal receipts/records remain mandatory.
+
+
+TASK-KL076-SEMANTIC-RECEIPT-003 retains the corrected runtime original failure: MutationReceipt native record equality also compares its private ImmutableArray backing state, so default-versus-empty representation can reject an otherwise equal complete logical receipt. The whole tenant operation independently checks every native field: mutation Kind/Resource/Id/Revision plus complete CompositionReferences; DocumentResult Reference/Revision/Json/Redacted/RedactedFields; canonical DocumentRecord Reference/Revision/Json/Access OwnerId/ProjectId/TeamId/UpdatedAt/Deleted. Literal records, original signed timestamps, complete original commit token/durability, exact native original outcome replay, raw no-effect image/journal cut and cold healthy assertions remain unchanged. No observed value becomes an expected value, no field is omitted, and no production serialization/layout/equality contract changes. Initial compiler/wait/mutation failures remain immutable; fresh whole-operation runtime qualification is required.
+
+TASK-KL076-ORIGINAL-FAILURE-004: the whole operation decodes its original native result before the full replay oracle, preserving the actual returned ErrorCode/SafeDetail exception on rejection rather than replacing it with a missing-value assertion. Every existing full result/model/raw-cut assertion remains. Original R3 failure is retained; no cause is assigned until original result evidence.
+
+TASK-KL076-NATIVE-SELECTED-CLOCK-005: original R4 returned ClockUncertain because the test submitted preissued commands with explicitTime=true after fair reordering. Actual ReplicaLeader.AppendOwned evaluates using state.Clock inside its selected leader gate before native append. The complete operation now uses existing TestDatabase.SubmitIssuedEmbedded with original cancellation; literal UpdatedAt is bound to the genuine retained native entry, with original command ID/principal/body equality, original complete receipt/replay and unchanged raw/cold assertions. No production clock, native authority, guard, quota or outcome changes. Original R4 remains failed and does not establish a product scheduler defect.
+
+REQ-RESOURCE-TENANT-SHUTDOWN-001 / AC-RESOURCE-TENANT-SHUTDOWN-001 / TASK-KL076-TENANT-SHUTDOWN-001: the existing complete tenant operation now additionally owns an independent native fixture proving Stop releases queued A/B leases with exact UnknownWriteOutcome/503/original detail and no storage/journal effects while retaining the selected original reservation. The selected genuine native producer ACKs; a fresh inbox re-admits the unchanged never-applied IDs, proves full literal receipts/models/replay, joins both inboxes and reopens the same native root for complete cold replay and healthy continuation. No new declaration/UID/product policy/clock/budget/timeout is introduced.
+
+REQ-TIME-PEER-001 / AC-TIME-PEER-001 / TASK-TIME-PEER-001: the genuine native peer signer and receiver use the same borrowed fixture TimeProvider. An unchanged original signed envelope expires without nonce or canonical effects; fresh real request/reply preserves every field/body/MAC and exact provider timestamp, then original duplicate refuses with unchanged complete native state. Existing System-clock controls and product clocks/config/defaults/aliases/quotas remain unchanged. The fixture-only optional provider and complete operation do not qualify RF3, database effects or the global call-site audit.