@@ -485,3 +485,24 @@ Independent full SQL+AST literal rows and exact maximum/minimum true-constant pr
 REQ-SQLC-006 / AC-SQLC-006 SQLC-LEX and existing REQ/AC-QUERY-004/005/006, ADR-065: NEXT SQL.UnicodeStringLiteral.v1 accepts adjacent U/u& single-quoted Unicode strings through the same original String ValueOperand. Default backslash or explicit UESCAPE supports four hexadecimal digits, plus-six digits, mixed-width adjacent surrogate pairs, doubled escape, doubled quotes and the original newline string continuation. Preserve exact raw SQL and original positional parameter mapping. UESCAPE consumes a current ordinary/E/dollar simple string whose decoded UTF-8 value is one non-NUL ASCII byte, excluding hex digits, plus, quotes and ASCII whitespace, matching the native PostgreSQL18 parser contract. Invalid scalar/surrogate/hex/NUL/unfinished literal or escape option refuses the existing fixed Validation. Each original fragment and the two UESCAPE source tokens consume unchanged MaxQueryTokens; original source/depth/read/output/cancellation/producer/connection ownership limits remain. Use current native .NET Rune, existing hex/trivia/strict literal helpers, no package, AST/version/serializer/provider or authority-store change.
 
 Original wholecase declarations/Args/UIDs, full SQL+AST literal low/empty/emoji/mixed-surrogate/doubled-escape/continuation pages, actual SDK/official MCP/Npgsql simple/prepared parity, external bound $1 beside a protected raw Unicode literal containing $1, malformed-to-same-owner healthy continuation, fresh query-policy epoch denial/restore, actual Boolean field fault/exact repair and seed/fault/repair receipt replay, exact original canceled token plus independent healthy token, full Unit raw image/position/identity, public RF3 document/outbox parity and two owned cold continuations are required. Native positional rewriting already preserves the ordinary quote/continuation raw source; no second translator is introduced. Public query cut stays opaque. U& quoted identifiers, general encodings/settings, admitted row-progress cancellation, physical-owner authority, compiler/runtime/Linux RF3/fault/resources and full SQL/client interoperability remain separate OPEN. This NEXT source-only candidate is not qualification.
+
+### SQL.BooleanPredicate.v1 (source candidate; not qualified)
+
+REQ-SQLC-006 / AC-SQLC-006 SQLC-READ and REQ/AC-QUERY-004/005/006, ADR-065: a Boolean field, scalar Boolean parameter or TRUE/FALSE/NULL operand may be a complete WHERE predicate and may participate in NOT/AND/OR/grouping. Lower it to the existing Comparison(value, equals, true) AST. Native null/missing three-valued semantics remain: NOT NULL and NOT missing do not admit a row; do not lower bare NOT to IS NOT TRUE. Non-Boolean retained values refuse the existing Validation diagnostic; no numeric/string truth coercion. Only existing end, group, logical, ORDER and bounded LIMIT/OFFSET/FETCH boundaries terminate a bare operand; incomplete comparison, missing parameter, malformed predicate and unsupported operators retain their existing safe diagnostic contract. No AST/version/serializer/protocol/library, policy/read-cut, deadline or resource-limit changes.
+
+Preserve original SqlBooleanTruth Unit and Aspire RF3 declarations/Args/UIDs. Extend their genuine native whole flows with independently authored full SQL/AST rows for bare and negated fields, TRUE/FALSE/NULL, grouped/logical predicates and real Boolean true/false/null parameters; SDK and official MCP plus Npgsql simple/prepared execute the same complete results. Malformed refusal must be followed by a healthy request on the original native connection. Original persisted query-permission denial/restoration, retained scalar-type fault and exact revision3 repair, original cancellation token, seed/fault/repair receipt replay, full native store image/position/identity and public document/outbox image, warm and two owned cold waves remain mandatory. Query cuts remain opaque publicly. Source/native admission, compilation, runtime, Linux RF3/recovery/resource, physical-owner correlation and full SQL/client compatibility gates remain OPEN until actual evidence.
+
+
+### SQL.NumericDigitSeparators.v1 — source candidate, qualification OPEN
+
+REQ-SQLC-006 / AC-SQLC-006 SQLC-LEX/READ and REQ/AC-QUERY-004/005/006 under ADR-065: bounded decimal mantissa/exponent and binary/octal/hexadecimal integer digit groups may contain one underscore between valid digits. One underscore directly after a radix prefix is accepted, including adjacent existing signs. Separators cannot be repeated, trailing, adjacent to decimal point/exponent/sign, or separate invalid base digits. Normalize only for the original native decimal/radix value parsing; preserve raw SqlToken.Text and source spelling. The private nullable NumericText token value is ephemeral parser metadata, not public JSON, persistence or an AST/version/serializer change. Original lex bytes/source-token count, native read/deadline/cancellation cadence, decimal.MaxValue/MinValue domain, fixed safe errors, field authority and canonical ValueOperand remain unchanged. The one exact normalized string is allocated only for a token containing separators; normalized characters never exceed raw token characters. Both bounded passes check the original read budget and cadence. No package, provider, deadline or limit changes.
+
+LIMIT/OFFSET/FETCH retain original unsigned Int32 NumberStyles.None parsing and original limit-plus-offset validation. Grouped decimal counts are supported; signs, radix, fractions, exponents and Int32 overflow remain Validation, even if numerically integral. Duplicate or mixed trailing clauses retain the original UnsupportedCapability contract. Non-decimal fractional forms and invalid trailing base digits remain UnsupportedCapability where the original lexer/parser already defines them; malformed separator groups refuse the existing fixed Validation diagnostic. Ordinary identifiers, quoted strings, parameters, unsupported operators and all other original diagnostics remain unchanged. This is a defined product subset, not full PostgreSQL numeric type/coercion or full SQL compatibility.
+
+The formerly unsupported 0x1_0, 0b1_0 and 0o1_0 now have independent complete SQL/AST literal results (16, 2 and 8 respectively) inside the original whole-flow cases. Their unsupported fraction successors 0x1_0.0, 0b1_0.0 and 0o1_0.0 retain explicit refusal/no-effects/same-connection healthy controls. No original native whole-class declaration, Args or UID is retired or filtered away. Original native/Aspire owners, literal rows/revisions/refs/access paths, persisted policy denial and exact epoch restoration, real scalar-type fault and revision3 repair, original fault/repair GUID receipt replay, original canceled token and independent healthy token, full native image/position/identity and caller-visible public image, warm and two original joined cold waves remain required.
+
+Original SqlNullDistinct Unit/RF3 cases execute complete decimal/radix maxima and signed/grouped mantissa/exponent rows, malformed/count-overflow and unsupported refusals followed by healthy SDK/official MCP/Npgsql on the original wire owner. Original SqlOffset pages execute grouped windows with independent scalar/Q2 AST pages and original signed continuation. Native-session Q1/Q2 parity runs grouped constant predicates and genuine SDK/MCP/Npgsql positional parameter values, simple and prepared; scalar parameter SQL/AST and grouped count pages repeat across warm/two cold. Original primary/cleanup observers and fixture ownership remain unchanged. Public cuts remain opaque; exact physical-owner correlation, admitted row-progress cancellation, resource/performance/fault/endurance and Linux RF3 qualification stay OPEN. No source/native preview/compilation/runtime result is inferred from this candidate.
+
+### NEXT bounded Unicode delimited identifiers
+
+AC-SQLC-006 SQLC-LEX; REQ/AC-QUERY-004/005/006; ADR065. U& escaped double-quoted identifiers decode using existing bounded Unicode codec and optional original ASCII-only UESCAPE, then canonical Identifier Quoted=true. Existing field/source/projection alias validation remains authoritative: no identifier alphabet/length/case/authorization widening or PG truncation promise. Double quotes double themselves; newline-adjacent identifiers never concatenate. Quoted decoded keywords never become grammar. Existing raw SQL byte/token/depth/read/cancel budgets retained; UESCAPE tokens charged through original helper. No AST/version/library/serializer/deadline change. Native compilation/runtime/fault/resource/Linux/full SQL/physical owner gates OPEN. Q2 literal source-alias proof also preserves existing REQ-QUERY-007 / AC-QUERY-007-JOIN-001/002 and AC-REL-004-JOIN contracts. Original whole Unit and Aspire RF3 SDK/official MCP/Npgsql simple/prepared flows require independent full scalar and typed Q2 SQL/AST pages, real external parameter, malformed same-owner refusal→healthy continuation, current policy denial/restore, true retained type fault/repair/original receipt replay, original-token cancellation and two existing owned cold waves. Unit retains complete raw image/position/identity; public pages retain complete document/outbox and seed/fault/repair receipts. Public cuts remain opaque; compiler/runtime/Linux/resource/fault/physical-owner gates remain OPEN.
@@ -0,0 +1,30 @@
+# Persisted principal revocation across public multipart reads and cold ownership
+
+Canonical BlobStorage REQ/AC-BLOB-002/003/004. Acceptance code qualification is pending. This whole-flow differs from warm BlobRead scope removal and API-key revocation: the persisted PRINCIPAL is revoked while the unchanged key and grants remain.
+
+REQ-R44-BLOB-PRINCIPAL-001 / AC-R44-BLOB-PRINCIPAL-001: publish two genuine parts (65536+17 bytes) with independently fixed byte(position)=(position*13+5)%241, literal raw-part SHA256 and independent 72-byte integrity chain from authentic Begin seed. Prepublication SDK/officialMCP placement independently binds full original Begin/Parts/Complete receipts (command/partition/incarnation/epoch/quorum/positive position/EMPTY mutations), complete metadata and current upload. A persisted BlobRead principal at epoch1 reads full typed metadata, first4, boundary65534/count6, tail65536/count17 and EOF65553/count0 through both genuine public sessions.
+
+REQ-R44-BLOB-PRINCIPAL-002 / AC-R44-BLOB-PRINCIPAL-002: persist the same COMPLETE principal with Revoked=true and PolicyEpoch2, preserving original grants/owner/key. The original live SDK metadata and each legal range return full independently native Unauthenticated Problem/no value; each original officialMCP operation fails HTTP401. Each individual result is immediately followed by independent administrator full metadata/range/upload/list/placement/outbox observation. These are public current observations, not one raw canonical/journal cut or no-append evidence.
+
+REQ-R44-BLOB-PRINCIPAL-003 / AC-R44-BLOB-PRINCIPAL-003: join original callers, then genuine all-three cold restart. A fresh owned SDK still refuses every metadata/range request. Actual officialSDK initialization with that key must fail HTTP401. This is TRANSPORT AUTHENTICATION ADMISSION refusal, not a fabricated range-tool dispatch or typed MCP error envelope; no claim of executing a range operation before initialization. Unexpected successful initialization must be disposed and must fail the test. Observe complete independent administrator state/outbox after that admission refusal.
+
+REQ-R44-BLOB-PRINCIPAL-004 / AC-R44-BLOB-PRINCIPAL-004: persist full original principal with Revoked=false and PolicyEpoch3, then fresh SDK/officialMCP callers must read all independently literal full pages. Replay each original administrator publication DTO through EACH route followed immediately by full current observer. Join callers before a second genuine all-three cold cycle; fresh callers retain identical bytes/metadata/full original results and current authorization. Original deadline and ordered body/disposal/restart failures remain; no clocks, sleeps, fallback, provider, library or API change.
+
+Canonical roles: existing BlobReadPolicyPublicTests Case retains original Trial first; new BlobStorage Models/BlobPrincipalRevokedR44State, Helpers/BlobPrincipalRevokedR44{Corpus,Seed,Publication,Trial,Policy,Replay}, Assertions/BlobPrincipalRevokedR44{Pages,Refusals}. UI/product/contracts N/A; acceptance-only original API composition. Original published time/Begin expiry/seed are authentic retained opaque producer metadata, not predicted caller time. Complete literal content and receipt authority are independent; current server outcome bytes are never normalized.
+
+```mermaid
+flowchart LR
+ A[Independent two-part publication and reader healthy] --> R[Same principal revoked epoch2]
+ R --> D[Each live route HTTP authentication refusal and current observation]
+ D --> J[Join callers then all3 cold]
+ J --> I[SDK refuses and official SDK initialization401]
+ I --> P[Full principal repaired epoch3]
+ P --> H[Fresh full literal reads and each original receipt replay]
+ H --> C[Join callers second all3 cold and full healthy controls]
+```
+
+Coverage distinction: PublicReadPolicy scope removal is warm-only; BlobRangePolicyCold is native kernel-only; CredentialAuthorityFlow changes API-key revocation/expiry and repairs before cold. No existing public multipart principal-revoked cold flow is reused as qualification. Compiler, original UID, runtime and Linux RF3 remain pending.
+
+Full receipt mutation vectors are independently EMPTY under the native BlobStorageOperations.Result constructor. Exact SDK credential denial detail is `The credential is unavailable or expired.`: owning credential validation throws Unauthenticated; original node executor forwards reply.Error/SafeDetail; HTTP middleware constructs the canonical full Errors.Problem. Warm MCP operations and cold Initialize refusals are HTTP authentication admission errors, not a typed tool Problem.
+
+The implementation preserves the complete administrator current observer after every individual reader/replay response (14 public calls: metadata2, full legal chunks4, upload2, list2, outbox2, placement2). These repeated controls remain bounded by the original test-owned cancellation token; completion within that original budget is not yet qualified. No new timeout. New type absence, existing Case native checkOnly, whole new creation checkOnly, compiler and Linux RF3 execution remain pending under the closed native boundary.