@@ -77,7 +77,7 @@ That's what we're building: **one place for context, one place for the work that
 
 | Plan tasks | Accepted | In progress |
 |---|---|---|
-| **105** | **18** | **87** |
+| **105** | **19** | **86** |
 
 ```mermaid
 flowchart LR
 
@@ -67,3 +67,14 @@ flowchart TD
 ```
 
 REQ-REP-SUBMIT-011 / AC-REP-SUBMIT-011: never perform the ordinary refusal extension's source-fence read before the original fresh same-view native authority attempt. Catch only the allowed actual PermissionDenied code using a scalar exception filter, then determine ordinary eligibility inside the catch body after CaptureRetiredOriginalOutcomeReadScope/AuthorizeOperation actually refused. Preserve original capability-before-fence order. Ineligible operations rethrow the same original denial; unexpected and fatal native predicate/decode/storage failures propagate rather than being discarded by CLR filter evaluation. The extension admits only the complete exact actual durable denial proof defined above. Normal authorized reads and public strict defaultfalse incur no new fence lookup from this extension. The original four and three added complete native flows remain unchanged; elected-leader malformed-metadata/privacy concurrency and real RF3 gates stay OPEN.
+
+
+## Current ordinary-document authority before append, 2026-10-12
+
+REQ-REP-SUBMIT-012: for an eligible ordinary document Batch, propagate the original current Principal `Unauthenticated` refusal before metadata selection and before the append boundary. This refines the advisory fallthrough in REQ-REP-SUBMIT-009 only for missing, revoked or expired current persisted principals. It matches the existing no-outcome contract of `SignedWriteReloadsPersistedRevocationBeforeCommit`; active-principal first `PermissionDenied` remains durably appended, and unsupported shape, movement, ownership and specialized paths retain their original handling.
+
+AC-REP-SUBMIT-012 maps to REQ-REP-SUBMIT-012: unchanged genuine SDK and official MCP requests held at AuthorizationReload must observe the actual persisted revocation, return exact Unauthenticated with no database effect or failed outcome, and retain their original joined lifetime and healthy continuation. The existing native signed-write revocation case remains required. The original R24 held-request failures establish a swallowed pre-admission refusal followed by a post-append principal reload; no client error remapping or relaxed terminal proof qualifies the repair.
+
+REQ-REP-SUBMIT-013: after the same-view original current principal and full operation authorization actually return PermissionDenied, a private advisory lookup may select only that same principal/command/canonical scope. A changed fingerprint may trigger a pre-append rethrow of the freshly computed refusal only when the retained record passes canonical scope/locator, current policy/incarnation and exact failed-result checks: the same PermissionDenied and safe detail, null JSON/native value and all five null authority members. Never return that retained record as the incoming outcome, expose its existence/content, or relax the strict terminal fingerprint validator. Missing, matching, stale, malformed or unsupported evidence declines the advisory check; original first-denial caching, same-body denied replay, authorized changed-body Conflict and specialized/ownership behavior remain unchanged.
+
+AC-REP-SUBMIT-013 maps to REQ-REP-SUBMIT-013: a separate genuine ReplicaSubmissionOutcomeFlow case must retain the full first failed receipt and canonical/journal bytes, prove unchanged matching replay, changed-body current denial before append with a complete unchanged cut, exact original denied replay, and fresh healthy continuation after policy restore plus authorized changed-body Conflict. The unchanged CrossTenant public SDK/MCP whole flow remains mandatory. Original R24 changed-body retry reached a strict mismatch after append; current-authority refusal must occur before that boundary. No new persisted/public schema, alias, quota, result provenance or provider is introduced. Compiler, native TUnit, real elected-leader SDK/MCP/RF3, cold/privacy and source qualification remain OPEN.
@@ -835,3 +835,27 @@ REQ-CRS-WITNESS-OWNERSHIP-001 / AC-CRS-WITNESS-OWNERSHIP-001: RequestCqrsProbeRe
 REQ-CRS-WITNESS-OWNERSHIP-002 / AC-CRS-WITNESS-OWNERSHIP-002: RequestCqrsProbeSnapshotFiles owns native directory/owner-byte validation, bounded file enumeration and checked record/aggregate-byte admission. RequestCqrsProbeFiles retains the original synchronization gate, ordered per-entry read and cross-record validation/commit sequence. Admission occurs before reading each witness, with identical regular-file, private-mode, known-name and byte limits; extraction adds no per-read inventory object or retained storage owner. TwoRf3MembershipWaveFactory creates the existing genuine six-owner profiles through the same readiness and joined shutdown path. Constructor flags, callbacks, limits, connection ownership and cold-root operations are unchanged.
 
 The current AcCrs004 codecs/private-files flows, query/read-cut and WaitForIndex witness flows, producer cleanup, remote ANN publication and RF3 membership/cold flows remain the automated contract. Native source preview and a code-line estimate establish source preparation only. Full compiler/analyzer, native TUnit, actual Aspire SDK/MCP RF3 and exact-source Linux qualification remain open until their original results are recorded.
+
+### TASK-MOVE-NATIVE-ISSUER-OBSERVATION-001 — original native refusal witness
+
+REQ-MOVE-NATIVE-ISSUER-OBSERVATION-001: An optional internal observer is registered by the actual native host fixture through ServerConfiguration.Build, borrowed by the existing OrleansNode native constructor and forwarded by PartitionMovementRuntime.Initialize to its same silo-owned PartitionMovementNativeReceiver. The normal product path has no registered observer and creates no observation scope. The test arms only its original outer nonce and configured receiving Control voter. Actual admission, outer MAC, caller identity/active state, native caller discovery body/voter/MAC/contracts, expiry/replay, inner dispatch and outer signing advance a closed stage on the same original call. One immutable terminal observation after the original runtime call joins records that stage, original ErrorCode and authenticated/dispatched flags; a later runtime failure has its distinct RuntimeCompletion boundary. Escaping exceptions retain their original object and propagation, and observer failures join that original ledger. The observer cannot authorize, duplicate authentication, redispatch, retry or change an existing wire, MAC byte, error, deadline or storage effect.
+
+AC-MOVE-NATIVE-ISSUER-OBSERVATION-001: The unchanged ControlledPartitionMovementNativeHostLifetimeTests and ControlledPartitionMovementNativeProcessTests whole flows retain original bad16 InvalidProof and outer-signed bad64 Unauthenticated/Unavailable with null InvalidReplyStage, before/after complete canonical images, genuine Prepare, same-root cold receipt/replay and healthy continuation. The actual fixture joins exactly one terminal witness per armed original nonce/voter, reports only nonce, closed stage, enum error, matching-voter boolean and authenticated/dispatched booleans, and joins missing/duplicate observer failures with the same original assertion and cleanup ledger. Payloads, signatures, credentials, private endpoints and free-form exception text are excluded. Recovery13 retains its native census UIDs and native50 route; original discovery/disposed-owner/ownership and five persisted CommitStage full flows remain controls.
+
+The coherent R24 development run has stable source and target DLL/PDB closure, eleven passing originals and two outer-signature-length failures during Warm. It does not identify an issuer rejection cause or prove this observer changes behavior. Fresh compiled execution and exact-source Linux qualification remain open.
+
+```mermaid
+flowchart LR
+  Arm[Fixture original nonce and Control voter] --> Owned[Same native receiver call]
+  Owned --> Boundary[Closed original admission or dispatch boundary]
+  Boundary --> Witness[One terminal enum witness]
+  Witness --> Ledger[Original assertion and joined cleanup ledger]
+```
+
+### TASK-MOVE-NATIVE-COMPLETED-FAULT-CLEANUP-001 — retained original shutdown ownership
+
+REQ-MOVE-NATIVE-COMPLETED-FAULT-CLEANUP-001: ControlledPartitionMovementNativeHost retains the actual memoized OrleansNode.StopAsync(None) task and applies its unchanged original shutdown deadline only to WaitAsync. A canceled wait proxy is not the original owner task. Existing native application and Partition disposal may continue after a completed original task, including a fault, only when HasJoinedRequestWork is true and the existing Silo.Discovery getter proves the native host was released. Observe this getter through the existing failure ledger. An incomplete original stop, unjoined request work or unreleased native host still refuses storage cleanup and cannot qualify joined shutdown.
+
+Owner invariants: OrleansNode.StopCoreAsync awaits native model discovery lifetimes, blob callback lifetime, movement/remote-document/graph owners and physical registration/probe work. Its existing request-work guard precedes native host shutdown. OrleansNodeHostShutdown.JoinAsync records original native IHost.StopAsync errors, closes scheduling/discovery, awaits consensus stop, clears the native host and awaits native host disposal; request work is disposed before the original ledger throws. ReplicaDiscoveryLifetime awaits its actual drained task before disposal. PartitionHost.DisposeAsync owns coordinator/consensus/materializer joins before journal and store close. The fixture retains both original shutdown and subsequent native Dispose/HTTP/Partition errors; it adds no force-dispose API, retry, timeout increase or error suppression.
+
+AC-MOVE-NATIVE-COMPLETED-FAULT-CLEANUP-001: Preserve the same original six-owner HostLifetime cancellation/stop/cold/replay and NativeProcess Prepare/kill/cold/healthy declarations, canonical images and receipts, exact original deadlines, all process/output/error/disposal joins and every failure. Verify actual completed-fault cleanup only with a genuine native original-stop failure that reaches host release and request join, then prove HTTP/Partition closure and exclusive owner-lock release while retaining the primary fault. No existing deterministic native completed-fault stop arm is established; this subcase remains an explicit qualification gap rather than a fake host or synthetic task test. Coherent R24 did not reproduce the earlier mixed-image canceled-proxy/owner.lock aggregate; this change does not claim that historical cause repaired.
@@ -1266,3 +1266,21 @@ flowchart LR
 ### TASK-MSG-READY-REPAIRED-RECEIVE-REPLAY-001
 
 REQ/AC-MSG-001/004/005 and ADR-026 require the same original failed committed Receive, after exact fault-owned row repair and joined materializer recovery, to retain its complete successful native ReceiveResult on same-command replay without another lease, expiry or journal effect. Extend the original eight QueueReadyAuthorityTests arguments only: capture full native result bytes, entire canonical image, identity, position and journal cut immediately after successful recovered Receive, replay that identical retained signed operation, require all bytes and cuts unchanged, then retain every independent original delivery/empty expiry literal, Processing receipt/document/inbox/counter and fresh healthy processing assertion. The generic empty/multi-queue receive replay cases remain distinct from this failed-owner recovery boundary. No new UID, clock, timeout, policy, default, effect or product contract is introduced. Native semantic preview is source preparation; fresh matched-image compilation and full operations remain OPEN for this private successor.
+
+
+## TASK-KL087-COLD-COMMAND-CONTENT-001 — original identity content fences and terminal continuation
+
+REQ/AC-MSG-001/004/005 under ADR-026: deepen the existing `QueueLostResponseWholeFlowTests.AcMsg001ClaimAndAckResponsesReplayExactlyAcrossRealStoreReopen` complete operation. After the first same-root cold open, change only LeaseSeconds on the same original Receive RequestId; require exact Conflict, null successful JSON/native value, complete unchanged native store bytes, position and identity, repeat the same refusal, then replay the complete original ReceiveResult. After genuine input ACK and the second same-root cold open, change only Action to Renew on the same original ACK CommandId; require the same full refusal/no-effect controls before complete original ACK receipt replay. Never create a new command ID to stand in for these conflicts.
+
+Preserve every original delivery/token/lease/payload/header/replay assertion. Genuinely ACK the healthy message, require independently literal complete Acked MessageInspection metadata for input and healthy (versions3, attempts1, lease versions1, generations1, original ready sequences1 and2, cleared lease, absent bodies/headers), then join/reopen the same native store a third time. Compare complete store bytes/position/identity, replay both original complete ACK results without effects, and execute a fresh empty Receive while preserving both terminal inspections. Existing fixture lifetime, clock, limits, identities and native50 scheduling remain unchanged. This adds no product or persisted format seam and does not claim a real lost socket response.
+
+Source-only stage: no new case UID or count is inferred; the existing case and all original corpus/history remain mandatory. Fresh shared Release, native census/source/DLL/PDB binding, original Unit/process results and Linux SDK/official MCP RF3 acceptance remain open; previews or edits are not runtime qualification.
+
+
+## TASK-KL092-DUE-BODY-AUTHORITY-001 — canonical body identity before due transitions
+
+REQ/AC-MSG-004 and REQ/AC-MSG-092-DEADLINE under ADR-026/028: the existing bounded `DatabaseEngine.ApplyDueEntry` MUST require the actual stored MessageBody.Id to match its selected scheduled/lease index identifier before deleting a reference or changing counters, order, metadata or body storage. Foreign embedded identity raises the existing closed Corruption/MissingIndexedBody failure and aborts the complete atomic operation. Existing metadata/key/due authority checks, signed operation, fresh permissions and quotas remain exact. This is a native KeyLoad invariant, not a provider workaround or new storage format.
+
+The additive `QueueDeadlineNativeWholeFlowTests.ForeignNativeDueBodyIdentityRefusesWholeOperationThenExactRepairColdReplayAndHealthyAck` declares original PromoteScheduled/ExpireLease × explicit deadline Batch/ordinary Receive sweep controls. Each uses genuine producer and scheduled/lease predecessors, damages only the native body identifier while retaining the complete original row, and repeats the same normalized original operation with exact Corruption detail and unchanged complete store bytes/position/identity before and after a same-root cold open. Restore only the owned original row, require complete pre-corruption row image equality, then commit and replay the same original operation. Independently literal metadata, payload/headers, actual delivery/token and genuine ACK precede a second cold image and complete original ACK/producer replay, followed by real healthy enqueue/claim/ACK. The original deadline, signed-jitter, process and RF3 cases remain mandatory and unchanged.
+
+Source-only declarations do not establish native UIDs or runtime counts. Fresh shared Release, native census and source/DLL/PDB identity, original Unit/process results and Linux public RF3 qualification remain open; no Corruption is converted into an ordinary successful receipt, hidden retry, metadata repair or alternate clock.
@@ -0,0 +1,11 @@
+# Native queue delivery receipts and current persisted policy
+
+TASK-KL087-CURRENT-DELIVERY-POLICY-RF3-001 maps REQ-MSG-001/004/005 and AC-MSG-001/004/005, ADR-026 and the current CommandOutcomes policy fence. The existing renew/reclaim flow proves foreign and stale delivery fences; this separate genuine six-silo flow proves current persisted authority for retained delivery receipts. It does not modify product transitions or classify lease expiry from permission refusal.
+
+REQ-QUEUE-POLICY-001: persist the actual epoch-1 worker and credential, claim the literal message, renew and ACK through existing SDK, official MCP and shared SQL routes, retaining full original receipts. An actual epoch-2 policy update removes QueueAck and QueueRenew while preserving inspect/consume. Old successful Renew/ACK identities and fresh delivery identities must return PermissionDenied before lease-state access. Capture complete stopped all-six canonical and journal state after the real policy commit and denials. Cold repetition of those exact commands under epoch 2 preserves all rows except explicitly proven native membership/apply and exact retained delivery append identities; snapshot-covered proof cannot substitute for retained original journals.
+
+AC-QUEUE-POLICY-001 maps to REQ-QUEUE-POLICY-001: the original public callers must return exact refusal without exposing success or reviving acknowledged messages. Compare full literal acknowledged-body absence, queue counters, future queued sibling, complete receipts and all six owner images. Scope/principal/credential, source term, authorized read cuts and exact command bodies remain genuine. No fake response, clock, role, retry, provider, allowlist or default change is allowed.
+
+REQ-QUEUE-POLICY-002: restore the same persisted worker with the actual returned epoch-3 principal. Epoch-1 successful receipts remain PermissionDenied because their authority epoch differs; restoration does not turn old receipts into current success. New genuine epoch-3 claim/ACK work must succeed, and its exact successful receipts must survive a second cold phase under unchanged epoch-3 authority.
+
+AC-QUEUE-POLICY-002 maps to REQ-QUEUE-POLICY-002: retain the original acknowledged state and queued future sibling across policy changes and cold phases, prove new literal healthy delivery and complete receipt replay, and preserve all canonical/journal cuts except explicit verified append/apply identities. Join every caller before stopping, check all 18 owned file locks, retain fresh signed generations and the original ordered body/shutdown failure ledger. New feature-local Cases, Helpers and Assertions under IntegrationTests/Features/Messaging own the test; shared original renew/reclaim helpers and the independent changed-body Receive/ACK unit case remain unchanged. Native compiler/UID discovery, actual Linux immutable image, RF3 SDK/official MCP/SQL, cold, resource and cleanup qualification gates remain OPEN.