@@ -90,3 +90,7 @@ Corrected fresh command retains original PATCH and inserts third/namegamma under
 Join original store, same-directory native reopen with original validated options and configured factory, exact NodeId/incarnation/nondecreasing ReadGeneration/full native bytes/physical cut. Reuse both exact original commands/time: old failed result and healthy full receipt remain byte-equal without new domain effects/outcome writes. Full typed SQL indexed rows remain independently literal. Then genuine revision3→4 PATCH of second count2→3 proves cold write health and produces new independent patchDocument receipt, original new-ID replay and complete final SQL rows/outbox horizon; cold store joins before original fixture cleanup. Retain initiating and cleanup failures with original observer/lexical store ownership.
 
 No product/API/serializer/format/limits/deadline/trust/provider change; no migration/fallback/source-oracle expectation. Core atomic gate remains authoritative. Native checkOnly + pernewpath NS/reconstruction are source only. Exact original Unit method/UID/deadline unchanged; required normal SIMD native50 compilation/formatter/analyzers/fresh discovery/runtime and Linux/process/RF3/coverage gates remain OPEN.
+
+## Q2 retained primary identity observation
+
+Existing nonnullable Text primary-key equality with EntityRef.Id also applies to actually observed readable nondeleted retained rows in the bounded Q2 read operator. This is the same frozen canonical identity, not schema evolution or a new constraint. Check left JSON identity before left-predicate elimination and right JSON identity before bounded candidate retention. Preserve deletion/row-ACL omission and do not inspect a right row skipped by a valid false left predicate. Native key/reference checks, ordered apply ownership, per-operation persisted permissions, read cut, budgets and cancellation remain unchanged. Existing closed Corruption identifies inconsistent retained identity. Syntactically malformed retained JSON is converted only at this bounded retained-row parser from JsonException into the same Corruption; valid non-object JSON fails the identity guard. Generic public admission/serialization failure mapping is unchanged. Independent real raw-fault/repair/GUID replay/cold operations qualify this finite rule. Source implementation joined; compiler/runtime pending and no new format/protocol or performance/qualification claim.
@@ -2041,19 +2041,25 @@ A fixture operation recorded by ServerFailureObserver is an original initiating
 
 ### TASK-OWNER-REGISTER-SUCCESS-POLICY-REPLAY-001
 
-REQ/AC-OWNER-REGISTER-001 requires current persisted authority even for a previously successful owner-registration receipt. Through ordinary authorized ConfigurePrincipal, establish a distinct administrator at policy1, issue its genuine native registration with original GUID/body/evaluated instant, and retain the complete successful stored outcome and literal two-owner directory. Revoke only that administrator flag at policy2. The original GUID must return exact PermissionDenied / "The principal policy changed since this command was evaluated.", without returning the old success, rewriting its policy1 outcome, or changing the complete canonical image/cut. A first same-root cold reopen preserves the literal revoked principal, original successful outcome, catalog/directory and exact no-effect replay refusal. A new registration GUID under that revoked principal returns the independent exact PermissionDenied / "Cluster administration is required." stored at policy2; only its original outcome may be added.
+REQ/AC-OWNER-REGISTER-001 requires current persisted authority even for a previously successful owner-registration receipt. Through ordinary authorized ConfigurePrincipal, establish a distinct administrator at policy1, issue its genuine native registration with original GUID/body/evaluated instant, and retain the complete successful stored outcome and literal two-owner directory. Revoke only that administrator flag at policy2. The original GUID must return exact PermissionDenied / "Cluster administration is required." at fresh administrator admission before cached-outcome selection, without returning the old success, rewriting its policy1 outcome, or changing the complete canonical image/cut. A first same-root cold reopen preserves the literal revoked principal, original successful outcome, catalog/directory and exact no-effect replay refusal. A new registration GUID under that revoked principal returns the independent exact PermissionDenied / "Cluster administration is required." stored at policy2; only its original outcome and the canonical clock for that operation's real recorded EvaluatedAt may change.
 
-Regrant administration through the same canonical operation at policy3. Neither the old successful GUID nor the policy2 denied GUID becomes a current success or has its immutable outcome rewritten. A fresh current-authorized GUID with the exact already registered owner and current directory revision succeeds without replacing entries or advancing directory revision; retain the same original native result and its distinct policy3 outcome. A second real cold reopen retains the complete image/cut, all three original stored outcomes and their policy epochs, exact policy refusals and byte-exact fresh successful replay. Finish with an independent healthy current-authorized registration continuation, exact outcome-only effect and unchanged catalog/directory. Preserve joined original body, constructor and disposal failures. PhysicalOwnerRegistrationPolicyReplayTests is disjoint local native storage support, not an invented public unregister/update API, a proven product defect or KL035 snapshot/RF3/Linux qualification.
+Regrant administration through the same canonical operation at policy3. Neither the old successful GUID nor the policy2 denied GUID becomes a current success or has its immutable outcome rewritten. A fresh current-authorized GUID with the exact already registered owner and current directory revision succeeds without replacing entries or advancing directory revision; retain the same original native result, its distinct policy3 outcome and exact canonical clock at the real recorded native EvaluatedAt. A second real cold reopen retains the complete image/cut, all three original stored outcomes and their policy epochs, exact policy refusals and byte-exact fresh successful replay. Finish with an independent healthy current-authorized registration continuation, exact outcome plus recorded-EvaluatedAt clock effect and unchanged catalog/directory. Preserve joined original body, constructor and disposal failures. PhysicalOwnerRegistrationPolicyReplayTests is disjoint local native storage support, not an invented public unregister/update API, a proven product defect or KL035 snapshot/RF3/Linux qualification.
 
 
 ### TASK-OWNER-REGISTER-IDENTITY-OUTCOME-001
 
-REQ/AC-OWNER-REGISTER-001 retains the immutable identity of each registered physical owner. After a genuine native two-owner registration, a fresh RegisterPhysicalOwner command with the current directory revision and the same destination physical shard but a different valid incarnation must return exact Conflict / "The registered physical owner identity conflicts with its existing entry.". Its original stored outcome is the only added canonical record; the catalog and complete literal directory remain unchanged. Reopen the same physical owner, require byte-exact original refusal/outcome and registration replay, then submit corrected content under the refused GUID and require exact command-identity Conflict without replacing that original outcome or changing the complete cold image/cut.
+REQ/AC-OWNER-REGISTER-001 retains the immutable identity of each registered physical owner. After a genuine native two-owner registration, a fresh RegisterPhysicalOwner command with the current directory revision and the same destination physical shard but a different valid incarnation must return exact Conflict / "The registered physical owner identity conflicts with its existing entry.". Its original stored outcome is the only added canonical record; the canonical clock must exactly equal that native operation's recorded EvaluatedAt; the catalog and complete literal directory remain unchanged. Reopen the same physical owner, require byte-exact original refusal/outcome and registration replay, then submit corrected content under the refused GUID and require exact command-identity Conflict without replacing that original outcome or changing the complete cold image/cut.
 
-A new command GUID with the exact registered owner and current revision succeeds without incrementing directory revision, replacing entries or changing catalog bytes. Require the same native result as the original registration, only its new outcome added, a second cold owner with the complete retained image/cut, exact original registration/refusal/new success receipt replay and an independent healthy continuation. Preserve both initiating and fixture disposal failures in the joined native ledger. This disjoint PhysicalOwnerRegistrationIdentityOutcomeTests case is local native storage support; it neither proves a product defect nor qualifies RF3 startup or Linux acceptance. No new authority, wire contract, fallback, deadline or retry is introduced.
+A new command GUID with the exact registered owner and current revision succeeds without incrementing directory revision, replacing entries or changing catalog bytes. Require the same native result as the original registration, only its new outcome and the canonical clock at its real recorded EvaluatedAt changed, a second cold owner with the complete retained image/cut, exact original registration/refusal/new success receipt replay and an independent healthy continuation. Preserve both initiating and fixture disposal failures in the joined native ledger. This disjoint PhysicalOwnerRegistrationIdentityOutcomeTests case is local native storage support; it neither proves a product defect nor qualifies RF3 startup or Linux acceptance. No new authority, wire contract, fallback, deadline or retry is introduced.
 
 ### TASK-OWNER-DIRECTORY-READ-PERMISSION-FIRST-001
 
 REQ/AC-OWNER-REGISTER-001 preserves fresh persisted administrator authorization before physical-owner metadata is exposed. The genuine read flow must register the canonical two-owner directory, prove the exact literal result for a persisted administrator, then remove only that principal's ClusterAdministrator permission through the ordinary authorized ConfigurePrincipal operation. With a generated-native structurally valid directory whose ControlOwner selects the genuine destination instead of the committed catalog default, that principal still receives exact PermissionDenied / "Cluster administration is required.", while the root administrator receives exact Corruption / "The physical owner directory does not match the control authority.". Both reads retain the complete canonical image and cut. Native reopen must preserve those same refusals and bytes.
 
 Restore the exact original directory bytes, prove the revoked principal still denied and root literal read healthy without read effects, then grant fresh persisted administration through the same canonical operation. Require the exact literal directory, unchanged original registration receipt replay, second genuine cold image/cut/replay, exact original catalog and directory bytes. No caller roles, synthetic policy, altered error, alternate serializer, owner lookup, protocol or startup path may replace these operations. Original initiating and cleanup failures remain in the joined fixture ledger. The disjoint PhysicalOwnerDirectoryReadAuthorityFlowTests case complements the existing two registration cases; it does not claim a product defect, RF3 startup or Linux qualification. Fresh coherent native census binds its source declaration only after Root builds; no native UID is inferred from source.
+
+### TASK-OWNER-REGISTER-CAPACITY-OUTCOME-001
+
+REQ/AC-OWNER-REGISTER-001 retains the existing bounded two-owner directory. After a native canonical registration of the existing control and destination tuples, a fresh current-revision command with a distinct valid physical shard and incarnation, retaining the existing destination's valid voter/endpoint shape, must return exact BudgetExceeded / "The physical owner directory is full.". This is a refused metadata attempt, never a registered third group or a started substitute host. Only the original global outcome may be added and the canonical clock must equal that operation's real recorded EvaluatedAt; catalog, literal directory and all other canonical records remain unchanged.
+
+The complete original refusal/outcome and registration success replay survive a first same-root cold reopen. Correct existing-owner content under that refused GUID returns the exact command-content Conflict without replacing its stored capacity refusal. A fresh authorized GUID for the exact existing destination and current revision succeeds before capacity admission, without adding an owner or advancing directory revision. Require byte-exact original successful result, exact outcome plus recorded-EvaluatedAt clock effects, a second complete cold image/cut, original refusal/success receipt replay and an independent healthy existing-owner continuation. Retain initiating and disposal failures through the original joined fixture ledger. PhysicalOwnerRegistrationCapacityOutcomeTests is local native storage coverage; it adds no public protocol, authority, topology, timeout, retry or Linux/RF3 qualification claim.
@@ -377,3 +377,27 @@ flowchart LR
 ```
 
 Source joined; current-image execution, compiler, native runtime, Linux and public Aspire SDK/MCP qualification remain OPEN. This additional native store case preserves all existing BlobRangeIntegrity whole cases.
+
+
+## TASK-BLOB-RANGE-POLICY-COLD-001 — current persisted principal across partial reads
+
+REQ-BLOB-RANGE-POLICY-COLD-001 refines REQ-BLOB-002/003/004: every native range, including a zero-length range at the exact published end, resolves the current persisted principal inside its own Store.Read. Original BlobAuthorizationTests warm metadata/row/creator checks remain unchanged. This additional native ZoneTree kernel flow does not qualify public authentication, native replica admission, process kill or RF3.
+
+AC-BLOB-RANGE-POLICY-COLD-001 maps to BlobRangePolicyColdTests.AcBlob003RevokedRangeRemainsDeniedColdThenRestoredPolicyReadsExactVersion: publish the genuine existing two-part object and original receipts, persist a separate authorized BlobRead principal at epoch1, prove literal cross-part/zero ranges and full image invariance, then authorized ConfigurePrincipal epoch2 Revoked. Repeated exact Unauthenticated/safe-detail refusals preserve the complete image and cut AFTER that actual policy commit. Join the store and reopen the same root; repeat exact refusal and complete damaged-policy image/cut equality. A denied read creates no StoredOutcome; it is not a retained issued command failure.
+
+AC-BLOB-RANGE-POLICY-COLD-002 requires a genuine authorized ConfigurePrincipal restore at epoch3 with exact returned principal and actual +1 commit position, literal original range/metadata and no-effect parity, original root publication receipts/result replay, and a second joined same-root cold owner with complete raw image/cut equality and exact healthy byte continuation. All body and owner disposal failures retain their ordered original ledger. No old successful reader command outcome is expected to replay across changed policy epochs; publication belongs to the unchanged original root principal.
+
+```mermaid
+flowchart LR
+  P[Actual multipart publication and persisted reader epoch1] --> H[Exact healthy ranges]
+  H --> R[Actual revoked principal epoch2]
+  R --> D[Repeated read refusal and post-policy unchanged image]
+  D --> C[Joined close and first cold refusal]
+  C --> A[Authorized restore epoch3]
+  A --> B[Exact ranges and original root receipt replay]
+  B --> S[Second joined cold image and healthy parity]
+```
+
+Source joined; compiler, current-image native execution, Linux and Aspire public SDK/MCP gates remain OPEN. Actual owning BlobReads.Cut/DatabaseCredentialValidation.ReadPrincipal reload semantics remain unchanged; no production defect is asserted.
+
+Policy writes use actual CreateNativeOperation with unchanged root, actual EvaluationClock and generated ConfigurePrincipalRequest native bytes, then owning DatabaseEngine.Apply. Caller cancellation is checked before this synchronous operation; this is not async cancellation or a native replica-issued journal claim.