Resolve native restore maintenance policy and advance RF3 fixture epoch

Author: KSemenenko

docs/ADR/ADR-003-durability-ack-barrier.md

@@ -35,6 +35,10 @@ flowchart LR
 
 ## TASK-KL009-NATIVE-APPLY-SCOPE-001 (follower-owner implementation contract, 2026-10-07)
 
+### TASK-KL009-PERSISTED-POLICY-EPOCH-002
+
+REQ-REP-APPLY-SCOPE-001 / AC-REP-APPLY-SCOPE-001 use the linked StorageRecovery fixture preparation contract: genuinely create/assert fresh persisted nonadministrator epoch1, advance that same principal to2 when adding the exact queue grants, and compare its complete returned record before the unchanged whole RF3 fault scenario. The original sourcef80 ConfigurePrincipal RevisionConflict remains immutable. Root freezes the spec, joins only RequestCqrsPhaseFaultProvisioning and CanonicalApplyNetworkData, builds/formats, runs related existing whole operations and delivers for actual current Linux KL009 plus mandatory complete suites. This is an Accepted test-fixture repair, not an Implemented qualification claim. Native authorization, storage, request/replica coordination, all bounds and receipts remain unchanged; rollback removes the coherent two-source amendment only.
+
 REQ-REP-APPLY-SCOPE-001 / AC-REP-APPLY-SCOPE-001 binds original KL009 to a genuine node-local canonical apply owner and real independent replica-network progress. Preserve native ZoneTree, original ordered commit/apply gates, deterministic replay, bounded admission, RF3 acknowledgements and separate authenticated request grains. This is authored acceptance infrastructure; Linux/native execution and original task closure are not claimed.
 
 Docs-first current private-format boundary: all RequestCqrsProbe owner/arm/release/marker producers/readers select version2 and reject version1 without fallback, migration or mixed records. Original request/read phases retain exact original semantics with nullable new arm fields all null and marker EntryIndex/EntryTerm null. CanonicalJournalFlushed is Hold-only and requires complete four-scalar Partition, nonempty SourceRequestId, distinct nonempty SourceArmId and exact TargetVoter. CanonicalOutboundObserved, CanonicalIndependentAppendCompleted and CanonicalOwnerDisposed are unarmable observation-only phases. Canonical markers contain positive real entry index/term and the genuine original request actor ID. Release still addresses the exact arm/request identity. Keep original 32-arm, 400-file, 8-marker, 8192-record-byte, 1048576-aggregate-byte and depth4 ceilings, original component/principal byte bounds, hold/poll/admission/shutdown deadlines and validated configurable lower bounds. No status/receipt is invented.

docs/ADR/ADR-046-storage-private-owners.md

@@ -57,6 +57,10 @@ gates stay open until actually qualified. No production, format, dependency,
 public API or deployment change is permitted by this test-only stage. Rollback
 removes only the added regression.
 
+## TASK-STORAGE-MAINTENANCE-SNAPSHOT-003
+
+REQ-STORAGE-MAINTENANCE-JOIN-003 / AC-STORAGE-MAINTENANCE-SNAPSHOT-005 in StorageRecovery, with BackupRestore REQ/AC-BACKUP-001/002/003, carry the original centrally bound IOptions through the existing restore owner into its private ApplyRestoreAuthorityState and use the canonical ResolveExecutionOptions before native runtime construction. Retain scalar WithExecutionSnapshot and configuration ownership; do not manufacture an execution-side wrapper, suppress KLD0037 or supply defaults. Root owns only the existing restore implementation, preserves per-store overrides/validation/native lifecycle and original failed source47 archive, then builds/formats, executes the genuine original failing class union in both unit profiles and recovery, and joins exact Linux complete suites. No format, public authority, provider, deadline, limit, fallback or maintenance bypass changes. This Accepted private snapshot repair remains unqualified until original native evidence exists. Rollback removes the one-source repair coherently; no original failure or required gate is waived.
+
 ## Decision
 
 Preserve the public ZoneTreeStore facade and every format/caller contract. Compose

docs/Features/BackupRestore.md

@@ -117,6 +117,10 @@ cluster-cut, power-loss, bounded-manifest-memory or performance claim.
 
 `BackupRestoreStagingJoinTests.AcSqlc011AbsentTargetPublishesNativeCutAndPreservesEveryBackupByte` and `AcSqlc011ExistingEmptyTargetPublishesNativeCheckpointAndPreservesEveryBackupByte` each have two trailing-separator cases. Their bodies directly call the native restore API, reopen the target, verify new identity/incarnation, paused dispatch, restored data and exact archive bytes. Map them to REQ-BACKUP-002 / AC-BACKUP-002 and the identity/pause portion of REQ-BACKUP-003 / AC-BACKUP-003 only. They do not exercise SQL, so the source's AC-SQLC-011 label is not an acceptance mapping. The cases do not close the complete cursor/lease fencing and operator reconciliation parts of AC-BACKUP-003. Their original native report rows remain failed-cohort historical evidence until current-source normal/scalar qualification.
 
+### TASK-STORAGE-MAINTENANCE-SNAPSHOT-003: complete restore execution snapshot
+
+REQ/AC-BACKUP-001/002/003 map to StorageRecovery REQ-STORAGE-MAINTENANCE-JOIN-003 / AC-STORAGE-MAINTENANCE-SNAPSHOT-005 and ADR046. The existing restore owner carries its original centrally bound IOptions into ApplyRestoreAuthorityState and invokes the canonical ResolveExecutionOptions before opening the staging runtime; the scalar helper is insufficient for native maintenance. Validation, canonical data, new authority and paused dispatch remain unchanged. Root joins the single owning restore implementation after the linked frozen contract, then verifies all original failed whole backup/restore/CLI/metadata/blob/recovery classes in normal/scalar and exact Linux complete suites. The source47 original51-per-profile unit and2 recovery failures remain immutable. Current qualification is pending; no local fix or isolated property assertion constitutes restore acceptance.
+
 TASK-GENERAL-OPTIONS-RESTORE-INPUT-001 maps REQ-BACKUP-002 / AC-BACKUP-002 to
 `MissingBackupManifestTests`: the real embedded restore normalizes only a missing
 manifest or its directory to the existing `FormatUnsupported` Problem and fixed

docs/Features/StorageRecovery.md

@@ -557,8 +557,24 @@ Operational policy comes from centrally bound/validated `ZoneTreeStorageExecutio
 
 Stage XI native analyzer correction retains the existing REQ/AC contracts: the ephemeral native gate snapshot is exposed as `GateDiagnostics`, and the one-command purge ledger snapshots and validates the existing centrally bound `OperationLimitsOptions`. Limits, observer ordering, byte/scan accounting and authorization remain unchanged. Lowercase digest validation uses the same exact ASCII alphabet through native span classification. Original failed build diagnostics are retained; compilation and whole-operation regressions remain mandatory.
 
+### TASK-STORAGE-MAINTENANCE-SNAPSHOT-003 (frozen before code, 2026-10-09)
+
+REQ-STORAGE-MAINTENANCE-JOIN-003 / AC-STORAGE-MAINTENANCE-SNAPSHOT-005 require every actual native store opening to receive the complete centrally validated per-store execution policy, including maintenance interval and block lifetime. Authentic source47 run37868406144/job113620582336 artifact11590685637 SHA2565f5586f89a4eb92ceff44090984cb521c0e83804c4c76b80843add1f25cf0efd contains51 restore-path failures in each complete3122-case unit profile and2 failures in the275-case recovery suite. All retain the same native unresolved-maintenance-policy initiating failure. Source shows the direct restore authority owner called the scalar WithExecutionSnapshot helper instead of the native opening's canonical ResolveExecutionOptions; only that resolver carries the original centrally bound IOptions maintenance policy.
+
+Carry the original centrally bound IOptions from Restore into its private ApplyRestoreAuthorityState and call the existing ResolveExecutionOptions before constructing the original staging runtime. Retain the existing scalar-only WithExecutionSnapshot contract and the canonical public resolver; execution must not manufacture an Options.Create wrapper or weaken KLD0037 configuration ownership. The original native maintenance lifetime freezes and validates that admitted policy before starting its work. Preserve explicit per-store frame/snapshot overrides and every effective scalar budget, validation-before-ownership, native maintenance lifetime, timer/task/merge joins, generation replacement and original disposal order. No fallback/default policy, skipped maintenance, exception swallowing, new engine/provider, format, restored authority, public API or changed limit is permitted. Existing node-local owner and separate journals remain authoritative.
+
+Root owns only BackupRestore/Recovery/ZoneTreeBackupRestoreRestore.cs for product repair. Existing whole native backup/restore, rejected-input then healthy restore, real CLI children, cold-reopen blob/eventing/metadata/identity flows and real recovery children are the regressions; no property-only test is added. ADR046 owns this private snapshot join; BackupRestore REQ/AC-BACKUP-001/002/003 remain unchanged. Build/format, focused actual original failing class union in normal/scalar and recovery, original source/image binding, then exact current Linux complete suites precede qualification. Preserve the original failed archive and complete TRX; neither local passing flows nor metadata closes KL008 or backup acceptance. Rollback restores this one coherent restore-owner implementation and retains the regressions. The original r836 failed development build records KLD0037 for an attempted execution-side wrapper; that rejected uncommitted wrapper is removed before the corrected build, not suppressed or accepted.
+
 ## TASK-KL009-NATIVE-APPLY-SCOPE-001 (follower-owner implementation contract, 2026-10-07)
 
+### TASK-KL009-PERSISTED-POLICY-EPOCH-002 (frozen before code, 2026-10-09)
+
+REQ-REP-APPLY-SCOPE-001 / AC-REP-APPLY-SCOPE-001 retain the actual follower-owned journal hold, independent authenticated replica Append progress, SDK/official-MCP full document/queue effects and original receipt replay/conflict/healthy continuation. Authentic sourcef80 run37861333290/job113597517356 artifact11588428430 SHA2561b12349298e2bcacfb442bff579b3b701677bfc26108121620ef2d9cd047ac73 failed the KL009 scenario while preparing ConfigurePrincipalAsync, before reaching those fault/effect boundaries. The fixture recreated its newly persisted epoch1 principal with additional queue grants and the same default epoch1; actual PrincipalConfiguration correctly rejects a policy update whose epoch does not advance.
+
+The fresh private provisioning helper must explicitly create and assert the committed initial policy epoch1. CanonicalApplyNetworkData must advance that known original epoch exactly once to2 while preserving the same non-administrator identity, tenant and original document scope, adding only its actual queue publish/inspect scope. Require the complete returned principal to equal the complete intended record. Preserve all real persisted credential/resource operations, unique IDs, original caller paths, deadlines and post-fault state/receipt assertions. No product authorization validator, retry, fake client, new transport, limit or topology change is permitted. These are assertions inside the existing full operation scenario, not isolated property tests.
+
+Root owns the two existing IntegrationTests ClusterRouting Helpers files, this spec and ADR003. Freeze, join, native full build/format and supporting related whole flows precede exact current Linux RF3 execution. The complete original KL009 whole RF3 case, current full normal/scalar/recovery/RF3 and other mandatory gates remain required; local compile or the repaired preparation does not close KL009. Rollback removes this coherent fixture-only amendment and preserves the original failed artifact.
+
 REQ-REP-APPLY-SCOPE-001 / AC-REP-APPLY-SCOPE-001 binds original KL009 to a genuine node-local canonical apply owner and real independent replica-network progress. Preserve native ZoneTree, original ordered commit/apply gates, deterministic replay, bounded admission, RF3 acknowledgements and separate authenticated request grains. This is authored acceptance infrastructure; Linux/native execution and original task closure are not claimed.
 
 Docs-first current private-format boundary: all RequestCqrsProbe owner/arm/release/marker producers/readers select version2 and reject version1 without fallback, migration or mixed records. Original request/read phases retain exact original semantics with nullable new arm fields all null and marker EntryIndex/EntryTerm null. CanonicalJournalFlushed is Hold-only and requires complete four-scalar Partition, nonempty SourceRequestId, distinct nonempty SourceArmId and exact TargetVoter. CanonicalOutboundObserved, CanonicalIndependentAppendCompleted and CanonicalOwnerDisposed are unarmable observation-only phases. Canonical markers contain positive real entry index/term and the genuine original request actor ID. Release still addresses the exact arm/request identity. Keep original 32-arm, 400-file, 8-marker, 8192-record-byte, 1048576-aggregate-byte and depth4 ceilings, original component/principal byte bounds, hold/poll/admission/shutdown deadlines and validated configurable lower bounds. No status/receipt is invented.