Implement bounded visibility cache and native event-feed execution

Checkpoint all current Stage54 source. Full Release, format and native analyzers pass; ordinary Aspire RF3 SDK/MCP normal/scalar and focused process recovery pass. Preserve the same negative-profile fixture failure in both selected unit runs; its scoped repair is prepared for the next stage. Full Linux/RF3 and numerical functional coverage remain open.

Author: KSemenenko

.codex/config.toml

@@ -6,3 +6,6 @@ tool_timeout_sec = 600
 
 [mcp_servers.roslynk.env]
 Roslynk__Port = "16502"
+
+[mcp_servers.roslynk.tools.apply_patch]
+approval_mode = "approve"

README.md

@@ -90,7 +90,7 @@ flowchart LR
 
 **Accepted** = original task criteria passed for a recorded source. **In source** = implemented, with qualification open. Later changes require fresh checks.
 
-The current local checkpoint passed the full Release build, formatting and focused operation/recovery checks. Persisted team row policy is implemented; its complete public qualification remains open because initial RF3 startup exposed an incomplete native authentication decoder. Complete Linux/RF3 qualification and product functional coverage remain open. See the [implementation status](docs/implementation/status.json) for the current acceptance gates and original evidence.
+The current local checkpoint passed the full Release build, formatting, focused recovery checks and a genuine RF3 SDK/MCP flow in both CPU modes. Persisted team row policy, its native authentication decoder, bounded visibility caching and event streaming are implemented. One selected unit-test fixture still requires its prepared repair; complete Linux/RF3 qualification and product functional coverage remain open. See the [implementation status](docs/implementation/status.json) for current acceptance gates and original evidence.
 
 | Workstream | What it does and why | State | Remaining work |
 |---|---|---|---|

docs/ADR/ADR-014-principals-rbac-row-policy.md

@@ -111,3 +111,48 @@ Ordered stages: this feature/ADR appendix -> additive existing native contracts
 Ownership: Abstractions AuthorizationContracts/DocumentStorageContracts; Security AuthorizationPolicy; Core ProtocolValidation, DocumentMutationCommands, BlobMetadataRules, ClusterPrincipalPolicy and RuntimeJournalIdentity; new Authorization Cases/Helpers/Assertions; append Authorization.md and ADR014. No Orleans routing/storage owner change. Native API reads and per-new-path NotSupported precede new C#. Root joins live/source/Git; isolated Unit build/testing are development only. Existing source/image/UID/coverage and RF3/recovery gates remain mandatory. Rollback removes additive team code/tests/docs together from a first-release source image; no legacy reader or conversion is supplied and no runtime compatibility rollout is claimed.
 
 Team graph source map: same new whole team case also seeds an actual collection of owner-a/team-b/owner-c vertices and actual ab/bc graph edges via original authorized Batch. Team membership yields complete ordered a,b,c and ab,bc; removal yields onlya/noedges, revoke rejects without page, higher-epoch repair and same-root cold yield complete original graph again. Existing GraphVertexVisibility actual source owns synchronous current-principal lookup; no cache hit or reusable ID-set claim. New Assertions/TeamGraphVisibilityAssertions.cs owns independent literal vertices/edge records and full native byte/cut invariance.
+
+
+## KL-065 generation-scoped native visibility ownership
+
+
+Architecture 29.3 / KL065 and REQ/AC-AUTH-005/007 require a genuine generation-scoped document-ID visibility acceleration set. Team tranche READY15 is a required source predecessor for team semantics; original owner/project checks remain. This is disposable current-source state, with no persisted/public fields, aliases, protocol changes or replacement storage provider.
+
+Exact existing APIs: KeyLoad.ICacheMemoryBudget.TryReserve(bytes, entries, out ICacheMemoryReservation) and CacheMemoryBudget, DatabaseEngine.WithQueryView, DocumentEpoch, ReadExecutionBudget.VisitRange, QueryCandidateReader.Candidate/Visit and GraphVertexVisibility.CanVisit/ReadVisibility. Core already grants Query and Server friend access. Native receipts retained beside this contract. PartitionHost creates CacheMemory before OpenCanonicalDatabase; existing shutdown joins maintenance/coordinator/materializer before CacheMemory and canonical stores. No IAtomicStore or IKeyValueView expansion.
+
+Minimum actual scope: Core/Authorization owns an internal RowVisibilityCache, scope identity and disposable build/lookup leases; one DatabaseEngine owns it for one actual store, explicitly borrowing the SAME PartitionHost CacheMemory. Composition closes the cache after operations/apply join and before CacheMemory; embedded test fixture owns its same validated shared budget and cache lifecycle. No separately sized cache ceiling or per-query substitute. Default embedded owners without this collaborator preserve the existing canonical path and cannot be credited as cache tests.
+
+Identity is an exact structured tuple: actual Store.Identity NodeId/incarnation/read generation, current Store.Position observed INSIDE original read view, full PartitionRef (including tenant), collection, resource schema version, source DocumentEpoch, current persisted principal ID/tenant/policy epoch. Existing strict principal epoch CAS is membership version, including owner/project/team changes. No signing key, credential, document JSON, retained PrincipalRecord, live IKeyValueView or caller role is cached.
+
+Fill reuses ONLY the original authorized full collection scan already performed by QueryCandidateReader. It accumulates actual visible document IDs after existing current row policy checks; it does not issue a second scan, affect point/index paths, change their access-path labels, skip original scan/result limits or accept a partial prefix. Publish only after original native scan reports HasMore=false, original cancellation/budget remains valid, and owning scan has completed successfully. Partial/failed/cancelled scans dispose the unpublished draft and all accepted reservations, retaining initiating/cleanup failures. Schema/filter/SQL projection does not define visibility: every candidate in the actual complete collection scan contributes independently of residual predicate, paging or result limit.
+
+A later matching full scan may exclude IDs absent from this COMPLETE set before current row policy; all positive IDs STILL deserialize current records, check Deleted and current CanReadRow before materialization. Native scan/byte/cancellation accounting stays exactly the original scan. Graph may borrow the same matching complete set after its current collection authorization/resource check: known-negative IDs avoid canonical vertex decode; positive IDs STILL perform current canonical read/current CanReadRow, and misses/unsupported/incomplete sets use existing actual canonical path. Never infer completeness from count, requested result limit or a graph traversal's visited IDs. No cache-hit performance claim from result equality.
+
+Bounds/lifetime: modeled retained charge includes scope strings and tuple/index/node/list capacity, each actual copied document ID string, reference/ordinal index state and every cache/build/lookup lease; reserve the original shared byte+entry grant BEFORE owned allocation/copy. Fixed implementation representation-size terms are accounting constants, not new operational limits or measured CLR heap. Refusal to retain accelerator state leaves original canonical execution intact; it cannot authorize/deny a row or change operation outcomes. No unlimited dictionaries or uncharged growth. Retire stale same-scope entries on new current scope/epoch/cut; bounded admission may retire unpinned entries. Retired pinned entries retain the same original charges until actual final lease Dispose. No lease evicted from under caller; no advisory invalidation needed for correctness. On cache Dispose close admission and retire entries; retain uncertain/pinned ownership until actual closure. Restart reconstructs an empty disposable cache using fresh identity; old cursors/sets never bind the new generation.
+
+Required complete operation controls: real team/owner/project corpus with same-ID cross-tenant documents; original SQL complete scan warms a real set, graph/page positive+negative paths retain complete independent literals and fresh final policy. Root revision-fenced row-owner/team changes, delete and real policy membership reduction/revoke ACK yield exact hidden/denied no-effect results despite old pinned set; higher epoch repair fresh healthy set/results. Actual shared budget contention refuses only accelerator retention, original native bounded healthy operation remains exact; cancelled original scan publishes no partial set, then fresh healthy scan. Same-root joined cold retains canonical full bytes/receipts and returns current literal pages/graph with empty new cache. Observation of cache reuse/reservations is test-only internal actual owner evidence alongside full operations, not a getter-only test. No fake clock, synthetic trusted state, quotas, deadline changes or performance claims.
+
+Ordered owners: docs/ADR014 first; Core internal cache/scope/retention; actual DatabaseEngine composition; Query full-scan draft/terminal publication and final row checks; Graph matching lookup/current checks; PartitionHost/TestDatabase lifecycle; whole Unit normal/scalar and real existing SDK/MCP/Q1/cold acceptance. Root joins main/Git. Source/DLL/PDB/native UID/cleanup and mandatory full solution/Linux/RF3/coverage remain OPEN. This finite contract freezes integration before new native seams; implementation and passes are not claimed.
+
+
+
+Current-cut graph bridge before source: retain only the actual SchemaVersion scalar with the ORIGINAL bounded collection-decision entry (no second map/resource object). After its original persisted collection capability/resource check, match actual store NodeId/incarnation/read generation/Position, full partition/collection, actual schema version and fresh principal tenant/id/epoch. Under SAME unchanged live native read gate, exact current physical position proves the full-scan entry's actually observed DocumentEpoch unchanged; snapshot replacement requires a new read generation and cannot match. No second scan or metadata-read budget is introduced. The full entry still records original actual DocumentEpoch; query acquisition compares it exactly with already observed ResolveCursor.SourceEpoch. Graph positive IDs still canonical-read/current CanReadRow; negative closure is valid only for this exact current cut. Existing graph collection-decision metadata reserve includes this scalar; no new collection index/map, new quota or authority.
+
+
+### TASK-KL065-GENERATION-VISIBILITY-001 whole-operation regression closure
+
+`GenerationVisibilityTests` owns two real-store operations: complete SQL/graph visible images, a foreign tenant with the same row ID and independent JSON, a held original cache pin across persisted removal/revocation/repair, original-command epoch refusal and current-command exact replay, then joined cache/store closure and same-root cold reconstruction with an empty disposable cache. The second operation exhausts the SAME original shared memory admission before a complete canonical scan, releases the genuine competing reservation, exercises actual cancelled caller refusal with complete no-effects, and ends in repaired healthy SQL/graph and same-root cold continuation. Cancellation is a real already-cancelled caller control, not a claim of a mid-scan barrier. All copied IDs and collection/index metadata remain charged through actual pin release; cache observations support the whole operation and do not replace complete literal public rows/native bytes/receipts. These are Unit normal/scalar development gates; process, RF3, authentic census/coverage and Linux task graduation remain open. No persisted/public ID, quota, clock or transport contract changes.
+
+
+The retained-byte model includes pointer-aligned object/string footprints, the retained PartitionRef object, cache/lease/entry/ID/reservation and sorted-set metadata, plus conservative native Lock/wait-event/safe-handle managed metadata reserved before owner creation. The .NET10 Lock fields are source-linked to the [official runtime v10.0.12 Lock implementation](https://github.com/dotnet/runtime/blob/v10.0.12/src/libraries/System.Private.CoreLib/src/System/Threading/Lock.cs); ulong thread identity covers the larger macOS layout and conservatively overcharges the Linux uint layout. This is modeled shared admission, not measured CLR heap/RSS or kernel-memory qualification. An uncertain reservation-release failure is latched by the original owner; a later idempotent native Dispose cannot be treated as a new successful release. Retired failed entries/leases keep their original identity and charges.
+
+The Query closure owns either its exact completed-set lease or its unpublished draft, never both: Begin is called only when Acquire returns null. Both direct nullable Dispose calls remain visible in the lexical finally; the initiating scan error is retained before cleanup and any cleanup refusal is aggregated outside finally. No second cleanup resource can be skipped because of the exclusive original acquisition path.
+
+Final responsibility ownership: pure RowVisibilityScope/CurrentScope stay in Models; the retained mutable entry and its actual reservation closure belong to Lifecycle/RowVisibilityEntry.cs, and the modeled native layout/byte admission calculator belongs to Admission/RowVisibilityMemoryModel.cs. Execution owns the current node cache/database composition, Admission owns draft/transfer construction, QueryExecution/Queries owns the original full-scan closure. No public namespace, alias, field ID, effect or authority changes accompany this private source-role correction.
+
+Node composition remains in the original PartitionHost: the existing canonical DatabaseEngine construction/runtime-journal preparation is factored into StorageRecovery/Hosting/PartitionDatabaseComposition, with the same store/configuration/clock/physical-owner arguments and the original shared CacheMemory. This helper owns no store or extra service. The host receives the original engine/cache pair before its unchanged transfer/log/snapshot/bootstrap stages. Direct typed field disposal after text closure and before CacheMemory closure preserves every failure in the host's original ledger, including construction refusal; failed cache ownership is never cleared or replaced.
+
+
+## TASK-KL065-GENERATION-ADMISSION-EXTRACTION-003
+
+The cache retains its original lock, closed check, scope lookup, invalidation and retirement ownership. Native lease reservation and successful constructor-to-pin transfer are owned by the existing `Admission/RowVisibilityTransfers.CreateLease`; the call occurs under the same cache gate. Direct nullable-reservation disposal and initiating/cleanup error preservation remain unchanged. No new owner, callback, quota, public/persisted contract or policy is introduced. Both original GenerationVisibilityTests whole operations verify cross-tenant/revoke/repair/replay, pinned retirement/admission/cancellation and same-root cold continuation in normal/scalar profiles. Canonical formatting, build and authentic runtime gates remain required.