Fix native local image ownership across RF3 foundation fixtures

Transfer the original verified Aspire image preparation and its ownership through physical-owner, remote-query, request-phase fault and follower-restart fixtures. Admit one exact eight-case combined selection and preserve original cancellation, state, receipt and joined-cleanup assertions. Reorder the private cancellation parameter and existing imports required by native analysis and the full formatter.

Validation: canonical full dotnet format verification passed; strict full Release solution build passed with zero warnings and errors. Source drift was zero. Native selection and eight RF3 operation cases remain pending the coherent lifetime integration; this is a source/build checkpoint, not completed runtime or Linux qualification.

Author: KSemenenko

docs/Features/TestInfrastructure/WholeClassLocalRf3Admission.md

@@ -43,3 +43,48 @@ REQ/AC-RF3-CURRENT-001 preserves every preceding selector and additionally admit
 `/*/*/(SafeProjectorOperationRf3Tests|SqlParserAdmissionRf3WholeFlowTests|GraphSearchLineageRf3Tests|AtomicTriadStagedRf3Tests|CompetingInboxPublicTests|QueueViewLeaseIsolationTests)/*`
 
 The same Node selector, fixture environment restoration and preparation-model lifecycle controls cover every new selection. They retain the original six classes and combined filter. New combined-order refusal swaps its actual first two classes; no UID is authored or inferred. AppHost model controls preserve the native nonempty-filter boundary and test mixed-identity refusal before resources, unique image prerequisite, runner dependency, native50 and joined model disposal. Actual native case census, rebuilt DLL/PDB identities, source-bound image creation, SDK/MCP RF3 operations, cold recovery and original cleanup remain OPEN until genuine Root execution; Comparison checks run only in Linux GitHub Actions. Functional coverage remains the original closed eleven-case cohort; these selectors add no coverage contributors or performance qualification.
+
+
+## Native image ownership for four foundation fixtures
+
+REQ/AC-RF3-IMAGE-OWNERSHIP-001 requires PhysicalOwnerRegistrationRf3Tests,
+RemotePartitionQueryRf3Tests, RequestCqrsPhaseFaultTests and
+RequestCqrsRf3FollowerRestartTests to use the existing
+LocalRf3ImageTestSession before their original image proof and native startup.
+The same verified Selection and original preparation owner flow into each
+existing wave. Unselected GitHub receipt admission stays strict. Mixed identity,
+unknown image or failed preparation cannot acquire database resources.
+
+REQ/AC-RF3-IMAGE-OWNERSHIP-002 requires original caller/producer settlement,
+joined AppHost shutdown and storage-lock checks before local image disposal.
+Transfer ownership once; join a preparation which fails before transfer through
+the existing never-built cleanup. Preserve original primary and cleanup failures,
+all physical groups, roots and unknown-ownership retention. The existing restart,
+cancellation, persisted permissions, state and complete receipt assertions remain.
+
+REQ/AC-RF3-IMAGE-OWNERSHIP-003 admits one additional exact combined filter:
+
+`/*/*/(PhysicalOwnerRegistrationRf3Tests|RemotePartitionQueryRf3Tests|RequestCqrsPhaseFaultTests|RequestCqrsRf3FollowerRestartTests)/*`
+
+Node and native fixture gates must agree. The current model selection inventory
+grows from fourteen to fifteen by appending that single literal; all previous
+filters remain. Native Node operation controls also reject expanded/reordered/
+partial/whitespace variants and unapproved individual class filters, conserve
+inputs and prove the exact healthy selection afterward. Existing
+NativeTUnitSelectionTests supplies four native cases for these controls.
+
+The RF3 source declarations predict eight cases: one physical-owner operation,
+two SDK/MCP remote-query argument instances, four request-phase fault operations
+and one follower-restart operation. Original rebuilt native TRX and exact method/
+argument identities must prove eight passed, zero failed and zero skipped.
+Parameterless NotInParallel remains on all four classes and native parallelism50
+is unchanged. No production code, deadline, assertion, coverage contributor or
+UID changes. Source counts and reviews do not prove runtime success.
+
+ADR-117 and the existing image ownership contracts remain sufficient: no new
+product/trust/persistence/topology boundary is introduced. Root integrates the
+coherent six fixture files and four selector/control files, formats them, builds
+the strict solution, passes the four selection cases, then executes the eight
+original RF3 operations. Local and exact-source Linux qualification are OPEN
+until their own original results exist. No migration or persisted rollout is
+needed; rollback reverts this coherent test-only enrollment.

scripts/Features/TestInfrastructure/run-tests.mjs

@@ -77,6 +77,7 @@ localImageFilters.add("/*/*/CrossTenantRf3WholeFlowTests/Kl015ForeignWritesScans
 localImageFilters.add("/*/*/RemotePartitionQueryRf3Tests/AcPqueryRemote001To005DestinationDenialLiteralMergeReceiptReplayAndOwnedRestart");
 localImageFilters.add("/*/*/FunctionalDatabaseColdReopenTests/SingleInstanceColdReopensAllModelsAndReplaysOriginalPublicCommands");
 localImageFilters.add("/*/*/FunctionalDatabaseColdReopenTests/ThreeNodeColdReopensAllModelsAndReplaysOriginalPublicCommands");
+localImageFilters.add("/*/*/(PhysicalOwnerRegistrationRf3Tests|RemotePartitionQueryRf3Tests|RequestCqrsPhaseFaultTests|RequestCqrsRf3FollowerRestartTests)/*");
 const nativeTextPreparedFilter = '/*/*/(NativeTextAsyncRf3Tests)|(NativeTextMaintenanceRf3Tests)|(NativeTextRf3LeaderLossTests)|(NativeTextRf3Tests)|(NativeTextWaitRf3Tests)/*';
 const localImageGithubIdentity = ['KEYLOAD_IMAGE_RECEIPT', 'GITHUB_SHA', 'GITHUB_ACTIONS'];
 const localImageInheritedIdentity = ['KEYLOAD_IMAGE_PROVENANCE', 'KEYLOAD_LOCAL_IMAGE_RECEIPT',

tests/KeyLoad.IntegrationTests/Features/ClusterReplication/Helpers/LocalRf3ImageSelection.cs

@@ -83,6 +83,7 @@ internal static class LocalRf3ImageSelection
     private const string RemotePartitionQueryFilterArgument = "--KeyLoadTests:Filter=/*/*/RemotePartitionQueryRf3Tests/AcPqueryRemote001To005DestinationDenialLiteralMergeReceiptReplayAndOwnedRestart";
     private const string FunctionalSingleColdFilterArgument = "--KeyLoadTests:Filter=/*/*/FunctionalDatabaseColdReopenTests/SingleInstanceColdReopensAllModelsAndReplaysOriginalPublicCommands";
     private const string FunctionalClusterColdFilterArgument = "--KeyLoadTests:Filter=/*/*/FunctionalDatabaseColdReopenTests/ThreeNodeColdReopensAllModelsAndReplaysOriginalPublicCommands";
+    private const string NativeImageEnrollmentFilterArgument = "--KeyLoadTests:Filter=/*/*/(PhysicalOwnerRegistrationRf3Tests|RemotePartitionQueryRf3Tests|RequestCqrsPhaseFaultTests|RequestCqrsRf3FollowerRestartTests)/*";
     private const string EnabledArgument = "--KeyLoadTests:LocalRf3Image:Enabled=true";
     private const string EnabledValue = "true";
     private const int MaximumNativeArgumentCharacters = 4096;
@@ -138,7 +139,7 @@ or FoundationAdmissionAuthorityFilterArgument or FoundationTelemetryFilterArgume
                 or AspireFaultFilterArgument or AcceptedRestartCancellationFilterArgument or OriginalRetireAspireFilterArgument
                 or FunctionalSingleFilterArgument or FunctionalClusterFilterArgument or PartitionQueryValidationFilterArgument
                 or CrossTenantWholeFlowFilterArgument
-                or RemotePartitionQueryFilterArgument or FunctionalSingleColdFilterArgument or FunctionalClusterColdFilterArgument
+                or RemotePartitionQueryFilterArgument or FunctionalSingleColdFilterArgument or FunctionalClusterColdFilterArgument or NativeImageEnrollmentFilterArgument
                 or CurrentGraphSearchPathPolicyFilterArgument or CurrentSampleChunkCorrectionFilterArgument or CurrentSqlGraphPublicFilterArgument or CurrentSqlGraphSamplePublicFilterArgument or CurrentGraphSamplePublicFilterArgument or CurrentFoundationRf3FilterArgument, EnabledArgument]
             || Environment.GetEnvironmentVariable(NativeCoverageArgumentsEnvironment) is not null
             || HasAmbientGithubIdentity()

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Assertions/ControlledRetireAspirePublicAssertions.cs

@@ -1,8 +1,8 @@
 using KeyLoad.Client;
 using KeyLoad.Core.Features.InternalSerialization;
-using KeyLoad.Server.Features.ClusterRouting;
 using KeyLoad.IntegrationTests.Features.ClientApi;
 using KeyLoad.IntegrationTests.Features.QueryExecution;
+using KeyLoad.Server.Features.ClusterRouting;
 using C = KeyLoad.IntegrationTests.Features.ClusterRouting.ControlledRetireAspireCorpus;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Cases/PhysicalOwnerRegistrationRf3Tests.cs

@@ -1,3 +1,4 @@
+using KeyLoad.IntegrationTests.Features.ClusterReplication;
 using KeyLoad.Server;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;
@@ -19,8 +20,13 @@ public async Task AcOwnerRegister001To003RegistersConfiguredOwnersThenJoinsAllNo
         await ServerFailureObserver.ObserveAsync(async () =>
         {
             evidence.Enter(PhysicalOwnerRegistrationRf3Phase.WaveStart);
+            var preparation = await LocalRf3ImageTestSession.StartIfSelectedAsync(deadline.Token).ConfigureAwait(false);
+            var selection = preparation?.Selection ?? LocalRf3ImageSelection.Read();
             wave = await TwoRf3MembershipWave.StartOwnedAsync(
-                new TwoRf3MembershipWave(null, register: true, nativeMembershipDiagnostics: true), deadline.Token).ConfigureAwait(false);
+                new TwoRf3MembershipWave(selection, register: true, nativeMembershipDiagnostics: true)
+                {
+                    localImagePreparation = preparation
+                }, deadline.Token).ConfigureAwait(false);
             await PhysicalOwnerRegistrationRf3Observation.WaitAsync(wave.Application, evidence, deadline.Token).ConfigureAwait(false);
             evidence.Enter(PhysicalOwnerRegistrationRf3Phase.Fingerprint);
             await TwoRf3MembershipFingerprintOracle.VerifyAsync(wave.Application, wave.Profile, deadline.Token).ConfigureAwait(false);

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Cases/RequestCqrsRf3FollowerRestartTests.cs

@@ -1,6 +1,7 @@
 using Aspire.Hosting;
 using KeyLoad.IntegrationTests.Features.ClusterReplication;
 using KeyLoad.IntegrationTests.Features.StorageRecovery;
+using KeyLoad.Server;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;
 
@@ -13,16 +14,30 @@ public async Task TwoCompatibleVotersServeAndRestartedFollowerPublishesANewSigne
         using var deadlineTimeout = new CancellationTokenSource(RequestCqrsRf3Protocol.ParentDeadline, TimeProvider.System);
         using var deadline = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current!.Execution.CancellationToken, deadlineTimeout.Token);
         var dataRoot = CreatePrivateRoot();
-        var (profile, _) = await NodeEpochRf3Profile.CreatePriorAsync(dataRoot, deadline.Token).ConfigureAwait(false);
-        var images = await RequestCqrsRf3ImageProof.ReadAsync(deadline.Token).ConfigureAwait(false);
-        var currentReference = new Dictionary<string, string>(StringComparer.Ordinal)
+        var failures = new List<Exception>();
+        LocalRf3ImageTestSession? localImageSession = null;
+        await ServerFailureObserver.ObserveAsync(async () =>
         {
-            [RequestCqrsRf3Protocol.Node1] = images.Current,
-            [RequestCqrsRf3Protocol.Node2] = images.Current,
-            [RequestCqrsRf3Protocol.Node3] = images.Current
-        };
-        var run = new RequestCqrsRf3FollowerRun(dataRoot, profile, deadline.Token);
-        await run.ExecuteAsync(currentReference).ConfigureAwait(false);
+            var (profile, _) = await NodeEpochRf3Profile.CreatePriorAsync(dataRoot, deadline.Token).ConfigureAwait(false);
+            localImageSession = await LocalRf3ImageTestSession.StartIfSelectedAsync(deadline.Token).ConfigureAwait(false);
+            var images = await RequestCqrsRf3ImageProof.ReadAsync(deadline.Token, localImageSession?.Selection).ConfigureAwait(false);
+            var currentReference = new Dictionary<string, string>(StringComparer.Ordinal)
+            {
+                [RequestCqrsRf3Protocol.Node1] = images.Current,
+                [RequestCqrsRf3Protocol.Node2] = images.Current,
+                [RequestCqrsRf3Protocol.Node3] = images.Current
+            };
+            var run = new RequestCqrsRf3FollowerRun(dataRoot, profile, deadline.Token);
+            var preparation = localImageSession;
+            localImageSession = null;
+            await run.ExecuteAsync(currentReference, preparation).ConfigureAwait(false);
+        }, failures).ConfigureAwait(false);
+        if (localImageSession is { } preparationBeforeTransfer)
+        {
+            await ClusterFixtureLocalImageLifecycle.JoinAsync(preparationBeforeTransfer, dataRoot,
+                stopped: false, neverBuilt: true, failures).ConfigureAwait(false);
+        }
+        ServerFailureObserver.ThrowIfAny(failures);
         Directory.Delete(dataRoot, recursive: true);
     }
 
@@ -42,9 +57,9 @@ private static string CreatePrivateRoot()
 internal sealed class RequestCqrsRf3FollowerRun(string dataRoot, NodeEpochRf3Profile profile,
     CancellationToken cancellationToken)
 {
-    internal Task ExecuteAsync(IReadOnlyDictionary<string, string> images)
+    internal Task ExecuteAsync(IReadOnlyDictionary<string, string> images, LocalRf3ImageTestSession? localImageSession)
         => RequestCqrsRf3Epoch7WaveRunner.RunAsync(dataRoot, images, false, true,
-            RunInWaveAsync, cancellationToken);
+            RunInWaveAsync, cancellationToken, localImageSession: localImageSession);
 
     private async Task RunInWaveAsync(RequestCqrsRf3Wave wave)
     {

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Helpers/ControlledRetireAspireBlob.cs

@@ -1,9 +1,9 @@
 using KeyLoad.Client;
 using KeyLoad.Core.Features.InternalSerialization;
-using KeyLoad.Server.Features.ClusterRouting;
 using KeyLoad.IntegrationTests.Features.ClientApi;
 using KeyLoad.IntegrationTests.Features.QueryExecution;
 using KeyLoad.Server;
+using KeyLoad.Server.Features.ClusterRouting;
 using C = KeyLoad.IntegrationTests.Features.ClusterRouting.ControlledRetireAspireCorpus;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Helpers/ControlledRetireAspireFixture.cs

@@ -1,8 +1,8 @@
 using KeyLoad.Clustering;
-using KeyLoad.Server;
 using KeyLoad.IntegrationTests.Features.ClientApi;
-using ManagedCode.Communication;
+using KeyLoad.Server;
 using KeyLoad.Server.Features.ClusterRouting;
+using ManagedCode.Communication;
 using P = KeyLoad.IntegrationTests.Features.ClusterRouting.ControlledRetireAspireProtocol;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Helpers/ControlledRetireAspireSeed.cs

@@ -1,7 +1,7 @@
 using KeyLoad.Core.Features.InternalSerialization;
 using KeyLoad.IntegrationTests.Features.ClientApi;
-using KeyLoad.Server.Features.ClusterRouting;
 using KeyLoad.IntegrationTests.Features.QueryExecution;
+using KeyLoad.Server.Features.ClusterRouting;
 using C = KeyLoad.IntegrationTests.Features.ClusterRouting.ControlledRetireAspireCorpus;
 
 namespace KeyLoad.IntegrationTests.Features.ClusterRouting;

tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Helpers/ControlledRetireAspireTrial.cs

@@ -1,7 +1,7 @@
 using KeyLoad.Client;
-using KeyLoad.Server.Features.ClusterRouting;
 using KeyLoad.IntegrationTests.Features.QueryExecution;
 using KeyLoad.Server;
+using KeyLoad.Server.Features.ClusterRouting;
 using ManagedCode.Communication;
 using P = KeyLoad.IntegrationTests.Features.ClusterRouting.ControlledRetireAspireProtocol;