Canonical slice: OrleansExecution, runtime adoption. Applicable ADRs: ADR-036, ADR-110, ADR-121, ADR-125, ADR-117.
REQ-ORL-ANCESTRY-001: Before either approved Activity callback accesses Baggage, KeyLoad's privacy processor bounds local Parent links by validated MaximumParentLinks (0..32, default32). The actual .NET10 getter scans ancestors even when every node has no baggage. Reuse the fixed baggage_limit suppression reason and Recorded flag; never replace propagation.
AC-ORL-ANCESTRY-001: The genuine streamed Batch writes a literal document under 33 actual local parent links. A passive listener must observe actual Orleans Application Client spans with that direct local parent and Recorded=false; those exact SpanIds must not reach the exporter. The operation and original command replay both return independently complete receipts using the retained journal entry Index and literal mutations. Complete literal DocumentResult and persisted original outcome are checked after each response; replay preserves store position and the entire journal cut. No store-position/logical-token comparison is used.
AC-ORL-ANCESTRY-002: After reverse-joined parent disposal and exact ambient restoration, repeat the same real flow with exactly32 local Parent links (inclusive) and then one shallow parent. Actual client spans must be recorded and those exact IDs exported. Each stage retains all earlier literal documents. Trace and metric captures must not truncate. The existing original operation timeout, startup, shutdown and provider flush bounds remain unchanged. No custom Orleans ActivitySource or span.
AC-ORL-ANCESTRY-003: Observe actual body tasks and separately joined cleanup with the existing ServerFailureObserver. Reverse-dispose every owned Activity and listener, then telemetry provider and fixture. Preserve original/cleanup terminal failures exposed by each owner. The existing telemetry fixture's internal nested-finally disposal semantics are unchanged; no stronger internal conservation claim.
flowchart LR
A[Persist scoped writer] --> B[33 real parents: real write and replay]
B --> C[Actual client suppressed; full model and receipt]
C --> D[Restore ambient; 32 parents inclusive]
D --> E[span exported; full model and replay]
E --> F[Restore ambient; shallow healthy operation]
F --> G[No truncation; join all owners]
AC-ORL-ANCESTRY-001..003 map to OrleansTelemetryAncestryTests.RealWriteSuppressesDeepClientTelemetryThenExportsInclusiveAndShallowSpans.
The MaximumParentLinks option and the pre-Baggage hooks belong to the production telemetry privacy processor. A TestCluster with node-local ZoneTree and the retained journal is not the Docker replicated cluster, SDK/MCP qualification or a CPU/DoS/performance measurement. The stock Orleans outgoing propagator still injects context and may enumerate baggage independently; this contract bounds only KeyLoad's privacy processor. No transport, provider, default or deadline changes.