Parent: StorageRecovery. Applicable cut and frozen-closure contract: ADR-097; owner refactor: ADR-046; test entry: ADR-117. Applies to the existing captured-read contract; no storage format, public API, clock, limit or dependency change.
REQ-CUT-004: A frozen forward/reverse traversal observes the original supplied cancellation token after each external observer and visitor callback. A callback selecting cancellation cannot authorize delivery of another row or return a successful early-stop result.
AC-CUT-004: Capture original exact/prefix scopes from a genuine ZoneTree cut, mutate the live store, close the lease and reopen the store. For each traversal direction exercise pre-cancellation, cancellation in the actual byte observer, and cancellation in the first actual visitor with both stop/continue results. Require the exact original cancelled token; pre-cancellation delivers/observes zero rows, observer cancellation delivers zero and observes one, visitor cancellation delivers/observes exactly one independently specified original row. Successful repeated frozen reads still expose the original values and absence, while full current records/identity/position remain unchanged by every rejected traversal. Commit an independent healthy record and verify the complete current state through two cold reopens while the frozen scope remains unchanged. Observe the original operation failure before each original lease/view/fixture cleanup failure.
unit evidence is not process-kill, power-loss, Docker replicated-cluster, SDK/MCP, performance or whole-task acceptance. The storage provider is unchanged; this covers KeyLoad's own frozen callback boundary.
flowchart LR
Execution[Seed real ZoneTree] --> Capture[Capture original scopes]
Capture --> Change[Commit changed live rows]
Change --> Close[Close lease and reopen]
Close --> Cancel[Observe selected cancellation in both directions]
Cancel --> Preserve[Verify full original frozen and current cuts]
Preserve --> Healthy[Healthy commit and two cold reopens]