@@ -145,7 +145,7 @@ flowchart LR
     G -->|"GraphToQueueMutation"| A[["Queue: actions"]]
 ```
 
-The current composition API uses .NET `CommitAsync`, SQL `EXEC keyload_documents_commit @arguments` or the official MCP server.
+The current composition API uses .NET `CommitAsync`, SQL `EXEC keyload_documents_commit @arguments` or the official MCP server. KeyLoad is a development preview.
 
 | Boundary | Current contract |
 |---|---|
 
@@ -16,7 +16,7 @@ entities and writing a knowledge graph, and graph-driven queue workflows.
 Extend ADR-054's invocation stage with two typed atomic composing mutations:
 QueueToGraph and GraphToQueue. They run inside the existing CommandRequest apply
 transaction and expand to existing primitive mutations, receipts and outbox.
-SQL `CALL keyload_documents_commit(@arguments)` reaches the same operation through
+SQL `EXEC keyload_documents_commit @arguments` reaches the same operation through
 the sole catalog and request envelope gateway. Full declarative model sources,
 joins and data-modifying SQL remain mandatory under ADR-065; this is a delivered
 stage only after actual tests, never the completed full SQL product.
 
@@ -31,7 +31,8 @@ correctness contract. Every planned database/topology row remains visible; missi
 or failed sessions have null metrics displayed as an em dash. Authentic sessions
 with incomplete server resource observations retain their recorded operation
 measurements, labelled Measured · incomplete telemetry. Preserve resourceQualified=false;
-missing resource metrics remain an em dash and server resource comparability is unverified. Selected corrupt,
+missing resource metrics remain an em dash and server resource comparability is unverified.
+Website recorded-operation aggregation validates each original resource report but does not require identical hosted-runner hardware. Native benchmark aggregation retains its strict comparison policy. Selected corrupt,
 expired, foreign or mixed evidence is rejected. A cancelled or in-progress producer
 supplies no figures. If no producer has eligible sessions, emit no metrics and a
 static empty state with benchmarks:null in the publication receipt.
 
@@ -420,7 +420,7 @@ complete original TRX, qualification, runtime/resource identities, hashes and
 correctness evidence. Incomplete server resource telemetry does not hide recorded
 operation measurements. Preserve resourceQualified=false and label these rows
 Measured · incomplete telemetry. Missing resource observations remain an em dash;
-server resource comparability remains unverified. Selected corrupt, expired, foreign or mixed evidence is
+server resource comparability remains unverified. Website records original operation timings independently of hosted-runner hardware equality; the native aggregation CLI retains its strict comparison policy. Selected corrupt, expired, foreign or mixed evidence is
 rejected. Workflows and triggers are defined in ADR-062, ADR-064 and ADR-112:
 Website intake reads original successful worker/runtime artifacts directly, even
 when the overall run or combined-results job failed. With no eligible sessions it
@@ -439,7 +439,7 @@ publishes content without figures. There is no `workflow_run` executor.
 | REQ-BC-FAIL-010 preserve exact OpenSearch vector ordering | AC-BC-FAIL-010 the query preserves the unchanged shared float32-input/double-accumulated cosine oracle and ordinal ID tie order. Use execution `scripted_metric` map/combine/reduce over actual vector doc values; round parsed query values back to float32 before double arithmetic, retain at most TopK candidates per shard, merge only bounded shard TopK states, validate finite double scores and retain projected content from the existing source only for admitted candidates. Do not sort through float `_score`, weaken recall/tolerances, rerank/fetch in the client, duplicate stored vectors, use ANN or change the corpus/topology/ACK contracts | independent deterministic precision witness for query d000000170 (documents2289/1272), positive/negative query/response TUnit checks, and genuine Aspire-owned OpenSearch VectorExact1/3 jobs with every five10000-operation repetition passing the unchanged oracle; complete same-run aggregate/site/Pages still required |
 | REQ-BC-FAIL-011 create the qualification evidence parent | AC-BC-FAIL-011 initialization creates the real workspace artifacts/site-evidence parent before any capture redirection, preserves existing directories/files, rejects file or symlink collisions at artifacts or site-evidence before output, and leaves isolated-capture absent for its exclusive producer. Never skip/rebind source/archive/current-plan/input/test/coverage/browser/freshness gates | SiteQualificationStartupTests executes the actual initialization Bash block in fresh owned filesystems (new/existing parent, file/base-link/parent-link collisions), checks actual envelope redirection and unchanged targets, and runs as a mandatory Aspire-owned unit preparation gate; genuine new-source website qualification/Pages remains required |
 | REQ-BC-FAIL-012 execute the actual probe contract | AC-BC-FAIL-012 C# probe requests serialize the existing lowercase operation/values contract; median arithmetic and odd/even/empty assertions remain unchanged. error probes preserve string error codes and use the actual error name for numeric DOMException codes; real AbortController cancellation must still assert AbortError | Existing SiteMeasurementArithmeticTests and SiteIsolatedHttpTests, original failed TRX and focused genuine-input development checks |
-| REQ-BC-FAIL-013 complete disposable builder source | AC-BC-FAIL-013 SEO/vendor scratch repositories copy the exact canonical isolated-contract.json bytes from the actual source repository before invoking the actual builder. Vendor-only mutations use the accepted fixture's unchanged full original aggregate and its source-bound worker inventory; they must not substitute an aggregate-only directory or duplicate the2GB raw inventory for each metadata mutation. Existing missing/link/corrupt-asset negatives must reach their intended checks before output; the valid vendor compression case must succeed. No fabricated contract, provider input, replacement builder or weaker assertion | Existing four SiteMetadataRejectionTests and three SiteVendorBuildTests, with actual source-byte copying and unchanged input authority |
+| REQ-BC-FAIL-013 complete disposable builder source | AC-BC-FAIL-013 SEO/vendor disposable repositories copy the actual canonical session-contract.mjs and its source dependencies before invoking the actual builder. Vendor-only mutations use the accepted fixture's unchanged full original aggregate and its source-bound worker inventory; they must not substitute an aggregate-only directory or duplicate the original raw inventory for each metadata mutation. Existing missing/link/corrupt-asset negatives must reach their intended checks before output; the valid vendor compression case must succeed. No fabricated contract, provider input, replacement builder or weaker assertion | Existing four SiteMetadataRejectionTests and three SiteVendorBuildTests, with actual source-byte copying and unchanged input authority |
 | REQ-BC-FAIL-014 bound heavy qualification children | AC-BC-FAIL-014 expensive full-cohort builder/archive-verification children share bounded admission before their existing 300s active execution deadline starts. The approved policy is two active children, a FIFO queue of at most 64 waiters and a 20-minute cancellable admission deadline; heavy classification covers actual builders, produce requests and inputs/verify-inputs probes, while light probes and network capture keep their existing paths and deadlines. An unsettled child or reader poisons admission and rejects pending requests rather than releasing unsafe capacity. Retain the complete source-bound current input/worker inventory, stdout/stderr bounds, caller cancellation and original-byte verification. Hold ownership until actual child exit and readers settle; cancelled queued requests start no child. Every complete site test and coverage gate runs in genuine Linux GitHub | Real-process admission regressions (FIFO/capacity, queued cancellation, queue-full/deadline rejection before start, start failure, active cancellation, output bounds, unsafe-ownership fail-closed), complete unfiltered Aspire-owned GitHub site/TRX/Node+Chrome coverage and Pages |
 | REQ-BC-FAIL-015 emit a confined browser catalog URL | AC-BC-FAIL-015 the actual built HTML uses `data/isolated-catalog.json`, which the existing strict `confinedUrl` accepts. Retain rejection of dot segments, traversal, foreign origins, credentials, redirects, mismatched hashes and unavailable evidence. Real Chrome must reach the existing Ready predicate and preserve every numeric/null, provenance, responsive and lifecycle assertion | Existing SiteIsolatedBuildTests, SiteIsolatedBrowserTests, SiteIsolatedFailedCellBrowserTests, SiteIsolatedStandaloneBrowserTests and SiteBrowserBehaviorTests; genuine Linux full site and coverage |
 | REQ-BC-FAIL-016 validate the actual PNG-backed ICO structure | AC-BC-FAIL-016 distinguish the ICO file header type1 from each directory entry's color-count0 and reserved0. The canonical PNG-backed entries retain planes0, bits32, bounded16/32/48 frames and actual8-bit RGBA PNG payloads. Preserve exact console/site/output bytes, frame bounds, dimensions and missing/corrupt asset checks | Existing SiteMetadataTests.AC_SEO_001_IconsAreValidSharedBytesAndEmittedFromTheRealBuild; genuine Linux full site and coverage |
 
@@ -9,7 +9,7 @@
     "aspireClusterSdkMcpTests": "in progress: KeyLoad.ClusterTests uses descriptive capability groups and lane IDs with the unchanged two-cluster runner bound. SQL TCP or TLS extends standard server addresses without replacing Aspire public HTTPS. A real three-node TCP case passed with API authentication and exact prepared/unprepared Npgsql queries. The original Int16 and Decimal SQL whole flows and explicit TCP pass locally, 3/3, including policy repair, original receipt replay and two cold cuts on TLS. SQL TLS uses the standard Aspire/Kestrel certificate; the separate certificate loader, test CA/PFX generator and custom root trust were removed. Original strong-session failover passed locally after observing Orleans membership following abrupt kill and rejoin, including policy repair, replay and two cold cuts. Source and compiled discovery agree on 196 cluster classes, 282 methods and 359 cases after adding five previously omitted qualified-attribute SQL classes to CI; this proves discovery, not successful execution. Full current local and exact-source Linux cluster execution, fault/endurance and coverage remain distinct required gates.",
     "coverage": "open: original Linux analyzer measurements exist; current source mapping and required numeric gates are not qualified. Functional coverage remains open.",
     "adminConsole": "open: Blazor Server and Fluent UI components replace the static JavaScript application; Playwright replaces the custom CDP client. Focused browser, complete suite and exact-source Linux qualification must be recorded separately.",
-    "performance": "Benchmark publication remains unqualified until exact-source Linux Website coverage/browser/Pages gates pass. Website source now admits complete successful original sessions from a completed failed run, derives the aggregate directly from authenticated worker/runtime ZIPs, and displays all 32 planned rows with an em dash for absent sessions. Local Debug solution build, formatting, governance, source closure and nine Node contract scenarios pass. Run 40364432422 has 24 successful session candidates; original PostgreSQL n1 has seven measured reports and seven passed TRX outcomes, but its serverCpuRss evidence is missing and resource qualification is false. The owner approved publication of recorded operation measurements despite incomplete server telemetry: preserve resourceQualified=false, label the rows Measured · incomplete telemetry, and show an em dash for absent resource observations. Complete execution, correctness and artifact gates remain required. Content-only Website run 40407730385 and Pages publication passed at source f9789234d; the newer partial-session pipeline still requires its own Linux qualification.",
+    "performance": "Website original-session intake passed on Linux at e6b771ee8 (run 40415206997), retaining 24 successful sessions from failed Benchmarks run 40364432422. The complete Website suite passed 120/136 cases; Pages remained blocked by stale asset references, browser module loading, public-copy assertions and critical coverage. The current repair batch passes the focused WebsiteTests build with -warnaserror, scoped formatting, nine Node contract scenarios, source closure and an actual local browser check against the Linux-verified aggregate: eight one-node and two three-node throughput rows, with missing KeyLoad values null. The combined canonical Debug solution build passed all 21 projects with zero warnings/errors, and full formatting verification passed. Linux Website coverage/browser/Pages qualification remains required for this batch. The owner approved recorded operation timings despite incomplete or heterogeneous runner telemetry; retain raw qualification flags, label incomplete telemetry and leave absent metrics null. These figures do not establish a controlled hardware comparison. The last verified live publication remains content-only Website run 40407730385 at f9789234d.",
     "powerLossDurability": "Not proven; process-kill tests do not prove it.",
     "endurance": "open",
     "sharedVolumeStorage": "open: lazy single-owner sessions are in source; execution runtime, owner loss/reopen and deployed filesystem locking/flush qualification remain required",
 
@@ -9,7 +9,7 @@ try {
     args.set(match[1], path.resolve(match[2]));
   }
   requireSession(args.size === 2);
-  const result = await aggregateSessions(Object.fromEntries(args));
+  const result = await aggregateSessions({ ...Object.fromEntries(args), resourcePolicy: 'comparison' });
   process.stdout.write(JSON.stringify({ schemaVersion: result.schemaVersion, workers: result.workers.length }) + '\n');
 } catch {
   process.stderr.write(SESSION.failure + '\n');
 
@@ -102,7 +102,8 @@ async function authenticateProof(input, proof) {
     runtime.files.map(file => ({...file,entry:path.basename(file.path),maximum:67_108_864})), 134_217_728);
   return identity;
 }
-export async function aggregateSessions({ input, output }) {
+export async function aggregateSessions({ input, output, resourcePolicy }) {
+  require(['comparison', 'recorded'].includes(resourcePolicy));
   const proof = await readJson(path.join(input, 'proof.json'));
   const runtimeIdentity = await authenticateProof(input, proof);
   const rows = proof.workers.map(worker => sessionRows().find(row => row.id === worker.id));
@@ -126,7 +127,7 @@ export async function aggregateSessions({ input, output }) {
     workers.push({ ...metadata, session: original.session, reports: original.reports.map(compactCase), execution: original.execution, qualification: original.qualification, resourceQualified: original.resources?.observations.qualified ?? false, stateSha256: original.stateSha256 });
     originals.push(original.session);
   }
-  requireComparableSessionResources(comparableResources);
+  if (resourcePolicy === 'comparison') requireComparableSessionResources(comparableResources);
   const aggregate = validateSessionAggregate({ schemaVersion: SESSION.schema, cohort: proof.cohort, plan: createSessionPlan(),
     preparation: proof.preparation, workers });
   await createDirectory(output);
 
@@ -1,11 +1,12 @@
-import path from 'node:path';
 import { exactSession as exact, requireSession as require, sessionHash, sessionPositive, sessionText } from './session-contract.mjs';
 
 const binaryFields = ['executablePath', 'executableSha256', 'assemblyPath', 'assemblySha256', 'pdbPath',
   'pdbSha256', 'sourceCount', 'sourceCompositionSha256'];
 const processFields = ['name', 'processId', 'startedAtUtc', 'aspireStartedAtUtc',
   'aspireProcessId', 'aspireProcessStartedAtUtc', 'binary'];
-const absolute = value => sessionText(value) && path.isAbsolute(value) && path.normalize(value) === value;
+// Published session identities retain canonical POSIX paths from the original Linux execution.
+const absolute = value => sessionText(value) && /^\/(?!\/)(?:[^/]+\/)*[^/]*$/u.test(value)
+  && !value.split('/').some(segment => segment === '.' || segment === '..');
 const utc = value => typeof value === 'string' && /Z$/u.test(value) && Number.isFinite(Date.parse(value)) && Date.parse(value) > 0;
 
 function validateProcess(value, role, expectedName, runtimeIdentity = null) {
@@ -21,8 +22,9 @@ function validateProcess(value, role, expectedName, runtimeIdentity = null) {
     && binary.pdbPath === binary.assemblyPath.slice(0, -4) + '.pdb' && binary.assemblyPath.endsWith('.dll'));
   if (runtimeIdentity !== null) {
     const expected = runtimeIdentity.descriptor.assemblies.find(item => item.role === role);
-    require(expected !== undefined && binary.assemblyPath === path.join(runtimeIdentity.descriptor.workspace, expected.path)
-      && binary.pdbPath === path.join(runtimeIdentity.descriptor.workspace, expected.pdbPath)
+    const workspace = runtimeIdentity.descriptor.workspace.replace(/\/$/u, '');
+    require(expected !== undefined && binary.assemblyPath === workspace + '/' + expected.path
+      && binary.pdbPath === workspace + '/' + expected.pdbPath
       && binary.assemblySha256 === expected.sha256 && binary.pdbSha256 === expected.pdbSha256);
   }
   return value;
 
@@ -112,7 +112,8 @@ export async function captureSessionSite({ environment = process.env, args, down
     compiledArtifact: projectArtifact(selected.execution.compiledArtifact), runtimeIdentity };
   await writeJson(path.join(input, 'proof.json'), { schemaVersion: SESSION.schema, cohort: selected.cohort, workers, preparation });
   const prepared = await createDirectory(path.join(input, 'prepared-input'));
-  const aggregate = requirePublishableSessionMeasurements(await aggregateSessions({ input, output: path.join(prepared, 'aggregate') }));
+  const aggregate = requirePublishableSessionMeasurements(await aggregateSessions({ input,
+    output: path.join(prepared, 'aggregate'), resourcePolicy: 'recorded' }));
   const aggregateRaw = await hashRegularFile(path.join(prepared, 'aggregate', 'aggregate.json'), SESSION.aggregateBytes);
   const provider = await createDirectory(path.join(prepared, 'provider'));
   const providerGithub = await createDirectory(path.join(provider, 'github'));
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ try {`
`9`	`9`	`args.set(match[1], path.resolve(match[2]));`
`10`	`10`	`}`
`11`	`11`	`requireSession(args.size === 2);`
`12`		`- const result = await aggregateSessions(Object.fromEntries(args));`
	`12`	`+ const result = await aggregateSessions({ ...Object.fromEntries(args), resourcePolicy: 'comparison' });`
`13`	`13`	`process.stdout.write(JSON.stringify({ schemaVersion: result.schemaVersion, workers: result.workers.length }) + '\n');`
`14`	`14`	`} catch {`
`15`	`15`	`process.stderr.write(SESSION.failure + '\n');`