Fix complete range paging at the storage work ceiling

Stop the internal provider page before its lookahead would exceed the examined-record ceiling, then resume from the last delivered key in the same storage gate. Preserve explicit reader stops at page boundaries.

Cover contiguous 100,000-document deletions and real ZoneTree page boundaries; reconcile all 13 new compiled test identities and coverage selectors.

Verified: restore, solution format and format verification, full Debug solution build with warnings as errors (0 warnings/errors), 38 focused real-store tests, governance, shard partition, source closure, and exact compiled discovery for all 3307 cases and five coverage groups. Linux delivered-image benchmarks remain pending.

Author: KSemenenko

docs/Features/QueryExecution.md

@@ -29,7 +29,9 @@ flowchart LR
 | REQ-QUERY-005: SQL, JSON and C# are adapters of one authorized AST with typed scalar semantics | AC-QUERY-005: equivalent requests return the same order, access path, PII omissions and an interchangeable cursor; null/missing/IN/parameters are defined; builder branches do not share a mutable query context | Existing `SqlJsonAndCSharpAdaptersHaveTheSameSeededResultsAndAccessPath`, `CursorContinuesAcrossEquivalentSqlJsonAndCSharpForms`, `NullMissingAndInHaveExplicitCanonicalSemantics`, `BuilderBranchesHaveIndependentQueryContexts` in QueryAdapterTests |
 | REQ-QUERY-006: planner, Explain and continuation preserve cut, scope and policy authority | AC-QUERY-006: point, index and full-scan paths obey the same authorization; tampered, wrong-scope and stale cursors are rejected; a source or policy change invalidates the matching cursor; protocol metadata counts toward the result bound | Existing `InvalidCursorIsRejectedBeforeACollectionScan`, `CatalogAndOtherCollectionWritesPreserveTheCursorButSourceWritesInvalidateIt`; SecurityAndQueryTests revocation cases |
 | REQ-QUERY-007: extended and distributed operators are declared only after versioned semantics and qualification | AC-QUERY-007: capability fixtures and real cluster tests prove the declared partition cuts, failure, cursor and budget semantics; unsupported joins, graph and search extensions remain explicitly unsupported, with no silent client-side evaluation | Distributed and extended AST ADR contract suites |
-| REQ-QUERY-009: a query ordered by ascending document id pages through any collection with work bounded per page | AC-QUERY-009: each id-ordered page continues after the last id of the previous page instead of an offset; a full scan seeks to that key and stops one accepted row past the page, so every document is read once and each page examines only its own rows; no request asks storage for more records than one range read may examine | `QueryKeysetPagingTests`, `QueryCursorTests`, `QueryAdapterContractTests` |
+| REQ-QUERY-009: a query ordered by ascending document id pages through any collection with work bounded per page | AC-QUERY-009: each id-ordered page continues after the last id of the previous page instead of an offset; a full scan seeks to that key and stops one accepted row past the page, so every document is read once and each page examines only its own rows; no request asks storage for more records than one range read may examine | `QueryKeysetPagingTests`, `QueryKeysetDeletedRangesTests`, `StorageRangePagingTests`, `QueryCursorTests`, `QueryAdapterContractTests` |
+
+Complete range traversal stops its internal visitor at the provider's record ceiling before a lookahead can exceed that physical page's work budget. It resumes after the last delivered storage key inside the same owning gate. An internal page boundary does not become the caller's terminal stop; an explicit caller stop remains terminal even at that boundary. A contiguous range of deleted documents can therefore span storage pages while the query continues collecting its requested live rows. Physical examined-record, byte, read-cut and cancellation checks remain enforced by their existing owners.
 
 Q1 provides typed adapter validation, authorization, deterministic scalar order, a bounded current-cut query and cursor, and a capability manifest. A global serializable snapshot, arbitrary joins and user delegates, and cross-shard execution are not declared implemented. [Search](Search.md) and [ChangeFeeds](ChangeFeeds.md) have their own behavior contracts; a live scalar query uses the same safe query boundary.