Adopt native ZoneTree MVCC and refresh published packages

Use ZoneTree 2.0.6 transactions and retained read snapshots at data epoch 8. Remove the superseded value header path and its exclusive support. Clear the physical logical image before applying a complete journal checkpoint so deleted disk records cannot reappear.

Validation: restore, full formatting and verification, all 21 Debug projects with warnings as errors, governance, source closure, shard partition and 3309-case discovery pass. Focused checks pass: 261 storage, 215 process recovery, four checkpoint, two deleted-range SQL, ONE/RF3 SDK/MCP/SQL gates and targeted settlement/text/restart cases. Combined-source Linux release qualification and released-image benchmarks remain required.

Author: KSemenenko

AGENTS.md

@@ -13,6 +13,13 @@ stop that approach and remove your own speculative additions. Apply this rule
 immediately, including to your previous changes, while preserving unrelated work
 and required correctness gates.
 
+KeyLoad is under development. Replace superseded implementations completely when
+adopting an approved new design. Remove their exclusive helpers, contracts, tests
+and documentation together. Keep one current implementation; do not preserve old
+formats, backward compatibility routes or conversion mechanisms. The native
+ZoneTree MVCC storage adoption uses the current data epoch across storage and
+internal request purposes.
+
 ## Product and runtime
 
 KeyLoad is one database for AI agents. Documents, typed tables, graphs,

Directory.Packages.props

@@ -7,7 +7,7 @@
   <ItemGroup>
     <PackageVersion Include="Cartograph" Version="0.1.0-alpha" />
     <PackageVersion Include="Cartograph.Catalog" Version="0.1.0-alpha" />
-    <PackageVersion Include="ZoneTree" Version="2.0.5" />
+    <PackageVersion Include="ZoneTree" Version="2.0.6" />
     <PackageVersion Include="ZoneTree.Analytics" Version="1.0.2" />
     <PackageVersion Include="ZoneTree.FullTextSearch" Version="1.1.0" />
     <PackageVersion Include="ManagedCode.Communication" Version="10.3.20" />
@@ -18,7 +18,7 @@
     <PackageVersion Include="ManagedCode.Storage.Server" Version="10.1.7" />
     <PackageVersion Include="ManagedCode.Orleans.Graph" Version="10.4.8" />
     <PackageVersion Include="ManagedCode.Orleans.Identity.Core" Version="10.4.2" />
-    <PackageVersion Include="ManagedCode.MCPGateway" Version="2.3.2" />
+    <PackageVersion Include="ManagedCode.MCPGateway" Version="2.3.3" />
     <PackageVersion Include="ManagedCode.MarkdownLd.Kb" Version="0.2.18" />
     <!-- Central transitive dependency used by Aspire and StreamJsonRpc. -->
     <PackageVersion Include="MessagePack" Version="3.1.12" />
@@ -31,18 +31,18 @@
     <PackageVersion Include="System.IO.Hashing" Version="10.0.14" />
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.3.0" />
     <PackageVersion Include="ModelContextProtocol.Core" Version="2.3.0" />
-    <PackageVersion Include="Microsoft.Orleans.Server" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.Client" Version="10.4.1" />
+    <PackageVersion Include="Microsoft.Orleans.Server" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.Client" Version="10.4.2" />
     <PackageVersion Include="ManagedCode.Orleans.RapidMembership" Version="10.4.6" />
-    <PackageVersion Include="Microsoft.Orleans.Streaming" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.Reminders" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.Journaling" Version="10.4.1-alpha.1" />
-    <PackageVersion Include="Microsoft.Orleans.DurableJobs" Version="10.4.1-alpha.1" />
-    <PackageVersion Include="Microsoft.Orleans.Sdk" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.Serialization" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.Serialization.SystemTextJson" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.CodeGenerator" Version="10.4.1" />
-    <PackageVersion Include="Microsoft.Orleans.TestingHost" Version="10.4.1" />
+    <PackageVersion Include="Microsoft.Orleans.Streaming" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.Reminders" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.Journaling" Version="10.4.2-alpha.1" />
+    <PackageVersion Include="Microsoft.Orleans.DurableJobs" Version="10.4.2-alpha.1" />
+    <PackageVersion Include="Microsoft.Orleans.Sdk" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.Serialization" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.Serialization.SystemTextJson" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.CodeGenerator" Version="10.4.2" />
+    <PackageVersion Include="Microsoft.Orleans.TestingHost" Version="10.4.2" />
     <!-- Orleans' existing Roslyn dependency; analyzer tests select SDK compiler assets. -->
     <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="5.9.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
@@ -72,7 +72,7 @@
     <PackageVersion Include="MySqlConnector" Version="2.6.2" />
     <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
     <PackageVersion Include="RabbitMQ.Client" Version="7.2.2" />
-    <PackageVersion Include="StackExchange.Redis" Version="3.4.20" />
+    <PackageVersion Include="StackExchange.Redis" Version="3.4.29" />
     <PackageVersion Include="MongoDB.Driver" Version="3.13.0" />
     <PackageVersion Include="KurrentDB.Client" Version="1.6.1" />
   </ItemGroup>

README.md

@@ -185,7 +185,7 @@ for ownership, distributed queries and open qualification gates.
 |---|---|
 | [.NET 10](https://github.com/dotnet/runtime) | C# end to end, pooled buffers, `Span<T>` and SIMD intrinsics; speedups need measurements |
 | [Orleans](https://github.com/dotnet/orleans) | The whole cluster: membership, routing, placement, migration, communication, data copies through grain calls and generated binary serialization |
-| [ZoneTree](https://github.com/ZoneTree/ZoneTree) | Embedded ordered storage and a write-ahead log for every model; data stays on its node |
+| [ZoneTree](https://github.com/ZoneTree/ZoneTree) | Native MVCC transactions and consistent snapshots over each node's ordered data |
 | [ZoneTree.FullTextSearch](https://github.com/ZoneTree/ZoneTree.FullTextSearch) | full-text indexing on the same storage foundation |
 | [Aspire](https://github.com/dotnet/aspire) | Owns server startup, required infrastructure, readiness and cleanup |
 

docs/ADR/ADR-005-canonical-keyspace-codec.md

@@ -38,7 +38,7 @@ flowchart LR
 This decision adds REQ-KEYCODEC-001..004 and AC-KEYCODEC-001..004 in
 [StorageRecovery](../Features/StorageRecovery.md). This freezes validation of
 the existing format; every byte emitted for a supported valid existing key
-remains unchanged. Identity digests, aliases/Ids, current data epoch7, journals,
+remains unchanged. Identity digests, aliases/Ids, current data epoch8, journals,
 cluster and public wire DTOs remain unchanged. Unsupported data epochs fail closed.
 
 The v1 type order is missing10, null11, bool20, int64/normalized int30, decimal31,

docs/ADR/ADR-060-internal-serialization.md

@@ -4,14 +4,14 @@ Status: Accepted. Current owner direction: 2026-10-19.
 
 ## Decision
 
-The official Orleans 10.4.1 generated serializer owns binary encoding, decoding,
+The official Orleans 10.4.2 generated serializer owns binary encoding, decoding,
 type metadata, object references, collections and field evolution. KeyLoad has no
 custom field codec, binary grammar, assembly-name selector, per-assembly service
 provider cache, wire walker or replacement JSON DOM serialization model.
 
 The shared serialization entry uses one standard `AddSerializer` registration
 and native pooled sessions. `JsonElement` alone uses the official
-`Microsoft.Orleans.Serialization.SystemTextJson` 10.4.1 codec; other attributed
+`Microsoft.Orleans.Serialization.SystemTextJson` 10.4.2 codec; other attributed
 contracts use generated binary codecs. This is an explicit type registration,
 not a general-purpose JSON serializer selection rule.
 

docs/ADR/ADR-105-published-nuget-upgrade.md

@@ -1,7 +1,7 @@
 # ADR-105: Published NuGet dependency refresh
 
 Status: Accepted; local dependency integration checked. Complete delivered-source qualification remains open.
-Date: 2026-10-29.
+Date: 2026-10-30.
 Feature: [RepositoryGovernance](../Features/RepositoryGovernance.md).
 
 ## Context and decision
@@ -12,10 +12,10 @@ the configured NuGet.org feed. Use the newest published stable release. Cartogra
 and Cartograph.Catalog have only their existing 0.1.0-alpha release; keep that
 published version. Do not introduce previews into stable package families.
 
-The 2026-10-29 feed audit selects Orleans 10.4.1, with Journaling and Durable
-Jobs at 10.4.1-alpha.1, ManagedCode.Storage.Server/FileSystem 10.1.7 and
+The 2026-10-30 feed audit selects ZoneTree 2.0.6 and Orleans 10.4.2, with Journaling and Durable
+Jobs at 10.4.2-alpha.1, ManagedCode.Storage.Server/FileSystem 10.1.7 and
 TUnit/TUnit.Aspire 1.76.45. The existing transitive Orleans.Client and
-Orleans.Reminders dependencies are centrally pinned to 10.4.1 so the runtime
+Orleans.Reminders dependencies are centrally pinned to 10.4.2 so the runtime
 family remains aligned. The remaining central pins, Aspire.AppHost.Sdk and the
 existing local tools are already current.
 RapidMembership 10.4.6 is rebuilt against Orleans 10.4.1 in its owning repository.
@@ -58,9 +58,10 @@ flowchart LR
 
 ## Rollout, rollback and failure contracts
 
-No KeyLoad schema, serializer aliases/field IDs, protocol, persisted authority,
-cluster membership or node-local ownership changes are selected. The existing
-recovery/serialization tests must detect dependency incompatibility. No compatibility or performance claim follows from version alignment or compilation.
+Serializer aliases/field IDs, cluster membership and node-local ownership stay
+with their current owners. The native MVCC storage format and data epoch are
+specified in [NativeMvcc](../Features/StorageRecovery/NativeMvcc.md). The existing
+recovery/serialization tests must detect dependency integration defects. No compatibility or performance claim follows from version alignment or compilation.
 Restore failure, downgrade, analyzer failure, runtime regression or missing
 infrastructure leaves qualification open. A reproducible dependency defect must
 be repaired at its actual owner; never suppress diagnostics to complete refresh.

docs/Architecture.md

@@ -154,7 +154,7 @@ volume's locking and flush behavior.
 
 Sources: [Orleans stateless workers](https://learn.microsoft.com/en-us/dotnet/orleans/grains/stateless-worker-grains),
 [grain directory](https://learn.microsoft.com/en-us/dotnet/orleans/host/grain-directory),
-and [the pinned ZoneTree WAL open contract](https://github.com/ZoneTree/ZoneTree/blob/dea002a935e0de8ed6bae98b526556c440b6b467/src/ZoneTree/WAL/Sync/SyncFileSystemWriteAheadLog.cs).
+and [the pinned ZoneTree WAL open contract](https://github.com/ZoneTree/ZoneTree/blob/bd11bd6d2b6ce022acd009ac5b31a254f09b7655/src/ZoneTree/WAL/Sync/SyncFileSystemWriteAheadLog.cs).
 
 Credentials and authorization policies are persisted in the database; callers
 never supply trusted roles. Standard ASP.NET Core authentication admits HTTP,

docs/Features/InternalSerialization.md

@@ -1,6 +1,6 @@
 # InternalSerialization
 
-The official Orleans 10.4.1 generated serializer encodes owned internal DTOs.
+The official Orleans 10.4.2 generated serializer encodes owned internal DTOs.
 [ADR-060](../ADR/ADR-060-internal-serialization.md) defines the current contract.
 Public HTTP/MCP JSON, exact user content, sortable keys, opaque ZoneTree bytes,
 canonical hashes and blob payloads retain their concrete owning boundaries.

docs/Features/OrleansExecution/CapabilityReview.md

@@ -24,8 +24,8 @@ The review covers the capability families in the
 the [overview](https://learn.microsoft.com/en-us/dotnet/orleans/overview), linked
 Learn topics, and APIs/source at
 [v10.4.0](https://github.com/dotnet/orleans/releases/tag/v10.4.0). The current
-central packages use [10.4.1](https://github.com/dotnet/orleans/releases/tag/v10.4.1),
-with Journaling and Durable Jobs at 10.4.1-alpha.1. Updating packages does not
+central packages use [10.4.2](https://github.com/dotnet/orleans/releases/tag/v10.4.2),
+with Journaling and Durable Jobs at 10.4.2-alpha.1. Updating packages does not
 qualify the runtime criteria below or repeat every original source review.
 
 `Source-present` means code or registration exists, not that its runtime gates
@@ -52,7 +52,7 @@ architecture judgments; no measured speed or memory benefit is inferred.
 | Activation state and caches — [lifecycle](https://learn.microsoft.com/en-us/dotnet/orleans/grains/grain-lifecycle) | Candidate: bounded validated caches rebuilt after migration. | Read-cut/policy-epoch identity, byte budget, invalidation and restart tests; never write or credential authority. |
 | `IPersistentState<T>` — [persistence](https://learn.microsoft.com/en-us/dotnet/orleans/grains/grain-persistence/) | Candidate: bounded snapshots through a ZoneTree adapter; no product grain uses it. | ETag CAS and uncertain-write recovery; never two writable copies of canonical state. |
 | Transactions — [transactions](https://learn.microsoft.com/en-us/dotnet/orleans/grains/transactions) | Candidate: short multi-grain transactions or a cross-partition SQL stage; current atomic batches are same-partition. | ZoneTree calls do not enlist automatically; an adapter must persist prepare/commit/abort to ReplicaCount copies with acknowledgement from every configured copy and define read visibility before any ACID claim. |
-| JournaledGrain and Orleans.Journaling — [journaling](https://github.com/dotnet/orleans/blob/v10.4.0/src/Orleans.Journaling/README.md) | Source-present under RuntimeJournal: the ZoneTree-backed journal provider used by Durable Jobs (10.4.1-alpha.1). Defer whole-history LogStorage. | binary format, ETag fencing, replay/compaction/corruption tests; recovery journals stay distinct. |
+| JournaledGrain and Orleans.Journaling — [journaling](https://github.com/dotnet/orleans/blob/v10.4.0/src/Orleans.Journaling/README.md) | Source-present under RuntimeJournal: the ZoneTree-backed journal provider used by Durable Jobs (10.4.2-alpha.1). Defer whole-history LogStorage. | binary format, ETag fencing, replay/compaction/corruption tests; recovery journals stay distinct. |
 | Durable Jobs — [README](https://github.com/dotnet/orleans/blob/v10.4.0/src/Orleans.DurableJobs/README.md) | Source-present: job handlers for due, ANN projection and time-series chunk work; persisted, at-least-once. | Idempotent effects, occurrence fences, missed-due restart and cancel/dispatch-race tests; a running attempt may finish after cancellation. |
 | Grain timers and reminders — [timers](https://learn.microsoft.com/en-us/dotnet/orleans/grains/timers-and-reminders) | Selected: the timer flush of StatelessWorker batches (not yet in source). Candidate: reminders for rare reconciliation; no provider today. | Bounded callback, joined disposal and a typed interval; a timer stops with its activation and never holds a durable schedule. |
 

docs/Features/StorageRecovery.md

@@ -8,7 +8,7 @@ Detailed contracts by topic:
 
 - Format and identity: [CurrentFormat](StorageRecovery/CurrentFormat.md), [IdentityAuthorityAdmission](StorageRecovery/IdentityAuthorityAdmission.md), [DispatchIdentityPublication](StorageRecovery/DispatchIdentityPublication.md), [MetadataRegularFileReader](StorageRecovery/MetadataRegularFileReader.md), [OwnerLockRegularFile](StorageRecovery/OwnerLockRegularFile.md).
 - Journal and checkpoint: [WriteThroughJournal](StorageRecovery/WriteThroughJournal.md), [JournalOriginalFailure](StorageRecovery/JournalOriginalFailure.md), [CheckpointOriginalCause](StorageRecovery/CheckpointOriginalCause.md), [SeededRedoCorruption](StorageRecovery/SeededRedoCorruption.md), [RecoveryFaultRootRetention](StorageRecovery/RecoveryFaultRootRetention.md).
-- Read cuts: [RuntimeReadCuts](StorageRecovery/RuntimeReadCuts.md), [TransactionalReadViewOperation](StorageRecovery/TransactionalReadViewOperation.md), [CapturedReadSelectedCancellation](StorageRecovery/CapturedReadSelectedCancellation.md), [LiveRangeSelectedCancellation](StorageRecovery/LiveRangeSelectedCancellation.md), [ValueHeaderRefusal](StorageRecovery/ValueHeaderRefusal.md).
+- Read cuts: [NativeMvcc](StorageRecovery/NativeMvcc.md), [RuntimeReadCuts](StorageRecovery/RuntimeReadCuts.md), [TransactionalReadViewOperation](StorageRecovery/TransactionalReadViewOperation.md), [CapturedReadSelectedCancellation](StorageRecovery/CapturedReadSelectedCancellation.md), [LiveRangeSelectedCancellation](StorageRecovery/LiveRangeSelectedCancellation.md).
 
 REQ-STORAGE-HOST-COMPOSITION-001 / AC-STORAGE-HOST-COMPOSITION-001: PartitionDatabaseComposition owns validation of the original host constructor inputs. PartitionHost invokes it at the same point before directory/storage acquisition, retaining the exact null checks and NodeOptions.Validate order. Ordered owner construction, rollback, materializer/verifier joins, store-close gate and all original failures remain unchanged. Existing host lifecycle, recovery and Aspire cluster whole operations plus the unchanged type200/function64 build gates verify this responsibility move; it introduces no new lifetime, operational policy or storage contract.
 
@@ -97,7 +97,7 @@ REQ-STORAGE-014 / AC-RC-003 (also AC-AISQL-014): the unchanged receipt is writte
 
 ## Descending bounded borrowed ranges
 
-REQ-STORAGE-013 / AC-RANGE-REV-001..003 ([ADR-052](../ADR/ADR-052-timeseries-bounded-aggregates.md)) accept the additive VisitReverseRange contract with the same exclusive bounds and borrowed lifetime as VisitRange. Private cursor, bounds and merge behavior are verified by real-store ReverseRangeTests, ReverseTransactionRangeTests and ReverseRangeResourceTests; interface and facade/budget forwarding stay unchanged. prefix-bounded NoRefresh reverse seek and SortedSet reverse enumeration preserve staged tombstones/replacements without complete buffering. Exact observer/lookahead/cancel/early-stop and healthy-following-operation tests are mandatory, with all existing forward tests preserved. seek failure disposal is covered by source/lifetime review, not by an executed fake fault case.
+REQ-STORAGE-013 / AC-RANGE-REV-001..003 ([ADR-052](../ADR/ADR-052-timeseries-bounded-aggregates.md)) accept the additive VisitReverseRange contract with the same exclusive bounds and borrowed lifetime as VisitRange. Private cursor, bounds and merge behavior are verified by real-store ReverseRangeTests, ReverseTransactionRangeTests and ReverseRangeResourceTests; interface and facade/budget forwarding stay unchanged. prefix-bounded native MVCC reverse seek and SortedSet reverse enumeration preserve staged tombstones/replacements without complete buffering. Exact observer/lookahead/cancel/early-stop and healthy-following-operation tests are mandatory, with all existing forward tests preserved. seek failure disposal is covered by source/lifetime review, not by an executed fake fault case.
 
 ```mermaid
 flowchart LR