[forhappy]

This draft replaces one-cell Raft ownership with physical cell groups. Independent SQLite cells share one Raft machine per group replica while retaining their histories, receipts, effects and versions. The full MVP and hard cutover remain unfinished; this PR is not merge-ready.

The implementation includes namespace/range routing, replicated enrollment, complete manifests/checkpoints, follower reads, membership send fences, archives/reclamation, fenced fresh-history recovery, indexed effects and bounded caches. Managed startup, directory refresh, capacity, peer/S3 replacement, maintenance and retained restart have scoped coverage. Automatic failed-voter recovery reaches terminal removal with independent S3 replay and retained obsolete data.

Latest change

Public SDK writes sent to a follower previously attempted local SQL and returned NotLeader despite a healthy known leader. The controller now owns one forwarding hop for a queued originating SDK command, retaining its command identity, captured inputs, admission and original deadline. Incoming commands and the lower-level controller command API remain local-only. A leader hint grants no execution authority. Any possible outbound transmission makes an error ambiguous; the owner does not invent a retry identity or automatically retry an uncertain mutation.

Managed peers can explicitly grant/revoke namespace command-origin permission after discovery verifies their actual boots and endpoints. The SDK checks its owned namespace; transport checks current process identity and monotonic permission revisions. Membership grants no write permission. These are trusted host configuration APIs; running-transport permissions must be reapplied from trusted policy after restart.

Command output distinguishes local inspected SQL receipts from authenticated remote results. Common result/observation/token/durability accessors work for either; local_receipt is present only for the local variant. Effects, wire encoding and physical qualification oracles require local proof. Existing physical assertions retain that requirement explicitly; no remote output is converted into a local image/archive proof.

The counter explicitly grants its configured peers permission for its namespace. Its process drill now requires the same original receipt to succeed through all six native/Axum addresses, both before and after retained restart; searching for a leader cannot hide broken forwarding.

Current-source qualification

Based on latest fetched origin/main 981a5417d9359d1f992e2dbf214eec7d221b6777.

• Eleven complete native cell-group targets: 308 passed, 2 failed, 39 explicit skips. The full campaign is FAILED. The new managed HTTP case and strengthened public SDK/counter process/restart gate pass; eight-turn maintenance replacement settlement and successor readiness after S3 source-service closure fail. Their disks/logs and original bounds are retained.
• The managed HTTP case covers cold capacity/group birth and replicated enrollment, independent cells, native/Axum follower writes, remote AtLeast/linearizable reads with actual responder identity, conflicting retries, cross-cell token refusal, grant/revocation and stale-process/foreign-namespace refusal, forwarded S3 acknowledgement, joined leader-stop failover, retained restart/old receipts/version floors/new writes, and quorum-loss refusals. Both image forms run.
• Four exact real-RustFS invocations: managed request run1: PASS (53.37s); managed request run2: PASS (50.61s); archived maintenance: PASS (88.53s); automatic S3 recovery: PASS (45.41s). Backend matrix status: PASSED. Each request case runs both image forms. The failed native campaign remains attached as prerequisite evidence; component passes do not waive it. Signed readiness/conditional probes pass. The pinned one-CPU/two-GiB backend and dedicated VM are stopped with data retained.
• Format/layout/dependency/docs/native-only Cellar/Python-library/diff checks pass. Strict library Clippy remains red: 220 reports, 202 dead-code reports, with no diagnostic-key additions. Plan tests/validate/preflight remain red for generated-index/Purpose and reviewed source drift. No suppression or silent anchor refresh is applied.

Code manifest: da3514ed9ea2dd614a45f3150f92d2280f75795287b7469a5883f72564b1a87c (2,726 Rust/Python/manifest inputs).
Native FAILED record: 6a4f24b43031c9b9cab3a996edd3b3bf280ecf494a2a231d997912b0e75098e7.
Managed request component record: 8f6e418e605c0d56a635b245ded5cc423d7657cf8f548bdc40109cdb3bdac1a8.
RustFS record: 646ebe709b457b540a97a12e85e43aade6aee1fbbb445a5d37d84a2650330695.

All results use the original local default stack, opt-level 0, assertions/overflow checks, quotas and existing operation/movement bounds. The leader-stop test joins shutdown; it is not a process-crash or partition drill. RustFS is constrained; voters remain host-native embedded Nodes with fixture capacity/isolation. These results do not qualify independent constrained voter containers, permanent launch fencing, sustained load or release.

The deterministic follower-write failure was reproduced before the fix. Earlier unseeded maintenance, ambiguous-write, transfer/readiness, eight-turn replacement, TCP, enrollment and inspection failures remain unwaived. Earlier disk-erasure RustFS recovery retains its recorded source and fence scope; it is not relabeled as this campaign.

Remaining priorities

1. Complete bounded command leader discovery for ingress without a local replica. Current automatic selection uses local physical group status. Finish normal namespace provisioning and managed SDK/CLI/daemon/native/Axum/admin/example default wiring without weaker fallback.
2. Deliver the four remaining original public gates: complete managed_group_lifecycle, ingress_cannot_cross_cell_authority, occupancy_one_uses_shared_path and feature_off_fleet_contract_unchanged. Finish retained surviving-voter debt and lifecycle failure/cancellation ownership.
3. Resolve Workflow/Queue callbacks, WebSockets and mutable-container capability coverage before broad default enablement. Queries still default stale; quorum writes do not imply linearizable reads.
4. Diagnose retained reliability failures; finish manifest-page collection, 128-cell enrollment, inspection, strict lint, plan reconciliation and SDK CI feature/profile modes.
5. Qualify independent constrained Linux voters with real RustFS, permanent Docker launch fencing, crashes/partitions/quorum/archive loss and bounded mixed replication/reclamation load with complete ledgers.
6. Complete CG-09–16: transfers, split/merge, placement, hibernation/wakeup, managed multi-group recovery, load/crash qualification and predecessor removal.

CG-07 remains IN_PROGRESS. RF3 quorum writes with asynchronous S3 archives are the intended default contract, with measured archive lag/RPO; explicit S3 acknowledgement requires complete coverage. Selecting the default backend for new cells remains unfinished. Existing Fleet data must not be reinterpreted as Raft data; no online conversion or legacy/shared switch is supplied.

The requested MR-13/MR-14 progress JSON files remain excluded from the entire PR diff.

See progress, remaining work and qualification.