feat: build shared cell-group multi-Raft runtime

.github/workflows/javascript-sdk.yml

@@ -221,7 +221,8 @@ jobs:
       - name: Quality and engine boundaries
         if: matrix.profile == 'adapters'
         run: |
-          cargo clippy --locked -p cellar-container -p cellar-guest -p cellar-javascript --features cellar-javascript/embed,cellar-javascript/node --all-targets -- -D warnings
+          # Keep dead code visible during the cell-group cutover.
+          cargo clippy --locked -p cellar-container -p cellar-guest -p cellar-javascript --features cellar-javascript/embed,cellar-javascript/node --all-targets -- -D warnings --force-warn dead_code
           cargo format --check
           cargo check-layout
           python3 tools/check_native_dependencies.py

.github/workflows/native-sdk.yml

@@ -336,7 +336,8 @@ jobs:
       - name: Doctests and Clippy
         run: |
           cargo test --workspace --exclude cellar-javascript --exclude cellar-rpc-qualification --all-features --doc --locked
-          cargo clippy --workspace --exclude cellar-javascript --exclude cellar-rpc-qualification --all-targets --all-features --locked -- -D warnings
+          # Keep dead code visible during the cell-group cutover.
+          cargo clippy --workspace --exclude cellar-javascript --exclude cellar-rpc-qualification --all-targets --all-features --locked -- -D warnings --force-warn dead_code
       - name: Qualify dense filesystem writes and cold recovery
         env:
           # Match the native campaign while retaining its correctness checks.

.github/workflows/typed-rpc.yml

@@ -87,7 +87,8 @@ jobs:
           cargo test --locked -p cellar-rpc-codegen -- --test-threads=1
           python3 tools/python/test_bridge_report.py
           python3 -m unittest discover -s tools/perf -p test_python_fleet.py
-          cargo clippy --locked -p cellar-rpc-qualification --all-targets --features full -- -D warnings
+          # Keep dead code visible during the cell-group cutover.
+          cargo clippy --locked -p cellar-rpc-qualification --all-targets --features full -- -D warnings --force-warn dead_code
           cargo test --locked -p cellar-rpc-qualification --features full -- --test-threads=1
       - name: Finish build writeback before live qualification
         run: |

.gitignore

@@ -37,6 +37,8 @@ console-audit.sqlite*
 
 # Keep new local multi-Raft benchmark evidence out of commits.
 /docs/design/multi-raft/evidence/
+# Retain historical local evidence at its source-bound paths.
+/plans/multi-raft/evidence/
 
 # Reproducible streaming example builds.
 /examples/streaming/app.bundle.js*

crates/cellar-admin/README.md

@@ -99,7 +99,14 @@ For an existing managed fleet, add `raft` to its private dashboard configuration
       "catalog_prefix": "raft/",
       "scope": "bucket",
       "managed": true,
-      "image_storage": "Materialized"
+      "image_storage": "Materialized",
+      "group_directory": {
+        "max_groups": 1000000,
+        "max_mutations": 1000000,
+        "max_cached_pages": 64,
+        "max_cache_bytes": 4194304,
+        "operation_timeout_ms": 5000
+      }
     }
   ]
 }
@@ -145,13 +152,16 @@ Graceful node departure adds independent `fleet_evacuate`, `fleet_remove` and
 then exclude it, prepare the complete-inventory finalization fence, explicitly
 request the exact process stop, and consume its signed joined closure in terminal
 removal. The embedding server must additionally configure
-`RaftFleetControl::with_removal_verifier` with its private bounded replay store;
-extent namespaces additionally require `ArchiveVerifier::with_extent_store`
-with a separate exclusively owned, initially empty `NodeExtentStore`. Never
-supply a live node's inventory. Each proof freshly downloads and seals the exact
-remote extent closure in this scratch owner. Entered physical work retains the
-owner after cancellation; a subsequent attempt reconciles scratch only after that
-work exits. Physical inventory quarantine still refuses verification.
+`RaftFleetControl::with_removal_verifier` with a `FleetGroupArchiveVerifier`.
+Its explicit replay options supply private bounded materialized/extent inventories,
+page limits and node-shared archive, checkpoint, tail and scratch pools. Never
+supply a live node's inventory. Each proof downloads the complete group checkpoint
+and replays its contiguous committed tail. An exact acquire intent is journaled
+before S3 mutation, and restart restores its original fixed cut and allocation.
+Entered physical work retains page/image ownership and memory admission after
+cancellation; physical inventory quarantine still refuses verification. Persistent
+holds remain retained until an explicit owner can fence users and join their work;
+dropping a controller or timing out does not release remote retention.
 Standalone existing-root connections cannot perform live proof or dispatch stop.
 Status and exact committed receipt reconciliation remain metadata operations.
 See the [departure workflow](../../docs/design/multi-raft/fleet-operations/operator-workflows.md#evacuate-and-permanently-remove-a-node)

crates/cellar-admin/lib.rs

@@ -10,6 +10,7 @@ mod cron;
 mod events;
 mod nodes;
 mod raft;
+mod raft_first_group;
 mod raft_lifecycle;
 mod raft_maintenance;
 mod raft_nodes;
@@ -109,6 +110,22 @@ pub fn router(console: Console) -> Result<Router> {
             "/fleets/{fleet}/raft/nodes",
             post(raft_nodes::register).layer(DefaultBodyLimit::max(16 * 1024)),
         )
+        .route(
+            "/fleets/{fleet}/raft/namespaces/{namespace}/first-group/standby",
+            get(raft_first_group::standby),
+        )
+        .route(
+            "/fleets/{fleet}/raft/namespaces/{namespace}/first-group/reserve",
+            post(raft_first_group::reserve),
+        )
+        .route(
+            "/fleets/{fleet}/raft/namespaces/{namespace}/first-group/publish",
+            post(raft_first_group::publish),
+        )
+        .route(
+            "/fleets/{fleet}/raft/namespaces/{namespace}/first-group/archive",
+            post(raft_first_group::archive),
+        )
         .route("/fleets/{fleet}/raft/nodes/{node}", get(raft_nodes::status))
         .route(
             "/fleets/{fleet}/raft/nodes/{node}/qualify",

crates/cellar-admin/raft_first_group.rs

@@ -0,0 +1,177 @@
+// Copyright 2026 Cellar Project Authors. Licensed under Apache-2.0.
+
+//! Bind first-group operations to the authenticated fleet and namespace.
+use crate::{
+    api::ApiError,
+    raft::{audit_failure, backend, failure, finish, hex_digest, TIMEOUT},
+    Console, Permission, Principal,
+};
+use axum::{
+    extract::{rejection::JsonRejection, Path, State},
+    response::{IntoResponse, Response},
+    Extension, Json,
+};
+use cellar::sdk::fleet_operations::*;
+use serde::Serialize;
+use std::sync::Arc;
+
+pub(crate) async fn standby(
+    State(console): State<Arc<Console>>,
+    Extension(principal): Extension<Principal>,
+    Path((fleet, namespace)): Path<(String, String)>,
+) -> Result<Response, ApiError> {
+    principal.require(&fleet, Permission::MetadataRead)?;
+    Ok(match backend(&console, &fleet) {
+        Ok(control) => match control.first_group_standby(&namespace, TIMEOUT).await {
+            Ok(value) => Json(value).into_response(),
+            Err(error) => failure(error),
+        },
+        Err(error) => failure(error),
+    })
+}
+
+pub(crate) async fn reserve(
+    State(console): State<Arc<Console>>,
+    Extension(principal): Extension<Principal>,
+    Path((fleet, namespace)): Path<(String, String)>,
+    body: Result<Json<RaftFleetFirstGroupPlan>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    principal.require(&fleet, Permission::FleetTopology)?;
+    let Ok(Json(plan)) = body else {
+        return Ok(failure(RaftFleetFailure::invalid(
+            "invalid first group plan",
+        )));
+    };
+    submit(
+        &console,
+        &principal,
+        &fleet,
+        &namespace,
+        Mutation::Reserve(plan),
+    )
+    .await
+}
+
+pub(crate) async fn publish(
+    State(console): State<Arc<Console>>,
+    Extension(principal): Extension<Principal>,
+    Path((fleet, namespace)): Path<(String, String)>,
+    body: Result<Json<RaftFleetFirstGroupPublish>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    principal.require(&fleet, Permission::FleetTopology)?;
+    let Ok(Json(request)) = body else {
+        return Ok(failure(RaftFleetFailure::invalid(
+            "invalid first group confirmation",
+        )));
+    };
+    submit(
+        &console,
+        &principal,
+        &fleet,
+        &namespace,
+        Mutation::Publish(request),
+    )
+    .await
+}
+
+pub(crate) async fn archive(
+    State(console): State<Arc<Console>>,
+    Extension(principal): Extension<Principal>,
+    Path((fleet, namespace)): Path<(String, String)>,
+    body: Result<Json<RaftFleetFirstGroupMutation>, JsonRejection>,
+) -> Result<Response, ApiError> {
+    principal.require(&fleet, Permission::FleetTopology)?;
+    let Ok(Json(request)) = body else {
+        return Ok(failure(RaftFleetFailure::invalid(
+            "invalid first group archive request",
+        )));
+    };
+    submit(
+        &console,
+        &principal,
+        &fleet,
+        &namespace,
+        Mutation::Archive(request),
+    )
+    .await
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "snake_case")]
+enum Mutation {
+    Reserve(RaftFleetFirstGroupPlan),
+    Publish(RaftFleetFirstGroupPublish),
+    Archive(RaftFleetFirstGroupMutation),
+}
+
+async fn submit(
+    console: &Console,
+    principal: &Principal,
+    fleet: &str,
+    namespace: &str,
+    mutation: Mutation,
+) -> Result<Response, ApiError> {
+    let (plan, request_id, action, valid) = match &mutation {
+        Mutation::Reserve(plan) => (
+            plan,
+            &plan.request_id,
+            "raft_first_group_reserve",
+            plan.validate(namespace),
+        ),
+        Mutation::Publish(request) => (
+            &request.plan,
+            &request.request_id,
+            "raft_first_group_publish",
+            request.validate(namespace),
+        ),
+        Mutation::Archive(request) => (
+            &request.plan,
+            &request.request_id,
+            "raft_first_group_archive",
+            request.validate(namespace),
+        ),
+    };
+    if let Err(error) = valid {
+        return Ok(failure(error));
+    }
+    let fingerprint = match serde_json::to_vec(&mutation) {
+        Ok(bytes) => hex_digest(&bytes),
+        Err(_) => {
+            return Ok(failure(RaftFleetFailure::invalid(
+                "invalid first group request",
+            )))
+        }
+    };
+    let mut audit = match console.audit.begin(
+        &format!("raft-{}-{request_id}", plan.catalog_id),
+        fleet,
+        &principal.id,
+        &format!("raft/namespaces/{namespace}/first-group"),
+        action,
+        &fingerprint,
+    ) {
+        Ok(value) => value,
+        Err(error) => return Ok(audit_failure(error)),
+    };
+    let result = match backend(console, fleet) {
+        Ok(control) => match &mutation {
+            Mutation::Reserve(plan) => {
+                control
+                    .reserve_first_group(&principal.id, namespace, plan, TIMEOUT)
+                    .await
+            }
+            Mutation::Publish(request) => {
+                control
+                    .publish_first_group(&principal.id, namespace, request, TIMEOUT)
+                    .await
+            }
+            Mutation::Archive(request) => {
+                control
+                    .initialize_first_group_archive(&principal.id, namespace, request, TIMEOUT)
+                    .await
+            }
+        },
+        Err(error) => Err(error),
+    };
+    finish(console, &mut audit, result)
+}