Document keyed recovery and row identity contracts

Complete the canonical contract fanout for socket-owned delta baselines and independently reconciled logical table rows across alerts, performance, and frontend primitives.

Change-source: pulse-maintainer

docs/release-control/v6/internal/subsystems/alerts.md

@@ -297,14 +297,19 @@ The websocket store's raw resource-delta baseline is connection-scoped. Closing
 or replacing a socket invalidates that baseline and its recovery throttle; a
 delta from the replacement connection must not patch the previous connection's
 raw snapshot. Only a full snapshot delivered over that socket may establish
-the new delta baseline. Oversized-state REST recovery may refresh the current
-connection's display state, but it is independently built and must remain
-delta-free; a marker or baseline-less delta observed during hydration must
-coalesce one trailing REST refresh after the throttle window so the latest
-invalidation is not lost. Late socket callbacks and REST responses from a
-retired connection must be ignored, while a current oversized connection
-remains free to hydrate without waiting for the retired connection's request
-to settle.
+the new delta baseline. The same lineage rule applies independently to the
+connected-infrastructure and active-alert keyed projections. Dropping an
+oversized state frame invalidates all three raw baselines and their queued
+projection work. Oversized-state REST recovery may refresh the current
+connection's displayed resources, infrastructure, and alerts, but it is
+independently built and must remain delta-free; a later keyed delta without a
+socket-owned baseline is ignored and requests the shared throttled recovery
+path. A marker or baseline-less delta observed during hydration must coalesce
+one trailing REST refresh after the throttle window so the latest invalidation
+is not lost. Alert deltas still apply immediately when their socket baseline
+exists. Late socket callbacks and REST responses from a retired connection
+must be ignored, while a current oversized connection remains free to hydrate
+without waiting for the retired connection's request to settle.
 While the document is hidden, that same connection-scoped baseline must keep
 accepting resource deltas without reconciling the visible resource store on
 every message. The store accumulates changed resource IDs (and their per-key

docs/release-control/v6/internal/subsystems/frontend-primitives.md

@@ -105,7 +105,13 @@ browser moves the page, and must update their runway only from the passive
 native scroll event. Spacer geometry is structural only: no feature may present
 it as loading, pagination, or an intentionally blank data region. Settings
 resource pickers, Availability target lists, Actions, alerts, and every
-provider-native platform table share this contract.
+provider-native platform table share this contract. For table rows with unique
+logical ids, or an explicit unique key extractor, `PlatformWindowedRows` owns a
+stable wrapper and independently reconciled store per logical row. A live
+snapshot may reorder those wrappers without remounting row-local input or
+drawer state, and must never reconcile one row's nested value through another
+row or duplicate rows after sorting. Missing or duplicate keys retain the
+reference-keyed fallback.
 
 Shared workload, node, Docker-host, and resource-drawer history presentation
 keeps current readings separate from stored samples. A current metric may

docs/release-control/v6/internal/subsystems/performance-and-scalability.md

@@ -265,7 +265,12 @@ the store with reference-stable untouched items so the per-tick deep walk of
 the whole projection is gone. Active alerts travel the same keyed transport
 (`activeAlertsDelta`, replacing the ~37KB whole-array re-ship whenever any
 alert changed) while their application stays immediate per the alerts
-subsystem boundary. Workload table rows derived from canonical
+subsystem boundary. These projection baselines are socket-owned: an oversized
+frame invalidates resources, connected infrastructure, and active alerts
+together, while REST recovery hydrates display state only. A later keyed delta
+without a socket baseline requests the throttled recovery path instead of
+patching an independently built REST array or silently retaining a stale
+projection. Workload table rows derived from canonical
 snapshots reuse the previous row object whenever the serialized row is
 unchanged, and a refresh that changes nothing returns the previous row array
 itself, so per-tick row identity churn stays bounded to guests whose data
@@ -957,7 +962,13 @@ change may globally weaken the Task 03 lifecycle-state idempotency invariant.
     runway only through the passive native scroll event after the page moves.
     Group and guest iteration must remain keyed so overlapping rows survive
     window shifts rather than rebinding every mounted row. This anticipation
-    must preserve the existing bounded mounted-row budget; rendering the whole
+    extends to platform rows rebuilt by live snapshots: a unique logical id or
+    explicit key extractor owns one stable wrapper and independently
+    reconciled row store. Sorting may reorder those wrappers but must not
+    reconcile one row's nested value through another row, duplicate rendered
+    rows, or remount row-local drawer and input state. Missing or duplicate
+    keys fall back to reference-keyed rendering. This anticipation must
+    preserve the existing bounded mounted-row budget; rendering the whole
     estate or adding per-row observers, timers, or scroll listeners is
     forbidden.
     That same viewport-sync owner may expose one passive app-shell scroll