Query authority oracle follow-up — 2026-10-12#

Four independent oracle reviewers examined PR #2065 at ebf7d024766dd70fb675ab57e6909f4419660562. This record evaluates their read-only findings and the subsequent oracle/documentation repair at c277333c4d605b7533096676f201a86c92e11325. The reviewers covered shared cache projection, fetch ordering, ownerless and persisted settlement, and checker calibration. The scratch intake preserved every provisional claim before verification. No production code changed in this follow-up.

Laws, experiments, and inference#

The Query Collection guide is the public authority. The maintainer also specified that the Query cache is the source of truth and Collections project it. Compatible eager Collections therefore share a representable cache edit. An on-demand peer that has already acquired that exact Query projects the edit; an unacquired peer needs its own server result. The ownership oracle now crosses both peer timings and a derived eager peer select. Both public Collections, the cache, and provider call count are compared at the write and held-fetch cuts. The mixed-mode source-reading claim was a useful missing law boundary, not a demonstrated product bug.

For a returned key held by overlapping on-demand subsets, the later-started successful fetch controls the public value while row ownership is continuous. The earlier oracle checked both settlement orders and owner releases, but the guide did not state the lifetime boundary. An executed two-cache probe found that after all owners release, reacquiring only the older Query with infinite staleTime and gcTime projects its cached older value without a request. A new legal oracle lane checks that older and newer cache entries each project their own value on separate reacquisition. This is consistent with the Query cache contract; it is not global last-fetch-ever precedence.

A complete unbounded matching result can retire an omitted ownerless direct row. It does not prove absence across another subset's retained Query cache. An executed probe inserted x directly, settled a later empty matching result, then settled an older overlapping response containing x: x disappeared and then reappeared. A second probe showed the same return without a direct write. These traces are real, but the accepted law orders two results that return the same key and the omission law concerns an ownerless row at its own result boundary. Negative authority across different Query entries would be a new product law. It would need a model for a complete scope's absent-key claim, controls for disjoint and windowed results, and a bounded retirement rule for old cached Queries. The guide and coverage map now state this limit; the proposed stronger law remains a design question rather than a claimed repaired defect.

The confirmed defect was in the oracle's legal-history grammar. Twenty-eight ownership histories used eq('field', value), which compares two constants; several authored provider rows lay outside the declared scope. The seven-case overlap model could pass an illegal history. All 28 sites now use real IR.PropRef field operands or legal union predicates; four multi-row fixtures needed union scopes. Two adjacent example tests were corrected too. The overlap driver now checks that its authored rows satisfy their actual predicates; it does not use the production expression compiler to calculate expected public rows. Reintroducing the literal-field predicate at the repaired head made all seven overlap cases fail at that admission guard; restoring it passed. This is an oracle integrity RED/GREEN, not a newly discovered production failure.

The ownerless oracle gained empty disjoint, offset, and cursor neighbors, matching and disjoint compound predicates, and a real SQLite restart with a disjoint durable sibling. A proposed public assertion for that sibling was rejected during testing: after restart, its on-demand scope had not been acquired, so durable presence was the valid observation. The final test checks the matching row's public and durable retirement and the sibling's durable preservation. A broad-predicate mutant failed three scope assertions; a window-classification mutant failed five, including empty offset and cursor cases. These checks protect the conditional omission rule without promoting an unacquired durable row into public state.

The cursor integration oracle's manual-write property is important generated coverage. It now has identical 50-run fixed-seed (20261012) and seedless campaigns for three cache shapes, plus direct seed/path replay. Its opening and local prose state the manual-write law, expected row fold, grammar, production path, checkpoints, and limits. A temporary page-cache fault failed the page state assertion and shrank to seed 20261012, path 0:0:0:0:0; direct replay reproduced the same assertion. A simultaneous cleanup fault retained the law failure as AggregateError.cause and recorded cleanup separately. Both faults were removed.

Lossless finding ledger#

The IDs preserve each reviewer's claims, including early claims later corrected by that reviewer. “Fixed” here means the oracle/documentation gap was repaired; it does not imply a production patch.

The raw count is 19: 12 fixed, four duplicates, and three design questions. No item is silently deferred. The three design IDs concern one unapproved cross-scope absence rule; their executed traces remain available for a future explicit law decision. The reviewers' corrections matter: neither OF1 nor S1 establishes the production bug initially suggested.

ORC-001–014 audit at the repaired code commit#

The full Query Collection suite passed 1,257 tests after the witness additions; the cursor integration file passed 47 tests after its final teardown refactor. Package TypeScript typecheck and build passed. ESLint had no errors (26 warnings in changed test files), Prettier and git diff --check passed. The literal-predicate, broad-scope, and window mutants were run against the repaired commit and restored without changing the committed tree. This record does not claim production fixes or universal coverage of arbitrary overlapping requests.

The four reviewers gave strong exploratory signal. One found a real test integrity defect across 30 sites and calibrated it; another executed both cache-replay and omission counterexamples; the others identified legal scope, persisted, and mixed-mode boundaries. Several initial claims were revised after checking the actual guide premise or the cache authority model. Hire for exploratory review, with executable calibration before product-bug sign-off.