# Content temporarily unavailable
# Structural identity oracle review — 2026-10-14

Reviewed executable head: `e1cd28afb6b9bd76641b42a06110eb184b5fac1a`.
Base: `87bc07354fa47df48e9b05c599f24dad74dea0f3` (`origin/main` at review).
The binary diff for the oracle, replay registry and manifest, and coverage map
has SHA-256 `9e94b37b8a03caa07f457d80d82a7aff399f70e3b47a6c59fe10190b43071c84`.
This record is added after the reviewed executable head; it changes no test or
production behavior.

## Law, failure, and observation

`structuralIdentity` must give equal D2 values the same result, including two
undefined results, and must not give unequal values the same defined string.
The contract is stated beside `structuralIdentity` in `hash.ts`; `groupBy`
depends on it when it merges contributions. The oracle checks the direct
`structuralIdentity` and `equalHashValues` return values after each call. It
does not claim to prove `groupBy` integration, which the incrementalization
law owns.

On untouched main, the independent-pair property failed at seed `1158727847`,
path `255`: an explicit array around `deep(5, value)` and `deep(6, value)`
built equal arrays, but the model gave their specs different normal forms. This
was an oracle model error. The repair expands `deep` shorthand into repeated
one-element array normal forms. A named equal pair preserves the original
witness, and an adjacent-depth pair checks that the model still distinguishes
one missing array level. The equal-pair grammar now generates both same-spec
and explicit-array/`deep` spellings. A structural grammar filter excludes
RegExps with a NaN `lastIndex` from that equal-pair lane; the independent-pair
lane still generates them.

The collision sweep added two distinct symbols with the same description and
Map, Set, and plain-object pairs with equal entry bodies. Their different D2
values must retain different defined identities. The alphabet includes `0` so
an object can reconstruct the index key of a Map or Set body.

## Grammar controls and executed calibration

The generated specs cover primitive leaves, short strings, arrays with holes,
objects with unique keys and optional enumerable symbol keys, Dates, RegExps,
Maps, Sets, small byte arrays, and `deep` nesting. Arrays have 0–3 items;
objects have 0–3 unique string keys; strings and keys have 0–4 characters;
binary values have 0–3 bytes from 0–2; generated `deep` nodes have depth 3–6.
The equal-spelling bridge uses depth 3–5 plus one explicit array. The
equal-pair lane varies prototypes, key order, and hidden symbols through a
64-Boolean choice stream. Duplicate object keys and cyclic specs are excluded
from the grammar. A separate fixed case checks that a cyclic object gets no
identity. The NaN-RegExp exclusion applies only to equal pairs.

Two fixed equal-pair witnesses assert that the builder produces an array
subclass with a hidden symbol and class/null-prototype objects with the
requested key order and hidden symbol. Each compares the variant against a
plain value through the model and production entry points.

The named equal/adjacent `deep` pairs reconstruct the reported and neighboring
cases. Same-description symbols and equal-body Map/Set, Map/object, and
Set/object pairs reconstruct the four collision boundaries. With the old
`deep` model and the equal-spelling bridge removed, both 2,000-case campaigns
passed; restoring the bridge made the fixed campaign fail after three cases at
`model vs equalHashValues`. Replacing symbol identity with its description or
collapsing any of the three object-kind tags fails a named pair at the shared
identity assertion. Date-as-number, binary-as-string, and bigint-as-number tag
mutants fail the generated comparison. The earlier length/header controls
exercise string length, key length, array length, and Date/RegExp headers.
Four isolated mutants made identity sensitive to key order, object prototype,
hidden symbols, or array subclass. Each failed its named representation witness
at `equal values`. Holes versus undefined, enumerable symbols, inner Map/Set
content, and byte content are generated and modeled; this review did not
execute a fresh mutant for each of those axes.

The old `deep:${depth}` model mutant fails the ordinary fixed equal-pair
campaign at seed `20261014`. The shrunk counterexample is an explicit array
around `deep(3, 0)` versus `deep(4, 0)`. Both the unshrunk and shrunk failures
reach `model vs equalHashValues`. Guarded replay of the shrunk path records one
run with `failed: true` for that mutant; the reviewed head records one run with
`failed: false`. The direct replay path is
`2:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0`.
The independent-pair replay at seed `1158727847`, path `8092`, also records
one successful run. Each generated property uses the same 2,000-run generator,
driver, and comparison for its fixed and seedless campaigns. The manifest
selects just the requested property for seed/path replay.

The reviewed oracle file passes 17/17 tests, including guarded replay of the
shrunk path. Typecheck, lint, formatting, and diff checks pass. Hostile-mutant
results above are assertion failures at the named comparison, not setup errors
or timeouts.

## ORC disposition at the reviewed head

| Requirement | Disposition and evidence |
| --- | --- |
| ORC-001 | Met. The opening law and `hash.ts` contract identify authority; the coverage map bounds the owner. |
| ORC-002 | Met. `normal(Spec)` computes expected identity independently of hashing. The equal-pair exclusion uses a separate structural NaN-RegExp predicate, not `normal`. |
| ORC-003 | Met. Opening prose states law and limits; the spec grammar, `build` path, `normal` model, and `expectAgreement` return-time comparison remain distinct beside their code. |
| ORC-004 | Met for the bounded grammar above. Named and generated witnesses reconstruct the repair and collision axes; fixed representation witnesses confirm subclass, prototype, key-order, and hidden-symbol choices reach production. Mutants reject those four sensitivities, and removal of the equal-spelling bridge lets the old model pass both campaigns. Bounds and excluded states are explicit. Other axes were not freshly mutated. |
| ORC-005 | Met. The real hash entry points run, and equality/identity are compared at synchronous return. No concrete missing-input hypothesis applies to these fully constructed values. |
| ORC-006 | Met. The old-model and collision mutants fail at `model vs equalHashValues` or `a shared identity`. The reduced old-model failure preserves the same law and checkpoint. |
| ORC-007 | Met. Both properties run fixed and seedless 2,000-case campaigns; manifest-backed guarded seed/path replay selects one property and emits one-run witnesses. |
| ORC-008 | Not applicable. `normal` is a stateless recomputation; this change adds no model state or transition. |
| ORC-009 | Met. The model maps `deep` to repeated arrays and symbol leaf indices to stable symbol instances; the shared D2 terms follow the glossary. |
| ORC-010 | Met for this harness. The reporter preserves the original comparison failure, seed, path, and reduced failure; tests acquire no resource needing cleanup. |
| ORC-011 | Not applicable. The review identified no remaining concrete shared semantic fault for which a second formulation would distinguish this bounded law. `equalHashValues` is a sanity observation, not the model source. |
| ORC-012 | Met by this exact-head record, including the applicable and non-applicable requirements and the bounded repair claim. |
| ORC-013 | Met. The equal array/`deep` pair and adjacent-depth pair distinguish the nesting rule from a lost-array-level rule at the model/equality comparison. |
| ORC-014 | Not applicable. Values are constructed in-process; no controlled provider or host premise is handed to a real integration claim. |

The repair closes the known false-red trace and tested nearby structural
identity collisions for finite acyclic specs at the direct helper boundary.
Temporal values, opaque reference values and functions, large binary values,
getters or proxies, arbitrary cyclic pairs, and mutation between observations
remain outside this owner. The coverage map assigns the separate `groupBy` path
to the incrementalization law.


## Post-merge independent review — 2026-10-16

Executable head: `4d9f3fffce65e9ed34567bc2ebf4a3051e20c159`.
Base: `2c83fdc53bd762fa8b8d5e5a8b82e092710618be` (`origin/main` at merge).
Merge commit `e61027695` preserved the earlier test behavior and retained the
coverage entries added on main. Three independent reviewers examined the merged
oracle's model, input grammar, and replay integration.

The model review found a pre-existing product defect outside the numeric
RegExp grammar: two frozen RegExps with separate frozen object-valued
`lastIndex` headers compare unequal under D2 but share a defined structural
identity. A real `groupBy` witness merges their contributions. This remains
open in [#2192](https://github.com/TanStack/db/issues/2192); the numeric bound
is now explicit in the oracle and coverage map. Returning no identity alone
would leave equal structural hashes on this pair.

The grammar review found two false greens in the previous 17-test oracle:
a Map/Set identity that serializes only its first entry, and an array identity
that omits enumerable non-index keys, each passed its fixed and fresh campaigns.
The executable head above generates zero to two Map/Set entries and an optional
enumerable array field. Pinned second-entry and field-difference pairs reach
the direct `structuralIdentity` and `equalHashValues` comparison. In scratch
mutant runs, the first-entry-only mutant failed both pinned Map/Set cases at
`a shared identity`; the array-field mutant failed its pinned case and a
generated independent pair at the same checkpoint. These were coverage gaps,
not observed production defects.

The revised Set builder wraps its second member in a fresh tagged array, so
JavaScript cannot deduplicate two equal primitive inputs before the comparison.
This lane does not test native Set deduplication or reorder two unwrapped
members; the separate hash-identity owner covers insertion-order behavior.

The old `deep:${depth}` model mutant still fails the fixed equal-pair campaign
after three cases at `model vs equalHashValues`. The reduced replay seed
`20261014` and path
`2:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0`
executed one failed mutant case and one passing repaired-model case. The
updated focused suite passed 20/20 tests, including fixed and fresh generated
campaigns; five repeated suite runs passed. Typecheck, lint, formatting, and
diff checks passed. The integration reviewer found no merge defect.

| Requirement | Post-merge disposition |
| --- | --- |
| ORC-001 | Met within the declared finite grammar; reference-valued RegExp headers remain an open product defect in #2192. |
| ORC-002 | Met. Spec normal forms judge the generated values independently of hash code. |
| ORC-003 | Met. The opening law and limits, model, grammar, builder, production calls, and synchronous comparison remain visible together. |
| ORC-004 | Met for the revised bounds: zero to two Map/Set entries, optional array field, and numeric RegExp headers. Pinned pairs reconstruct the two survivor boundaries; their mutants now fail. |
| ORC-005 | Met for the direct helper boundary. `groupBy` integration is a separate receiving path. |
| ORC-006 | Met. The old deep model and both former survivor mutants fail at the stated comparisons. |
| ORC-007 | Met. Fixed and seedless campaigns retain the same properties and 2,000-case budget; direct seed/path replay retains one executed case. |
| ORC-008 | Not applicable: the normal-form model is stateless. |
| ORC-009 | Met. `deep` is declared model shorthand for nested arrays; the second Set member's wrapper preserves its JS insertion count. |
| ORC-010 | Met for this harness. Shrinking and direct replay preserve the comparison failure; no resource cleanup is involved. |
| ORC-011 | Open for the larger RegExp header domain: #2192 owns a reference-identity model and a `groupBy` receiving witness. The numeric grammar does not claim that domain. |
| ORC-012 | This addendum binds the revised evidence and open cells to the executable head above. |
| ORC-013 | Met. Equal and adjacent-depth pairs distinguish the nesting law; second-entry and array-field pairs distinguish the new grammar boundaries. |
| ORC-014 | Not applicable: all values are built in-process without a controlled external provider. |

The PR repairs the false oracle failure for equivalent nested arrays at the
direct helper boundary. It changes no production code. Structural identity
correctness for reference-valued RegExp headers and the receiving `groupBy`
path remains open in #2192.