DbClient migration feedback evaluation#

Evaluation date: 2026-10-22. Source artifact: Feedback.txt, identified by its SHA-256 under Content identifiers. The report describes db 0.15.1, react-db 0.5.11, electric-db-collection 0.6.2, react-router-with-db 0.1.0, and Start 1.169, without a reviewed commit or an application fixture. This evaluation uses fresh origin/main 205ab7158d81680c3cc4f06cd9ebe62b30911a5a, in the isolated codex/evaluate-dbclient-feedback worktree. Current package versions are db 0.15.2, react-db 0.5.12, and electric-db-collection 0.6.3.

The review found two reproducible correctness failures. A newly admitted ordinary subscriber must be able to start a source left deferred by an abandoned render; that defect is repaired here. A plain SSR hook can render a warm source's rows that are absent from result-only transport; actual React hydration then recovers. That defect remains unfixed, with a product decision needed about the initial snapshot policy. A green scoped test run does not close it.

Production changes add one executable call and an ordering comment. The React oracle, shared lifecycle judgment, three core test drivers, SSR guidance, and coverage map also change. At the initial evaluation closeout, the changes were uncommitted and unpushed; only the helper's initial branch was published. The user subsequently approved PR preparation after both review findings were repaired. No external review response was sent.

Source weight: production +2/-0, including the comment; oracle and ordinary test files +332/-46. Documentation is separate. The production call repairs the existing admission path without adding state or replacing its control flow.

PR preparation also measured shipped bytes with pnpm size:compare --packages db,react-db --files against the stated merge-base. The final db production bundle grows by 8 gzip bytes and 116 brotli bytes. Its changed module grows by 24 minified bytes before compression. The react-db bundle is unchanged. A simplifier review found no safe consolidation: moving release into the shared start helper or resumed-acquisition path broadens its authority. The earlier experiment releasing from resumeSubscriber broke synchronous-error and peer-release laws. The measured growth pays for the separate independent demand boundary without a new state or branch.

Laws, experiments, and remaining enforcement#

Hydration must begin from the server's observable snapshot — F02#

Authority: the SSR guide promises query-result transport and hydration before hooks render. React requires the initial hydration output to agree with server markup. The review exposes a missing transport boundary, not an obligation to choose one particular capture implementation.

The existing React descriptor owner checks request isolation, descriptor binding, transported results, source claims, and handoff. Its green histories either register the observed query or supply the corresponding normalized source data. They do not establish the behavior of a second, unregistered plain query over a source loaded by another query. This is an absent history dimension, not a wrong per-client reference map.

The diagnostic history uses one descriptor and two projections. Preload the first projection into the server client; it synchronously publishes { id: 'one', value: 'server' }. Render a plain hook for the second projection, dehydrate the server client, hydrate a fresh browser client, and compare the initial server snapshots. Then run real hydrateRoot in jsdom with an onRecoverableError recorder. Explicitly preloading the second projection is the distinguishing control. The expected relation is markup equality and zero hydration recoveries, independent of the query evaluator.

The source facts exist on the server at render time. The transport lacks the second query's result and the source rows; waiting until browser commit cannot repair that earlier observation. The real React receiving witness confirms the reported host failure with a controlled source. It does not establish the reporter's Start/router/Electric deployment.

The unresolved choice is whether plain SSR hooks automatically capture their observable synchronous result for transport, or initially render empty/loading unless a result or normalized source snapshot was explicitly supplied. The former needs capture and transport semantics; the latter changes observable server behavior. Merely refusing new source starts does not solve reads from an already warm source. Capturing only rows from eager source Collections with status ready fixes one trace. It misses partial nonready rows and status flags. Suppressing all unregistered rows would conflict with documented reuse of explicitly normalized sources.

The failing diagnostic and passing control are preserved in task scratch as dbclient-hydration-feedback.probe.test.tsx and react-hydration-red.log. They are not installed as a passing oracle or hidden behind an expected-failure gate. The permanent owner remains the React descriptor owner, as recorded in the coverage map. After the product decision, extend its model and histories for ready/partial/nonready sources, full rendered status, normalized-source transport, and mixed plain/Suspense/preload schedules; reject the original behavior and a ready-only capture mutant at the hydration cut. Actual Start/Electric delivery is a separate receiving witness. F02 is design-decision, with the correctness failure still confirmed and open.

Independent subscription demand outlives an abandoned render — F03#

Authority: public ordinary Collection.subscribeChanges() starts sync when needed; deferAcquisition explicitly withholds that demand. React render-time source deferral prevents work before commit, but does not grant an abandoned render authority to veto a later independent reader. This composes the Collection subscription contract with the descriptor owner's zero-work-before- commit law. Source preload() is independent demand too, although on-demand source preload alone does not acquire rows.

The old React owner tested only the preload reader after suspension. Its expected start rule was correct within that scope; its history grammar omitted ordinary and deferring subscriptions. The first extension crossed all three readers with startSync true/false and eager/on-demand sources (12 cells). PR review then exposed cleanup reentry during ordinary admission, R01 below.

The final React grammar has 24 cells: ordinary subscriptions cross those source axes with no cleanup, cleanup from loading, synchronous cleanup from ready, and held cleanup from ready (16 cells); preload and deferring readers retain their eight no-cleanup controls. The core lifecycle owner adds 24 cases crossing the four cleanup histories with no start gate, a held unrequested gate, or a held requested gate, in both source modes. The shared finite judgment is defined in collection-subscription-lifecycle-grammar-oracle.ts. It derives expectations from demand and cleanup authority, without reusing production classifiers.

Without cleanup, ordinary/preload demand starts once and reaches ready; deferring demand remains idle with zero starts. An eager source publishes at start; on-demand rows are owed to an ordinary subscriber, while source preload alone does not acquire them. Cleanup during loading prevents adapter entry. Cleanup during ready permits one entry and retires it. Held resource cleanup retains the ready public status until settlement, as defined by the glossary. Admission cannot retry a retired start. A fresh later subscriber may restart it; otherwise the peer reuses the existing run.

The real React driver renders an ordinary hook and throws a never-settling promise inside Suspense, preventing commit. Direct public Collection operations then supply demand. The driver checks adapter entries, cleanup calls, status and the complete status trace at admission return and cleanup settlement. It checks rows only in no-cleanup histories, and checks fresh demand afterward. The core driver reaches the same judgment independently of React, including an explicit no-gate control. These are finite histories, not a claim about all concurrent schedules.

The repair records ordinary demand, requests/starts sync, then calls sync.resumeStart() to release any render gate. There is no trailing start request that could retry after callback cleanup. It adds no state, retry, recovery path, or lifecycle. Releasing the gate in resumeSubscriber() was tried and rejected: that query-owned acquisition transition may occur while the renderer still owns a separate start gate, and it broke existing synchronous-error/peer-release tests. That distinction remains intact.

Three core test files previously used an ordinary new subscriber to simulate the renderer-held gate. Their drivers now create a deferring subscriber and resume its acquisition while retaining the separate renderer gate. Their queued request, cancellation, lease, and release assertions remain. Core tests that directly exercise _sync.loadSubset still cover the actual deferred sync queue. No expected result was changed to match a wrong production output.

F03 is fixed-now for abandoned-render deferral followed by independent public subscription demand in the finite eager/on-demand, startSync true/false grammar. The model, histories and drivers check admission, cleanup settlement, and later fresh demand; both the original design and release-before-request repair are rejected. No remaining counterexample is known within those cells. Arbitrary React interruption schedules and Electric awaitTxId delivery are not established. In particular, the reporter's downstream txid timeout was not reproduced against Electric.

Indexes must exist before compilation if diagnostics depend on them — F01/F08#

This is an initialization requirement, not evidence of incorrect rows. Four executed cells compile the same ordered-limit query before source sync:

The report is right about timing and the missing descriptor config API. The literal claim that there is no place to initialize indexes is too broad: an application client initializer is available. The guide now shows it. Whether to add declarative indexes or onCreate is a product/API decision. F08 retains its unique hydration-fallback context but is a duplicate of F01's timing issue; that exact React fallback/index-warning combination was not independently run. The existing index-suggestion owner remains authoritative for diagnostic laws; this evaluation does not invent a new runtime failure law.

Readiness, cancellation, identity, and ownership — F04/F05/F06#

Preload waits for readiness. A controlled never-ready source starts once and keeps the promise pending. Whole-client cleanup rejects it and stops the source once. The API has no timeout or AbortSignal option. Thus F04 identifies an operational need and API choice; it does not falsify an existing deadline promise. Real unreachable-Electric retry behavior remains reporter evidence. A timer race alone does not cancel work; the guide now calls out cleanup.

The same prepared query produces different function-form query and object-form config hashes. F05's diagnosis is correct. Config identity also includes result settings such as schema, getKey, singleResult, and collation; blindly merging hashes could alias different result contracts. The requested guide note and shared-config example are implemented. This documentation action is closed without changing identity semantics or adding a warning.

Three distinct browser preloads produce three public result records and three retained preloaded Collections. Once one mounted observer takes authoritative live ownership, public records fall from three to two, while retained preloaded Collections remain three. Whole-client cleanup exists, and private error/retry paths can discard entries; therefore “nothing discards them” is too broad. There is no public per-query release. F06 needs a policy for cache lifetime, active observers, repeated preload, eviction, and release. Cardinality proves retained ownership here, not endless active network work or a violated memory budget. The guide documents current ownership and independently owned query Collections as an alternative. This does not close the API request.

Lossless finding ledger#

Severity below is this evaluation's estimate; the report supplied no formal severity ranking. design-decision does not mean fixed or permission to defer a known defect. No item is marked deferred.

F07 needs particular care: tsc --noEmit with strictFunctionTypes enabled and explicit absolute paths to current db/electric sources accepts assignments to CollectionOptions<any, any, any, ElectricCollectionUtils> & NonSingleResult. It also accepts the report's generic TConfig extends CollectionConfig<any, any, any, any> wrapper with a Date schema and typed mutation handler. Positive non-never assertions avoid a vacuous never witness. Reversing the assertions causes errors and leaves an unused @ts-expect-error. The tested fixtures do not refute an unprovided application assignment. The report's Date/type-variance explanation remains unconfirmed. There is no basis to loosen typed public utilities or introduce production any for it.

The surrounding setup and closing prose also contain useful claims. They are kept separately rather than silently folded into the numbered issues:

Reviewer assessment#

Recommendation: hire, with moderate confidence from this one integration report. The author found two concrete lifecycle/SSR counterexamples, connected them to practical application behavior, supplied useful workarounds, and identified hash and retained-ownership details accurately. Signal is high and the report preserves successful integration evidence as well as friction.

Prioritization and fix design need strengthening. Hydration and independent demand are correctness defects; index hooks, cancellation, cache release, and type erasure need separate contract/API treatment. “No place,” “nothing discards,” and unwritten collections “always” timing out overstate the evidence. The typing claim lacks a minimal fixture and did not reproduce in the reliable compiler check. Refusing source starts is an incomplete hydration remedy. Missing tests, law boundaries, partial-ready states, and adjacent schedules were not analyzed by the reporter. These reduce confidence in a ready-to-implement fix specification, without diminishing the value of the original diagnosis.

Verification and replay#

Scratch root: /tmp/evaluate-dbclient-feedback/. It holds the unchanged raw report, append-only initial ledger and corrections, diagnostic sources, and logs. Scratch files are not intended repository changes. Logs can include cleanup diagnostics; the decisive REDs below are assertion failures reached before cleanup, not setup failures or timeouts.

Run the permanent React owner from packages/react-db:

pnpm exec vitest run --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1 \
  tests/descriptor-query-binding-oracle.test.tsx

Run its demand matrix alone with -t 'after an abandoned render'. The original calibration removes only the added this.sync.resumeStart() in addSubscriber. The narrow calibration keeps that repair but changes sync.resumeStart's gate to require both deferred start and a previously requested start; filter to "'subscriber' after an abandoned render". Those historical mutations were temporary and restored. The previously-requested start mutant is no longer discriminating on the reordered path, which requests before release; its old kill does not calibrate the current implementation. The expanded final matrix is also run with the added resume call removed. sync.ts has no final diff.

Core surrounding command, from packages/db:

pnpm exec vitest run --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1 \
  tests/collection-subscription-lifecycle-oracle.test.ts \
  tests/collection-subscription.test.ts tests/collection.test.ts \
  tests/db-client.test.ts tests/query/immutable-demand-boundary.test.ts \
  tests/live-query-deferred-acquisition-oracle.test.ts

Vitest's path matching also selects tests/query/live-query-collection.test.ts. For scratch probes, copy each archived file back to its original package's tests directory, run the same package-local Vitest filename, then move it back. The electric probe uses direct pnpm exec tsc -p /tmp/evaluate-dbclient-feedback/tsconfig.electric.json --noEmit, with that config including the package-local file and absolute source paths. The hydration probe is intentionally RED on this branch. It is not part of the green suite count.

Oracle review evidence#

This is a self-review of the modified oracle portions, not an independent review of the whole owner or repository. Base HEAD is the exact commit above; the content identifiers below bind the uncommitted executable changes to this record. Recheck this evidence if those files change.

Content identifiers#

SHA-256 of the executable files reviewed above, on the stated base plus working changes:

The source report SHA-256 is 846313a43c3deae3b72abcd7ae2102c4b589460465ee838c9fb42fa6dd379922.

Loss audit and implementation state#

Returned to the raw report after verification: all eight numbered issues, setup/helper suggestions, and closing positive claims are represented above. F08 overlaps F01 without losing fallback timing; N04/N05 preserve workaround details without erasing their corresponding defects. No sibling production defect was confirmed. The erroneous intermediate typing conclusion is corrected in the append-only scratch ledger and here.

Numbered finding totals: 2 fixed-now, 4 design-decision, 1 confirmed-open, 1 duplicate = 8. Contextual claim totals: 1 fixed-now, 1 design-decision, 2 confirmed-open reporter observations, 4 accepted-design qualified API usages = 8. Combined: 3 fixed + 5 decisions + 3 open + 4 accepted + 1 duplicate = 16 raw items. These are disposition counts, not 16 production defects. There are zero deferred, stale, already-fixed, or fully refuted items.

Item accounting is complete; implementation is not fully complete. F02 remains a demonstrated defect pending its exact initial-snapshot contract. F07 needs the failing application fixture. Index initialization, cancellation and preload release need API decisions. Reporter deployment success, actual unreachable Electric retries, the txid consequence, and Start/Electric hydration are not independently established. No postponement of confirmed repair work has been approved or inferred. The permanent suite's green excludes the explicitly preserved failing hydration diagnostic.

Initial evaluation readiness: not assessed. The original request was to evaluate feedback, before the later PR preparation request. The known hydration counterexample prevents claiming this work closes all migration bugs.

Subsequent PR preparation review#

The user subsequently requested PR preparation. Parallel simplification and independent production/lifecycle and oracle/documentation review found two introduced issues. No simplification was warranted. The user accepted R01; the admission path is now repaired and the expanded oracle covers cleanup reentry. The user also accepted OD01; the guide and N05 now require config objects at both consumers when using an explicit queryKey.

The runtime probe ran successfully against the current source and an isolated copy with only the added resume call removed. An earlier TypeScript-script setup failure is excluded from the evidence. The parent repeated the successful three-case current-source probe. Raw independent reviews, exact scripts, and stdout are preserved under the same scratch root as prep-code-review.md, prep-production-review.md, prep-production-current.log, prep-production-original.log, and prep-oracle-docs-review.md.

The hydrated-row core test now resumes detached demand rather than itself proving the exact sync-layer queue path. Adjacent explicit _sync.loadSubset and lifecycle request histories preserve that path; this is a qualification, not another confirmed defect. Internal resumed deferring acquisition remains distinct from new ordinary demand. Executable content identifiers above bind the accepted repair and expanded judgment.

F03 is fixed-now within the expanded finite scope. Numbered totals return to 2 fixed, 4 decisions, 1 open, and 1 duplicate. R01 and OD01 are fixed. The eight contextual items retain their earlier dispositions, with N05 qualified by OD01. R01 and OD01 are additional PR-review items, not additional claims attributed to the migration reporter. The user approved committing the reviewed changes and generating PR documentation. The open hydration policy and missing typing fixture remain outside this repair's closure claim.

A focused independent follow-up reviewed the accepted R01 repair and changed judgment/drivers after calibration. It found no residual actionable defect: request-before-release removes the trailing restart; the shared judgment is independent; both drivers check entries, cleanup calls, full status traces at admission return/settlement, and fresh-demand restart. It verified the counts for 24 core cases and 24 React cases, including loading cleanup and held cleanup. This was a read-only source review, not a new broad test run or whole-PR readiness verdict.

Subsequent CodeRabbit evaluation#

Review 5618234197 covers 2975790568cab6c4834db575fe22904693f669e3. The next head 75a7d043fee10f50f34ecd4b1f13df918b2bf373 changes only skill instructions; all six reviewed executable hashes still match. The inline comment's newer commit metadata does not change the review body's stated coverage.

The three corrections change prose only. The source reference now uses the existing immutable artifact identifier, whose SHA-256 matches the archived raw feedback. Counts and Collection status wording retain the original meaning. Direct source and link checks, plus whitespace validation, are sufficient for these findings. No production or oracle behavior changed, so no new runtime RED/GREEN claim is made.

The docstring warning names no functions and supplies no repository authority for its 80% threshold. The admission method has JSDoc, and the shared judgment has adjacent literate contract prose. Preserve that approved documentation form rather than add redundant comments for an unverified external metric.

Loss audit: 18 items = 3 fixed-now + 15 accepted-design contextual assessments. No CodeRabbit finding is deferred or confirmed open. Raw review, inline data, mutable summary and the detailed ledger are retained in task scratch. Related PR #2060 is a useful navigation pointer, not new proof of current behavior. Reviewer recommendation: hire, with low confidence from this review alone. It supplies three useful documentation corrections and no new runtime counterexample. The original open hydration decision and typing fixture gap remain separate; pending CI and a mergeable flag do not establish PR readiness.

Cleanup admission follow-up — CodeRabbit review 5620262151#

Review 5620262151 covers 75a7d043fee10f50f34ecd4b1f13df918b2bf373. Its runtime code is identical to the starting head 7f2ad8e12f44c1811d1b557b19b9116435259763. This appendix audits the follow-up on that head. The executable content hashes below identify the tested tree independently of this report's commit.

Law, experiment, and repair#

A same-path diagnostic reproduced the admitted-but-idle subscription in eight cells: loading/ready status, eager/on-demand mode, and both initial-snapshot options. The adapter cleanup promise remained held when subscribeChanges returned an active subscription. After cleanup settled, the Collection stayed cleaned-up with one subscriber until an explicit restart. The same observations held with changes.ts from merge-base 205ab7158; this predates the PR.

The review proposed automatic retry. The public cleanup contract instead closes restart admission while cleanup is active. On 2026-10-22, the user selected rejection: “yes reject during cleanup.” This decision applies to ordinary subscription admission and deferred acquisition resumption. A subscription that still defers acquisition can retain logical demand without starting source work. Existing subscriptions can survive cleanup for an explicit restart. An Effect constructed during active cleanup must still return a disposed handle.

The production repair adds the existing lifecycle admission assertion before ordinary ownership or deferred resumption changes. The Effect cleanup observer moves before subscription admission. It can retire a late Effect before that Effect requests forbidden source work. There is no retry queue or new state. These are two new executable guard statements; the Effect machinery is moved. Tests and contract prose account for the remaining source growth.

The old cleanup owner checked start/preload admission and the late Effect handle, but did not exercise fresh ordinary admission or deferred resumption while adapter cleanup remained pending. The general subscription grammar models completed cleanup and explicit restart. R01 checks cleanup during an admission already in progress. Neither history is this new admission boundary.

The new oracle retains the independent three-cut judgment. It adds production paths and finite histories, without changing that model to match production. A deferred subscription may report its local snapshot before a rejected resume. The callback recorder preserves that prefix and requires rejection to add no callbacks. The later row projection deliberately compares only id and rank; virtual-field semantics are outside this law. All recorder entries remain countable, so an extra callback cannot disappear in a final row map.

Executed evidence and limits#

Scratch root: /tmp/tanstack-skill-reading-update/. It retains the complete raw review, append-only item ledger, diagnostic source, and logs. Calibration restores the final source bytes in finally and verifies their identity. The original and missing-resume outcomes are assertion failures at the held admission cut. The guard-only outcome is a runtime failure after setup at Effect construction; it is not a timeout or a refinement-assertion kill.

All Vitest runs report no type errors. The complete repository pnpm test command was not run. The ordinary receiving checks use controlled adapter cleanup and real Collection entry points; the Effect checks use that same premise through real Effect construction. They establish the stated finite admission and ownership cuts, not actual provider shutdown or every framework schedule. The owner already has cleanup rejection and terminal-status restart histories. Ordinary admission specifically at a terminal-status callback, multiple overlapping cleanup failures, and arbitrary framework scheduling are not new coverage here. The primary cleanup/restart owner owns additional core boundary histories; framework conformance drivers own their host schedules.

Replay the new finite selection from packages/db:

pnpm exec vitest run --coverage.enabled=false \
  tests/collection-cleanup-restart-oracle.test.ts \
  -t 'closes .* admission during|releases a late Effect'

The ten-file command adds the lifecycle history, acquisition cells, subscription reentrancy, deferred acquisition, sync reentrancy, idle cleanup, ordinary subscription, Effect, and Effect disposal suites named in the evidence table. The four-file command selects collection.test.ts, db-client.test.ts, and query/immutable-demand-boundary.test.ts; Vitest also selects the receiving query/live-query-collection.test.ts by path matching.

Loss audit and reviewer assessment#

CR2-01 is the single unique behavioral finding, repeated in generated prompts. Its admitted-but-idle counterexample is confirmed. Its proposed retry is superseded by the user's rejection decision. The boundary repair and its finite oracle coverage are fixed-now; no cleanup finding is deferred or left open. The review body, both repeated prompts, selected-file metadata, and outside-diff placement were reconciled. There is no associated inline finding. Loss total: one raw item = one fixed-now. The original F02 hydration policy and F07 application typing fixture remain separate open work.

Reviewer assessment: hire for counterexample discovery, with low confidence from one finding. The report supplies a useful public lifecycle cut and a correct symptom. Its proposed cure lacks contract authority and misses the Effect guarantee, so its fix guidance needs independent verification.

Executed source identities (SHA-256):

Eight-item review of 16824f677 — follow-up evaluation#

The user supplied eight deduplicated, unverified findings against PR #2229 at 16824f6778bc3feb21c67d4f865c4f444e11f2e4. The reviewer used medium effort and reported no clear AGENTS.md violations. Those statements describe provenance, not correctness evidence. This appendix records a self-review and executed experiments. The earlier appendices remain historical records.

Laws, experiments, and inference#

The review exposed incomplete ownership handling around a deliberate rejection boundary. It also exposed a separate resumption defect. The user's decision, “yes reject during cleanup,” remains authoritative. Automatic admission and restart would revise that contract. It would not establish failure atomicity for other setup errors.

These repairs preserve cleanup rejection, terminal dependents, render-only zero-work behavior, independent preload demand, publication eligibility and explicit restart. The laws are encoded and reached at the listed observation cuts within their finite domains. No known reachable counterexample remains within these declared repair boundaries. This is not a proof over arbitrary provider, callback or framework schedules.

The receiving React driver adds deferred subscription resumption to the real abandoned Suspense grammar. It reuses the core startup/cleanup judgment and checks adapter entries, complete status traces, cleanup settlement and later demand. Its 64 tests pass. A full-suite failure also exposed an older conflicting expectation in useLiveSuspenseQuery.test.tsx: it expected no browser acquisition while a server stream was pending. The established stream-preload law predicts one local start, independently of stream availability. The corrected assertion requires that start. The unchanged later assertions require the server row until browser acquisition completes, then the browser row. This changes the work observation to the accepted law without weakening snapshot authority.

Source-order item ledger#

Severity below is this evaluation's assessment. The supplied review gave no severity except marking R06 as a design issue. Complete raw claims and the append-only working ledger remain in the scratch root named below.

Loss accounting: eight raw findings = five fixed-now + three accepted-design. The two additional raw prose/metadata items remain separately accounted for. Including them gives ten raw items = five fixed-now + four accepted-design + one duplicate provenance entry. Two discovered siblings are fixed separately. False subclaims remain explicit inside their source items. No item is deferred or silently merged.

Reviewer recommendation: hire for bug discovery, with reservations about fix judgment. Five of eight findings expose real defects, sometimes on a narrower trace. R02/R03/R07 identify useful lifecycle cuts and R05 correctly questions side effects in validation. The report does not execute them, overstates the absence of public diagnostics in R01/R08, and treats an approved terminal policy as a defect. Its automatic-restart proposal lacks contract authority and misses failure atomicity. The ranking of R03 below the policy concern understates the most direct progress failure. The reviewer is useful with independent contract and experimental verification.

Executed evidence and limits#

Scratch root: /tmp/tanstack-skill-reading-update/. Logs retain assertion messages and exact selected tests. No mutant remains in the working source. Every mutation restores original bytes in finally and checks SHA-256 identity.

The early review-eight-oracles-red.log is not a clean calibration total. It contains eight invalid virtual-field comparisons and eight progress timeouts among 80 failures. The invalid comparisons were corrected to the declared row projection. The clean boundary and React assertions above carry the RED claim. review-eight-react-red.log selected no tests and supplies no evidence. The first retired-owner mutant used a test-name selection that also triggered the existing cell audit because other tests were skipped. Only its count assertions were useful; the complete-file rerun supersedes that audit artifact. Intermediate broad GREEN attempts passed runtime assertions but had test-fixture type errors. They are not cited as clean GREEN runs.

Production source weight for this follow-up is +71/-39 lines, net +32 across six files. Shared admission startup, shared observer release and centralized pooled status release remove duplicate control flow. The remaining added checks defend observable partial-construction and reentry boundaries. Tests add dimensions and assertions separately from production. Shipped growth above is +90 gzip and +107 brotli bytes beyond reviewed head's earlier measured delta. No new stored state, retry queue or recovery lifecycle was added.

Replay the broad core run from packages/db:

pnpm exec vitest run tests/collection tests/db-client.test.ts tests/effect \
  tests/live-query tests/query/pooled-live-query --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1

From packages/react-db, run the same command without path selections. The complete repository pnpm test was not run. These results do not establish actual provider shutdown, every framework commit schedule, arbitrary recursive callbacks or unbounded failure histories. Source/error and cleanup facts are available at the asserted cut; no concrete missing-input hypothesis remains for these repairs. The coverage map retains each owner's wider limits.

The eight-item implementation and bounded oracle repair are complete. Whole-PR readiness remains separate: F02 still needs an initial-snapshot policy and F07 still needs the reported failing application fixture. Earlier browser E2E runs failed in dependency setup rather than demonstrating an assertion failure. A new CI run does not erase those independent limits.

Final evaluated source identities (SHA-256), based on reviewed HEAD 16824f6778bc3feb21c67d4f865c4f444e11f2e4 plus this follow-up:

Current-head summary: cleanup during ownership transfer#

CodeRabbit's summary at da37bc9bbafbed4b2cc901adcbad9181b0aeb93d reported no actionable comments, but said: “The deferred-resumption cleanup edge case is unresolved but has no established user impact.” It then paused automatic reviews. This concern required an experiment without an inline finding. The previous appendix's closeout is historical and does not cover this new counterexample. The earlier eight-item ledger remains unchanged.

Law, experiment, and repair#

A returned acquiring subscription remains demand after cleanup. Explicit restart must serve it. A still-deferred subscription contributes no acquisition. Cleanup during admission retires that start. Admission must not start another run unless a caller explicitly requested one. Authority comes from the primary owner's surviving-subscriber contract, cleanup start, and shared startup judgment.

Eight probes varied plain/live-query Collection, eager/on-demand source and cleanup from loading/ready callbacks during resumption. Two on-demand live queries remained loading after explicit restart with one acquiring subscriber. Removing the target render gate exposed a neighbor: first-demand notification could clean up the query, after which admission started it again. These are concrete consequences absent from the summary.

The old surviving-subscriber grammar cleaned up after admission settled. The retirement grammar unsubscribed at the interruption. Neither represented a surviving owner whose transfer was still in progress. The primary deferred- acquisition owner now adds 192 finite histories: two modes, two shapes, one/two levels, ordinary/resumed/deferred readers, render gate present/absent, source loading/ready cleanup, and explicit restart later/from terminal publication.

The independent judgment counts returned acquiring handles as next-run demand. A deferred handle contributes none. Eager local rows can establish readiness without acquisition. The driver reaches cleanup through real status callbacks. It compares the complete target status trace after cleanup starts, ownership and absence of implicit restart, then acquisition, readiness and rows after explicit restart. Two-level histories permit an inner query's earlier accepted acquisition to remain useful. They require acquisition to exist, without forcing an unnecessary new physical attempt for each outer restart.

The first draft incorrectly required that additional attempt. Its assertion was corrected before production changed. The corrected original implementation fails 44 histories at unintended-restart or replacement-progress assertions. Keeping ownership retention while removing the sync-run guard fails 16 unintended-restart assertions. Both runs have no type errors. Evidence: review-da37-surviving-red-original.log and review-da37-surviving-red-no-generation-guard.log in the existing scratch root. The earlier draft total is not calibration evidence. Mutants restore source bytes in finally and verify identity.

The repair uses the existing sync-run generation to fence admission after a first-demand callback cleans up. Current acquiring ownership also contributes to the demand judgment. Ownership commitment restores a demand mark cleared during startup cleanup, including an explicit cleanup-listener restart. Retired owners do not commit that notification. Ordinary admission includes its fallible ownership notification in rollback, preserving the setup error if a release listener throws too. Rollback removes the pending owner's count, without resetting a total that could erase a reentrant peer. No stored lifecycle state, retry queue or recovery lifecycle was added.

The same 53-file core selection passes 2,776 tests. The full 22-file React selection passes 457 tests. Both report no type errors or unhandled errors. Scoped ESLint has zero errors. The production bundle is +138 gzip / +191 brotli bytes against merge-base 205ab7158; React is unchanged. This adds 36 gzip / 20 brotli bytes beyond da37bc9bb. Additional source weight is production +23/-6 and tests +112/-0, with documentation separate. Evidence logs: review-da37-core-green.log, review-da37-react-green.log, review-da37-lint.log, and review-da37-size.log.

New-summary accounting: three raw items = one fixed-now + one refuted repository- requirement claim + one duplicate provenance entry. S03/S04 remain separate violations. No finding is deferred. Reviewer recommendation for this summary alone: insufficient evidence for a hire decision. It preserved a useful concern, but gave no trace and missed the demonstrated consequence.

ORC-001–014: authority, limits, independent handle judgment, literate layers, real entry points and immediate/settled comparisons are stated above and beside the grammar. New cases are bounded enumeration, so generated controls and new campaign/replay interfaces are not triggered (004/007). Existing fixed/random campaigns remain unchanged and green. No reference state was added (008). Glossary terms and the existing projection remain unchanged (009). Controlled teardown removes callbacks before cleanup, with the preceding failure-fidelity limits (010). No concrete shared semantic fault calls for a second formulation (011). Original and narrow-mutant assertion failures calibrate both ownership retention and startup fencing (006/013). This versioned appendix and the source identities below supply 012. These cases claim controlled core callbacks only, so no additional real-provider/framework handoff is claimed (014). The React run is compatibility evidence, not a receiving witness for this new premise.

The law is encoded and asserted across the stated 192 histories, including no-acquisition and explicit-listener-restart neighbors. No counterexample remains within this declared boundary. Arbitrary recursive cleanup, asynchronous provider work before acquisition and other framework schedules remain outside these finite histories. The primary owner's coverage-map entry retains those wider witnesses. No universal history or provider-shutdown proof is claimed.

Source identities for this follow-up on da37bc9bb (SHA-256):

Final-head CI: subscription-specific replay classification#

Core shard 1 at e852b0accf9971f61348066277290b010a7b016e found CI-01 in replay.ordered-window-faults: seed -1751969525, shrink path 67:11:10:12:1:8:7:7. The five-action reduction holds work, moves row 1 to rank 1, truncates markers, then settles one request successfully and one with failure. The query is ascending, offset zero, limit one, with an anti-join, on-demand markers and an inline include. No peer participates.

Law and competing accounts#

A failed ordinary lazy demand is terminal. A failed truncate replay retains the last complete publication until a later authoritative replay succeeds. Authority is the architecture's demand, replay and publication contracts and this owner's stated terminal-error law. Those contracts apply to each subscription's demand; a shared source's replay does not classify every other subscription's load.

The existing grammar already generated the case. Its source-wide markerReplaying flag mistook a new include subscription's first request for renewal of an older demand. The real adapter diagnostic reaches a new lexical subscription without a replay hold. Its ordinary request fails and the query correctly enters terminal error. The oracle rejected that allowed result. The same exact seed fails with all six changed production files restored to 16824f67, so this classifier defect predates the eight-item repairs.

An initial hypothesis blamed production's lazy-demand failure path. A guard experiment did not repair the failure and was removed. It supplies no GREEN credit. A trial that inspected a nonpublic Collection property could not classify provider ownership and was also discarded. A test-name selection that matched zero tests supplies no evidence. Final evidence below uses only adapter inputs, recorded lease ownership, semantic predicates and public query status.

Model, observations and calibration#

Before truncate, the adapter records its held leases. A new acquisition renews one captured lease only when its subscription token and independently evaluated key predicate match. Each lease is consumed once. A new owner or different keys remain ordinary demand even during another owner's replay. Separate source and marker snapshots retain the provider boundary; a WeakSet records which adapter received each options object. The five-key grammar makes predicate membership a complete finite demand projection here. No production replay classifier or private state computes the expected result.

Terminal-error assertions now run after each history action, before final recovery, as well as at convergence. The named CI reduction requires terminal error. A settled joined-demand replay neighbor requires nonterminal recovery. Existing fixed and random campaigns use the unchanged generators and 300-run budget. The direct seed/path replay still runs without a normal campaign.

All mutant source bytes were restored and verified. This correction changes no production file. The original eight-item dispositions and S01–S04 remain intact. CI-01 is fixed-now as an oracle-classification defect, with the generated witness, distinguishing neighbors and calibration retained in the primary owner. No product contract or approved cleanup policy changed.

ORC-001–014: the law and finite projection are stated above and in the owner; expected classification uses adapter-observed ownership and an independent predicate evaluator (001–003/009). Existing generated domains, exclusions, fixed/random parity and replay interface are unchanged; the CI reduction and settled-demand neighbor supply reconstruction and ablation controls (004/007). The driver invokes real Collections and checks status at each action and convergence, with no missing-input hypothesis for this controlled boundary (005/013). The two assertion failures calibrate owner identity and replay terminality separately (006). Captured ownership and provider identity are necessary to distinguish a new demand from renewal of an existing one (008). Existing cleanup fidelity is unchanged; experimental mutations restore bytes (010). No additional shared-fault hypothesis calls for a second formulation (011). This versioned record and source identity supply 012. No provider or framework handoff claim is made (014).

Limits remain five numeric keys, one-level includes and controlled adapter schedules. This is self-review. The coverage map names the expanded observation cuts. F02's initial-snapshot decision and F07's application fixture remain separate readiness obligations.

Oracle source SHA-256 at this follow-up: 86f652fadc3ddeddfd5188d18b049969293209efdda51641e28ec38122884ea2.

Audit against the declared-reach rules from PR #2233#

This self-review starts at 38eb2831f6005faa51f4021f0c29dd532c3a6cf4. It uses rule proposal 91ee6db4f1e37fffb44ca4432d01e27c63bed45c, now merged as 65d9ada508114f199464f753d50eb3447eb0eaf9. The audit changes tests and coverage evidence only. It preserves the maintainer's cleanup-rejection decision. The scratch ledger and raw logs are in /tmp/tanstack-rule-2233/.

Law, experiment and inference#

Law. An ordinary lazy demand failure is terminal. A settled demand's failed truncate renewal preserves the last complete publication and permits a later authoritative replay. Authority is the live-query architecture's demand and replay-participant rules, publication law 9, and this owner's terminal-error contract. Subscription identity and immutable predicate membership distinguish renewal from new demand; sharing a Collection does not establish renewal.

Reach. The existing 300-history fixed campaign reached zero failures of new demand during marker replay and one failed settled renewal. A calibrated random campaign reached zero of either. Both fail when both states are required. The old grammar can express the CI counterexample, but its normal budget does not reliably enforce that interaction. More named examples would not fix this missing sampling dimension.

The primary replay owner now runs replay.subscription-demand-origin: 75 fixed histories with seed 2233, then 75 random histories with the same grammar and judgment. It varies ordinary versus renewal origin, zero to three prior successful replays, a marked row from 1/3/4/5, and its rank from 1 to 9. The ordinary branch holds work, moves the row, truncates markers, succeeds one held request, then fails the next. The renewal branch holds, truncates, and fails the held renewal. Both use the existing production driver and independent five-key predicate projection. Actual adapter entry, prior demand, public readiness and a non-aborted failure establish reach, independently of the expected terminal status. Named neighbors calibrate the recorder.

The original broad grammar, seed, 300-run budget and replay coordinates remain. Its seventeen existing required dimensions now count histories, once per state, instead of events. Both new states require at least one history per campaign. Explicit seed/path replay skips campaign minima. Public terminal status is checked after actions and at convergence. A new positive assertion also requires an observed ordinary failure to become terminal at convergence.

RED. replay-broad-reach-calibrated-red.log records both broad campaigns failing their added critical reach requirements on unchanged production. This is a reach failure, not a product defect. The initial replay-reach-original.log used an uncalibrated new-subscription witness that missed the named regression. It supplies no reliable zero-reach claim and is superseded. A new logical demand can use an already-seen subscription token. The calibrated recorder checks demand renewal rather than token novelty alone.

GREEN. final-owners-green.log passes 1,006 tests in eight files, with no type errors. It includes the replay owner, reach helper, subscription lifecycle, cleanup, deferred acquisition, observer construction/publication, partition release and DbClient tests. Scoped ESLint passes. Production source is unchanged in this audit. Earlier full core and React counts remain evidence at their recorded heads, not new runs against an integrated tree.

Each count below is the number of histories in that normal GREEN run.

Mutant. The generated focused campaigns reject all four semantic controls at assertions, with no setup, timeout or type failure:

The first control shrinks at seed 2233, path 1:0, to ordinary origin, zero previous replays, row 1 and rank 1. Direct replay rejects that mutant and passes after byte restoration (replay-direct-mutant-red.log, replay-direct-green.log). The all-terminal control shrinks at the same seed, path 2:1:1:1, to renewal with zero previous replays. Removing the rank move from the grammar leaves ordinary-demand reach at zero and fails both campaign minima (replay-mutant-no-rank-move.log). All mutated files were restored in finally, with byte identity verified. The new positive assertion was added before its ignored-failure production mutant ran.

Limits. Five numeric keys, one-level inline includes, one live query in the focused grammar, ascending offset-zero limit-one windows and controlled adapter settlement. The unchanged broad grammar covers other window/order/peer forms. Neither property proves arbitrary predicates, actual provider cancellation, unbounded replay histories or framework scheduling. The coverage map names the same primary owner and these remaining receiving boundaries.

Audit of the seven shortcuts#

These results preserve the eight-item ledger: five fixed-now and three accepted-design, with S01–S04 separately fixed in their declared finite bounds. The audit adds a reach-enforcement repair, not another product-policy change. Whole-PR readiness remains not ready because F02 needs a product decision. F07 remains an evidence gap. Green finite evidence does not resolve either.

ORC-001–015 result for this repair#

Authority, limits and the unchanged independent projection satisfy 001/002. Prose, grammar, driver and comparison remain beside executable code (003/009). The shrunk ordinary and renewal histories reconstruct the known witnesses. Removing rank movement loses the ordinary premise. Rank bounds avoid existing starting ranks, and the constructive grammar places failure after holding work rather than requesting failure without a pending request (004). Real Collection entry points, action cuts and convergence supply 005/013. The four assertion controls and reach ablation supply 006. Equal fixed/random budgets and the checked direct replay supply 007. No model state or equivalence class changed (008). Existing primary/secondary cleanup fidelity remains, and experimental mutations restore exact bytes (010). No new shared semantic hypothesis calls for a second formulation (011). This versioned record, starting revision and source identities supply 012. Controlled-boundary claims require no new provider handoff (014). Mandatory campaign minima and the table supply 015.

SHA-256 identities for the repaired executable sources:

Integration with merged PR #2233#

Oracle repair commit a39a07d21 was followed by merge commit e32ac735c, which includes origin/main at 65d9ada50. The authoring skill conflict retains both the oracle-first sequence and the branch's full-source reading requirement. The review skill retains both sets of instructions as well. Upstream's persisted readiness extraction merges with the observer ownership repair without a manual production edit. No branch history was rewritten.

The first combined core command passed 2,808 runtime tests but failed with two test-source type errors. The filtered dimensions have a narrower union than keyof OrderedReach; the loop had continued to iterate all keys. Iterating the declared dimensions fixes those errors and removes the unused event aggregation. This does not alter generated histories, public judgments or reach minima. integrated-core.log is not a clean GREEN result. The final command in integrated-core-fixed.log passes all 2,808 tests in 55 files, including type checks, with no unhandled errors. The smaller earlier selection did not expose these test-source diagnostics.

The merged React suite passes 458 tests in 23 files. The persistence readiness owner passes 64 runtime and type tests in two runner entries. Evidence: integrated-react.log and integrated-persistence.log. Scoped ESLint, Prettier, git diff --check, and the 418-name mangle-cache check pass. The complete repository command remains unrun.

The source-wide, identity-blind and always-terminal mutants again fail both focused campaigns at the terminal-status assertion on the combined tree. Removing rank movement again fails reach. Ignoring ordinary failure again fails the positive terminality assertion. The integrated-replay-*.log files preserve these runs. Every production and test mutation was restored before the final checks. The direct seed/path replay passes all 26 selected tests (integrated-direct-green.log).

Final normal core-run history counts follow. Fixed seeds and budgets are unchanged, and the minimum is one history for each declared state.

Against merged main 65d9ada50, pnpm size:compare --packages db,react-db --files reports db +139 gzip / +238 brotli bytes and React unchanged. Tree-shaken app scenarios range from +136 to +148 gzip bytes. This is the existing production repair's cost on the integrated baseline. The declared-reach audit adds zero production source lines or shipped bytes. integrated-size-final.log records the final matching-source cached comparison. Earlier bundle figures remain tied to their original bases.

Final repaired replay-owner SHA-256: 7b47e515ce94ec26f60fd78b400ddb2ea104abd9eb3bd8978a098c5efd7662e8. The six-part evidence block and the stated finite limits above still apply. The historical generated-RED chronology deviation, F02 decision and F07 evidence gap remain visible. Integration GREEN does not turn this into a ready verdict.

High review of ten findings — 2026-10-23#

The review checks 929c1d418a84c2d9ed57fb68aa829ba8c85c5ab7, the head supplied by GitHub when this evaluation began. The reviewer did not supply its own reviewed SHA. Production and test repairs below follow that head. Earlier entries, decisions, counterexamples, and evidence remain unchanged.

The review exposed two distinct laws. A recorded Collection error does not prove that a particular handoff threw. A failed subscription setup transfers no resource ownership to a caller that received no release handle. Those laws need separate error-provenance and partial-construction observations.

Laws, experiments, and inference#

H01's reference judgment is shared by the core and real React driver. It retains callback outcome, handoff timing, and defined/undefined cause. It combines no production queues or classifiers. The React driver supplies only host scheduling and observations. Explicit preload has a distinct error-reporting obligation: it must reject if its source startup failed even when graph demand consumed the gate first. Existing exact-error, healthy-peer, stream and replacement cases continue to check that obligation.

H07 uses a controlled persisted-readiness capability that can fail registration before returning a handle. First-party readiness registration does not currently throw. The driver also uses real sync startup throws. This proves cleanup at the core capability boundary, not a first-party persistence outage or every possible provider failure. A failed registration itself transfers no unreturned handle. A returned reentrant peer remains a logical record. A later explicit subscription reattaches that record and receives subsequent publication.

Lossless source-order ledger#

The H02 provenance claim is separate from its product claim. Commit 2151d9f1f did change cancellation fixtures to create deferred logical demand and then resume it. That change does not establish permission for ordinary React render work. At this evaluation's parent, the DbClient queued-load fixture still checks no adapter work before release, using an explicit queued load. The real React startup matrix separately checks zero work for abandoned renders and later acquisition for direct demand. The high review supplied no failing render fixture. These assertions remain intact, and all actual render-cut suites pass.

The ten panel entries and both summary bullets are accounted for above. H01's undefined cause, H02's test-integrity subclaim, both H06 hooks, and H06's outside-diff provenance remain distinct. No additional product sibling was confirmed. Fixture setup and replay-registration mistakes found during this pass are recorded below rather than counted as product defects.

Generated grammar and calibration#

All six properties run fixed seed 2229 and an unseeded campaign with equal budgets. Each declares reach with a minimum of one history per named state. The state counts below come from the final normal runs. Observer reach uses an actual returned peer handle, checked against the generated premise.

The core handoff budget is 100, pooled cleanup 40, observer attachment and notification error 60, and each React observation 30. These are sampled finite histories, not universal proofs. The domains retain the distinctions needed to reconstruct the reports and the following neighboring cases:

• Handoff: ready versus returned error versus throw, before versus during release, and defined versus absent cause. Timing distinguishes another reader's failure. Outcome distinguishes readable error from exception. Calling an old render handle again must not start a second run.
• Pooled registration: returned versus thrown late callback, defined versus absent cause, and 1–3 healthy peer status listeners. Removing release-before- cleanup prevents the late-registration premise. On-demand sources are excluded by production's pool eligibility, not a test waiver.
• Observer: granular/wholesale, early capability/real sync failure, one/two failed attempts, and absent/present reentrant peer. Removing early failure loses partial-registration reach. Removing peer presence accepts the narrow record-count repair. Successful retry/publication/release follows every case.
• Notification: held/immediate cleanup, returned/thrown second notification, and 1–3 distinct predicates. Cleanup is required to clear the first demand mark and reach the second notification. Distinct predicates retain separate demands. Replacement readiness is explicit because cleanup promises no automatic restart.
• React: both hooks, returned error versus actual throw, and defined/absent cause. A healthy source is covered by the surrounding host suite. Direct QueryBuilder input to the infinite hook is outside its accepted input form.

Original RED and hostile results are assertion failures at the claimed cuts:

Every production mutation was restored byte for byte before the final GREEN. Removing the hook rollback guards survives both direct-source and exploratory lazy-child histories with the repaired helper. That surviving mutant supplies no evidence that rollback guards are necessary. The unproved lazy-child extension is not part of the final claimed grammar. Original helper plus guards passes both hooks' ownership checks, but the upstream provenance repair also passes without adding those guards.

Early H04 on-demand throw probes did not reach pool subscription: the pool explicitly rejects on-demand sources. They are setup failures, not RED evidence. An early infinite-hook fixture also supplied an unsupported direct QueryBuilder. Its setup failures are withdrawn. The corrected real-hook original assertions above supply the evidence. The first combined core run passed runtime tests but reported two test-source builder type errors. The final run fixes the narrowing without changing the grammar or expected results. A replay manifest test also caught dynamically constructed React property IDs. Literal IDs repair the registry check without changing behavior.

GREEN commands and direct replay#

From packages/db:

pnpm exec vitest run tests/collection tests/db-client.test.ts tests/effect \
  tests/live-query tests/query/pooled-live-query \
  tests/query/load-subset-replay-refinement-oracle.test.ts \
  --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1

This final run passes 2,816 runtime/type tests in 54 runner entries, with no type or unhandled errors. The final observer reach check separately passes all 30 owner tests. The complete replay-wrapper run passes 34 protocol tests, while its three manifest tests initially fail on the dynamic IDs. After correction, all three manifest tests pass. From packages/react-db, the full test command passes 462 tests in 23 files. A final four-campaign run adds nonvacuous Collection ownership and isError comparisons and passes. No full repository pnpm test claim follows from these scoped runs.

All six guarded replays run only the manifest's random lane and report one completed exact-property witness. Use these seed/path pairs:

For example, from packages/db:

TANSTACK_DB_ORACLE_SEED=2229 \
TANSTACK_DB_ORACLE_PATH=0:1 \
TANSTACK_DB_ORACLE_PROPERTY=live-query.start-handoff \
node --import tsx tests/oracle-replay.ts \
  tests/live-query-deferred-acquisition-oracle.test.ts --coverage.enabled=false

For React, run from packages/react-db and use ../db/tests/oracle-replay.ts with the descriptor test file. None of the new properties uses fc.commands, so no commands replay path applies.

Shipped weight and refactor experiments — H10#

The target remains merged main 65d9ada508114f199464f753d50eb3447eb0eaf9, verified by a fresh fetch. pnpm size:compare --packages db,react-db --files reports:

Actual alternatives tried during this pass:

1. Replace separate observer channel locals and release closures with one early-owned list. Keep the existing callback runner so every acquired channel gets a release attempt. This repair removes parallel ownership mechanics and supports early registration failures.
2. Remove the duplicate outer unsubscribed guard. Existing inner authority checks preserve behavior through the full lifecycle suite.
3. Remove current-demand count from hasSubscriberOrPreload. Reject this candidate: it fails one admission-reentry ownership assertion.
4. Remove the positive-count conjunct from positive ownership notification. Reject this candidate: four reentrant retirement assertions fail.
5. Add then remove rollback guards in both React hooks. Keep their removal: repaired-helper ownership histories pass without them. Measured React cost falls from +22 gzip/+26 brotli to zero. The typical app falls from +186 gzip to +175. Brotli changes are nonlinear and not a sum of source-file deltas.

The db package remains 36 gzip bytes larger and 5 brotli bytes smaller than this review's parent comparison. Its remaining growth pays for error-provenance separation, early resource ownership, and the prior demand/admission repairs. The rejected count simplifications violate concrete ownership laws. No extra React rollback or replacement lifecycle remains. The new production diff is net +7 source lines, reported only as context. Shipped bytes above are the weight measure. The test/model/replay changes add roughly 840 lines separately from production and contract documentation.

ORC-001–015 assessment and limits#

001/002: The conformance error surface, handle ownership, glossary cleanup rules and architecture law 15 supply authority. Small error-origin and resource-token judgments stay independent of production classifiers. 003/009: Each changed owner states its law and limits before mechanics. The shared handoff judgment names its projection. Vocabulary follows the glossary. 004: The grammar controls above name reconstruction, axis ablation, finite ranges and nearby exclusions. 005/013: Real Collection/observer/pool entry points and real React commit/unmount paths reach the stated cuts. Returned versus thrown starts and cleanup callbacks are distinguishing neighbors. No concrete missing source fact is identified for these cuts. 006: Original and narrow-mutant assertions above reject the wrong designs. H04/H08 gaps receive no closure credit. 007: Equal fixed/random budgets and six guarded direct replays pass. 008: The handoff projection retains timing and outcome because each changes allowed throw behavior. The retirement model's new mark observation distinguishes retired ownership after cleanup. No new stateful reference machine was introduced. 010: Driver cleanup is deterministic within these fault domains. Experimental mutations restore exact bytes. Cleanup-throwing capabilities are outside this grammar and are not claimed. 011: No new shared semantic-fault hypothesis needs a second formulation. 012: This versioned record preserves verdict-critical evidence and source identities. 014: React receives the shared handoff judgment through actual host scheduling. Controlled capability failure remains a core-only claim. 015: Mandatory minima and every declared state count appear above.

The encoded laws are enforced at their stated return, failed-construction, retry-publication and host-unmount cuts for these finite grammars. They do not establish arbitrary provider outages, every callback program, every React schedule, or other frameworks' error policies. Ordinary hook/error ownership and explicit preload rejection are separate observations. The pooled and observer owners retain their broader existing lifecycle histories.

H04 remains open until a legal eager-source subscription throw with promised same-run recovery is supplied. H08 remains open until a retained demand is shown stuck past supported replacement readiness. Both questions were sent with the tested path and observed results. Neither is silently deferred or refuted by a different-path green test. The coverage map names those owners and required witnesses.

Reviewer assessment, loss audit, and readiness#

Hire recommendation: hire for code review. The review found four reproduced behavioral findings, including two subtle partial-construction leaks, plus a valid simplification and the missing size rationale. Its strongest contribution was tracing a new throw into unchanged receiving code. Its recovery and render claims need better legal-path evidence. One simplification contradicts reentrant ownership, and the review did not supply executable fixtures for its two remaining failure consequences. Those limits reduce confidence in autonomous design recommendations, without erasing the useful discoveries.

Ten raw items = six fixed-now (H01/H05/H06/H07/H09/H10), one accepted-design (H02), one refuted (H03), and two confirmed-open evidence gaps (H04/H08). No items are deferred or merged away as duplicates. Accounting is complete. Confirmed authorized repairs and their declared oracle work are complete in the bounded domains above. The two unproved consequences remain open investigations, rather than confirmed unfixed defects.

Whole-PR verdict remains not ready because the earlier confirmed F02 warm- source hydration mismatch still needs its initial-snapshot policy. H04/H08, the earlier F07 typing report, and final-head CI also limit readiness evidence. The earlier 24 passing checks at 929c1d418 do not validate this new tree. Browser dependency installation timed out at that head and on merged main; that infrastructure failure did not execute application assertions. CodeRabbit remains paused and last reviewed da37bc9bb. No bot command or review comment was sent during this evaluation.

Repaired source identities#

The implementation/test revision is identified by its parent above and these SHA-256 values. The subsequent closeout entry pins the resulting commit.

Ten-finding implementation closeout#

Implementation and oracle commit: 83bd08ded8b74254515536233d7d82a32a85d3c3. The source identities above match this commit after the commit hook. The following closeout commit changes documentation only. The earlier REDs target parent 929c1d418a84c2d9ed57fb68aa829ba8c85c5ab7; the final GREEN commands and six guarded replays target the implementation identified here.

Scoped ESLint passes with zero errors and four warnings on unchanged lines. Prettier, git diff --check, and the 418-name mangle-cache check pass. The historical audit prefix remains byte-identical. The changeset now records readable source errors and partial-attachment release. No published commit was amended or rebased. The production changes preserve the approved cleanup rejection policy. The loss totals and non-ready verdict above still apply.

Current receiving-gate enforcement — 2026-10-23#

This pass starts at 1d1ac0170d5520ff21b54aee90c006382841150d and changes no production source. It strengthens the current receiving comparisons before considering any further repair. It does not repair historical work order.

Law and authority. The shared conformance contract exposes recorded source errors as readable React status. The shared expectedStartHandoff judgment permits an exception only from startup performed by that handoff. Both hooks must release every subscriber after unmount, before GC can conceal ownership. Explicit preload failure reporting and abandoned-render zero-start cuts remain neighboring guarantees in their existing owners.

The pre-edit inventory names both public hooks, failure before/during commit, returned markError/thrown startup, defined/absent causes, error/boundary after commit, and ownership immediately after unmount. Each hook now has independent fixed/random campaigns and reach minima. Independent DbClient startup supplies the earlier-failure premise: its throw is observed before render, the source already reports error, and commit must not start it again. No model rule or production expectation changes.

Reach. Each row contains 30 histories. Columns count returned errors before and during commit, thrown starts before and during commit, and absent causes. Every minimum is one; counts are per history, not callback count.

RED and mutant. Temporarily removing reportSourceErrors && from the helper restores the reviewed defect. After rebuilding db, all eight receiving campaigns fail at the intended comparisons. Error-surface campaigns observe one boundary error instead of a readable result. Ownership campaigns observe one retained subscriber after unmount instead of zero. These are assertion failures, not setup errors. The mutation is restored byte for byte and db rebuilt. This calibration tests current enforcement; it is not a new pre-fix RED claim.

Four new guarded replays preserve the changed grammar. The property IDs remain react.descriptor-error-surface and react.descriptor-ownership; the additional -t 'ordinary ' or -t 'infinite ' selects the receiving hook independently. The runner's manifest still selects the random lane. All four exact witnesses execute and pass after restoration:

GREEN. The full React package passes 466 tests in 23 files, including type checks. The deferred-acquisition owner and DbClient pass 580 tests in two files. The four guarded replays pass. Scoped ESLint and Prettier pass. All three edited skills validate with quick_validate.py, using cached PyYAML. A broader replay- protocol run was interrupted; its partial output is not a clean GREEN claim. The protocol itself is unchanged, and its previous results remain historical.

The first surrounding React run exposed a real-clock test gap: a nominal 10-millisecond wait overshot the abandoned-render GC cut under load. The two infinite-query GC tests now advance a controlled clock by exactly 10 milliseconds, check the same live-state expectation, then run pending timers and check cleanup. All 12 tests in that file pass separately and in the full package. No status comparison was relaxed and no product behavior changed.

Grammar and limits. Both hooks independently sample the same bounded 2 × 2 × 2 failure grammar. Removing timing loses the unrelated-error case; removing either hook loses its host path; absent causes distinguish a missing error value from absence of failure. The grammar reconstructs the original returned-error/during-commit witness. The driver excludes a claimed pre-commit failure without prior startup by checking source error and one start before render. Healthy startup retains its core-owner coverage. Source startup is synchronous and eager. This does not prove arbitrary React schedules, asynchronous outages, error recovery, Suspense error policy, or another framework's receiving boundary.

For ORC-001–015, authority/model independence and canonical terms remain unchanged (001/002/009). Prose, generated timing, real receiving drivers and commit/unmount assertions are colocated (003–005). The eight intended assertion failures calibrate the checker (006); paired campaigns and exact guarded replays satisfy 007. No reference-model state changes (008). Cleanup exceptions remain outside this grammar (010), and no new shared semantic-fault hypothesis requires a second formulation (011). This versioned entry records the evidence (012). Before/during timing distinguishes the exception boundary (013), both real hooks receive the startup premise (014), and each path has mandatory reach (015). The coverage map identifies the same owner and finite limits.

The oracle-authoring, oracle-review and personal evaluate-review instructions now require the receiving-path inventory and comparisons before production edits. Missing required witnesses and setup failures block that gate. Aggregate reach cannot substitute for each receiving path. Retrospective verification and a recorded deviation cannot satisfy the gate.

The React owner SHA-256 is e9bff514ae6bf023ec5d310a7848fb6b817132dad6fb9cc2dc1848d5d3ecd550. Production remains pinned to the starting head. All 26 CI checks passed on that head; later-head CI must be assessed separately. F02's initial-snapshot decision still prevents a ready verdict. H04/H08 and F07 retain their evidence gaps.

SSR preparation admission — 2026-10-23#

This entry implements the maintainer's decision: fail on programming errors that expose incidental server-only rows or readiness. An ordinary cold/loading render remains legal. The SSR guide already permits normalized source rows and prepared query results. Normalized rows carry no query readiness. A completed query result can carry readiness. Runtime provider failures retain their existing error surface. This is a product decision, rather than authority inferred from production output.

Pre-edit gate. Production was unchanged at 90a30827fd32c5444243206f136a89e738ee6099 while the shared SSR judgment and receiving drivers were added. The inventory named React ordinary and infinite reads, Svelte server reads, normal browser warm reads, normalized hydration, and cold/warm Suspense discovery. Named replays ran all seven preparation boundaries before either generated campaign could stop at its first mismatch. The React drivers use real renderToString, hydrateRoot, commit, and unmount. Svelte uses real server compilation and its native browser effect root. A new real renderToPipeableStream witness checks Suspense discovery.

RED. In packages/react-db:

pnpm exec vitest run tests/descriptor-query-binding-oracle.test.tsx \
  -t 'SSR snapshot admission|SSR Suspense discovery' --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1

In packages/svelte-db:

pnpm exec vitest run tests/ssr-snapshot-admission-oracle.svelte.test.ts \
  tests/hydration.svelte.test.ts --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1

All three receiving paths accepted unsupported ready-empty snapshots and incidental rows. Pending query registration did not transport partial rows. Normalized ready sources differed at the first browser status observation. React infinite reads also ignored a completed query result. Cold/loading, ordinary completed query transport, normalized partial-loading rows, and Svelte browser initialization supplied passing neighbor controls. The first streaming control had a missing test import. Correcting that setup before production edits produced a passing cold discovery control and an assertion RED for the warm query's absent transport entry. The setup error receives no defect or calibration credit.

Repair. The shared observer checks server reads against completed query results or explicit/hydrated normalized sources. Unsupported server reads throw the coded preparation error. Normalized source snapshots report loading on both hosts until browser acquisition proves readiness. A Collection record remembers hydration, including an empty chunk. It preserves the existing dehydration selection policy. The infinite controller consumes a matching result through the same observer and uses its own server snapshot. Streaming Suspense preloads before its server snapshot, including when a peer warmed the source. Svelte distinguishes server reads from ordinary browser initialization.

Model and grammar. The pure judgment reads caller preparation, authored source state, and zero to three authored rows. It imports no production classifier. The source-state abstraction combines synchronous eager startup and readiness. Query preparation distinguishes completed and pending preload. Removing that distinction admits partial untransported data. Removing rows misses partial-loading data. Removing readiness misses ready-empty markup. Removing source preparation rejects valid normalized hydration. Idle plus nonempty rows, a completed preload with an unready source, and a pending preload over a synchronously ready source are outside this grammar. Named examples reconstruct F02 and every admission boundary. Campaign examples preserve boundary reach even when random sampling omits one. Fixed and random campaigns execute the same property and budget.

Self-review. ORC-001/002: maintainer decision and SSR guide authorize the judgment, which stays independent. ORC-003/005/009: literate model and directly named receiving drivers keep the grammar, paths, observations, and canonical terms visible. ORC-004: the reconstruction, ablation, bounded range and invalid neighbors are stated above. ORC-008 does not apply to this stateless judgment. ORC-010: cleanup does not throw in the controlled grammar, including the calibrated production mutants. ORC-011: server/browser markup equality independently challenges the preparation judgment's claim that accepted state is reproducible. ORC-013: partial-loading rows and ready-empty status distinguish row-only and readiness-only checks. ORC-014: both React hooks and Svelte each receive their premise through their real host paths. ORC-006/007/012/015 results, counts, replays and artifact identities follow below.

Limits. This closes F02 for the bounded preparation histories and named receiving cuts. It is not a proof of arbitrary providers or schedules. The coverage map keeps asynchronous providers, persistence readiness, pending-stream page-shape changes, mixed plain/Suspense streaming, and real Start/Electric execution with their owners. Custom filters that deliberately discard needed state and rendering local Collection identity are outside portable hydration. H04/H08 still need legal failing traces. F07 still needs the failing application type assignment and dependency versions.

GREEN and reach. React passes 486 tests in 23 files. After the final reach classifier correction, its SSR owner passes all 20 selected tests again. Svelte passes all 146 tests in 10 files, including type checks, with no unhandled errors. Core observer, snapshot, controller, DbClient, hydration-authority, preload-identity, and production-error owners pass 274 tests in eight files. The unchanged replay protocol and manifest suite also passed in the preceding 311-test core run. The final scoped ESLint and Prettier checks pass. Generated error documentation matches its fixture. The private-member cache validates all 420 names. The consumer minified check passes 107 error names, index metadata, query rows and live updates.

Every campaign executes 120 property samples at fixed seed 2229 or without a seed. The seven boundary examples are samples in each campaign. Counts below include those examples. normalized-ready now requires an actually ready source, rather than counting idle normalized sources. No observation expectation changed.

Calibration. These are assertion failures at the stated public comparisons:

An initial constant-false bypass failed TypeScript compilation. It receives no calibration credit. The corrected bypass retained type-valid control flow and failed the intended assertions. The first browser-guard mutant threw directly at the intended public call. A later run captures that call and fails the explicit no-error comparison instead. All temporary source mutations were restored, db was rebuilt, and the same receiving checks passed.

Guarded replays each execute one selected receiving campaign and pass on restored production. React ordinary uses seed 451253809, path 1. React infinite uses seed -348951204, path 1. Svelte uses seed 2229, path 1, captured by its own ready-empty hostile run. The old Svelte path 0:0 no longer selects a sample after adding campaign examples. The replay guard correctly rejected its zero-execution run. Only the replacement replay receives evidence credit.

From the relevant framework package, the guarded command is:

TANSTACK_DB_ORACLE_PROPERTY=<property> TANSTACK_DB_ORACLE_SEED=<seed> \
TANSTACK_DB_ORACLE_PATH=<path> node --import tsx ../db/tests/oracle-replay.ts \
  tests/<owner> --coverage.enabled=false \
  --pool-options.threads.maxThreads=2 --pool-options.threads.minThreads=1

Property IDs are react.ssr-ordinary, react.ssr-infinite, and svelte.ssr-snapshot. The React owner is descriptor-query-binding-oracle.test.tsx. The Svelte owner is ssr-snapshot-admission-oracle.svelte.test.ts.

Production weight. pnpm size:compare --packages db,react-db --files compares the full branch with merged main 65d9ada50. db grows 372 gzip / 345 brotli bytes. React grows 103 gzip / 106 brotli bytes. The typical app grows 294 gzip / 346 brotli bytes. Other app scenarios grow 272–297 gzip bytes. These totals include the earlier lifecycle repair, rather than measuring only this follow-up.

The repair reuses one observer snapshot builder and one window pagination builder. It combines the persisted-readiness condition instead of adding another publication path. Private-member minification includes both new private names. Narrower alternatives were tried as the row-only, source-readiness, and omitted-window-binding mutants above. Their intended assertion failures rule out those byte reductions. A separate hydration fact preserves existing dehydration selection and represents empty hydration chunks. Source rows and query readiness require distinct evidence. The remaining shipped growth pays for admission, that provenance, the matching infinite observer, and host selection. It adds no retry or recovery lifecycle. Tests, oracle metadata and contract documentation grow separately from production.

This entry is tied to the following artifact hashes and the commit that contains it. The starting production head is recorded above. Hashes cover final oracle artifacts:

Final SSR cache check and publication evidence#

The preceding SSR results and size figures describe the first candidate. This entry records the final cache design and supersedes those size figures. The maintainer's programming-error policy and the bounded SSR judgment are unchanged.

Adjacent cache law. With no write between reads, an ordinary observer getter retains its snapshot identity. Without a DbClient, its server getter exposes that same snapshot. A completed client query also shares its ready snapshot. Reading the server view cannot invalidate the ordinary view's cache. This follows from the existing retained-snapshot contract, independently of SSR admission.

The markup comparisons did not observe cross-getter object identity. Before the cache fix, the retained-snapshot owner added those observations to its existing sorted-map histories. Its four ordered/single-result × attached/detached paths all failed on the global server-mode cache. The focused replay also failed. A narrower client-only mode passed the no-client checks, but all four prepared-client paths and the focused replay still failed their identity comparisons. Each RED run had five assertion failures at the promised getter checkpoint. A malformed preload fixture failed setup before that corrected RED and receives no credit.

The final observer leaves getSnapshot() unchanged. It caches only provisional server copies in a separate WeakMap keyed by the ordinary snapshot. Completed query results and no-client reads use the original object. Weak keys allow obsolete revisions to retire. This adds no retry, rollback, or recovery lifecycle. These failed candidates supply hostile controls for cache invalidation. The previously recorded admission mutants still challenge the unchanged admission judgment.

Cache oracle conformance. ORC-001/002: the retained-snapshot promise authorizes identity at an unchanged revision, independently of production cache fields. ORC-003/005/009: the literate owner explains its sorted-map model, history, real observer/client preload path and getter checkpoint. ORC-004: the existing one-to-24 command grammar keeps keys a..d, versions 0..9, and delayed read orders. Both query shapes and both attachment modes reconstruct the reported failures. Removing client preparation misses the narrower failed candidate. No-write capture is the marginal identity case. Deletes of absent keys do not mutate the model or source. ORC-008: the reference model retains its existing state. ORC-010: the recorded controlled runs had no cleanup failure that replaced an assertion. ORC-011: no separate shared semantic-fault hypothesis applies to object identity. ORC-013: no-client and prepared-client observations distinguish the two failed cache modes. ORC-014: these are core getter claims, with no host handoff inferred. ORC-006/007/015: each of eight normal campaigns reaches both server-getter and client-getter 40 times. Fixed seed 2043 and an unsupplied seed use the same property and budget. The existing wrong-lazy-snapshot calibration still fails its row comparison.

The guarded cache replay uses property live-query-observer.retained-snapshot, seed 2043, and captured shrink path 0:0:0. It executes all four random/replay variants and passes. Separating the campaign test cases lets the manifest select those variants without running fixed campaigns. A preliminary guarded command rejected the missing owner mapping, which was then registered. That rejected command is not successful replay evidence. The final run reports four nonzero executions, four passing tests, and six skipped unrelated/fixed tests.

Final receiving reach. Each SSR path again runs 120 samples per campaign, including the seven boundary examples. The fixed campaigns retain their counts above. Final random counts, in the same column order, are:

React passes 486 tests in 23 files and Svelte passes 146 in 10 files on the final db build. Both include type checks. The core run passes 311 tests in nine files, including 37 guarded-replay protocol/manifest tests. After splitting the cache campaign cases, the eight core behavioral owners pass 278 tests. This is four more test cases, with the same eight campaigns and history budget. Svelte builds successfully. The minified consumer passes 107 error names, index metadata, rows and live updates. The production-error bundle check verifies 248 literals, with 20 shared literals, in ESM and CommonJS development and production builds.

Final production weight. Against merged main 65d9ada50, db grows 378 gzip / 460 brotli bytes. React grows 103 gzip / 106 brotli bytes. The typical app grows 322 gzip / 326 brotli bytes. Other scenarios grow 298–322 gzip bytes. These are full-branch figures. The row-only, readiness-preserving and omitted-window-binding alternatives failed the earlier calibrated comparisons. The global and client-only cache alternatives above failed snapshot identity. The separate weak cache retains one ordinary builder while preserving both public getter contracts. Remaining bytes pay for preparation provenance, provisional snapshots and host selection. Tests, oracle metadata and contract documentation are separate from shipped code. This SSR follow-up adds 124 production-source lines and removes six. Its test source and fixtures add 806 lines and remove 28. Those counts exclude contract documentation and build metadata.

The bounded limits and H04/H08/F07 evidence gaps above still apply. The coverage map names the cache owner and its limits alongside the SSR receiving owners. The following artifact hashes and the containing commit identify the final evidence: