PR #2257 oracle review — 2026-10-26#

Reviewed PR: https://github.com/TanStack/db/pull/2257

Reviewed head: b585f92f20de9cd89a6783ac67784d4bdf9b7a18. Four independent reviewers used the repository's oracle-review skill to examine contract authority, generated histories, listener recording, and deliberately incorrect cleanup variants. Oracle-authoring was read before experimental test changes. Production and oracle source in the shared review checkout remain unchanged.

Findings#

P2: Generate cleanup during partial delivery and reset#

Location: packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts:2415-2417, with the response driver at 2337-2359.

Every successful generated response includes both a row and up-to-date. Consequently cleanup-while-loading means no delivered rows or only retries; it never includes a transaction opened by a partial row batch, or an active reset awaiting replacement data. The law promises listener release whatever state the source reached. These are legal ordinary stream histories: electric-sdk-framing.test.ts:29-35 already demonstrates row-only responses and HTTP 409 must-refetch delivery through the real SDK.

Two single-condition changes to the production cleanup pass the existing fixed/random listener campaigns and managed-cache rotation case:

if (!transactionStarted) stream.unsubscribeAll()
// Separately:
if (!isResettingSnapshot) stream.unsubscribeAll()

The first also passes all 42 existing SDK delivery tests. A row-only response, next actual HTTP request, then cleanup distinguishes the first change: the PR leaves zero listeners; the incorrect variant leaves one. An initial HTTP 409 must-refetch, next actual request, then cleanup distinguishes both changes in eager, on-demand, and progressive modes. The Collection remains loading before cleanup, and the final listener comparison is the failing assertion.

Repair the primary history grammar with row-only and reset answers separate from up-to-date. Permit cleanup before that later marker and declare reach for partial-delivery and reset cleanup. Include nearby retry, give-up, abort, and restart histories when claiming coverage of the full stated class. Keep the independent active-run model; do not copy production transaction/reset flags into it. This finding concerns oracle coverage. The PR's unconditional production release passes these cases.

P2: Release retained listeners after a failing test#

Location: packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts:331-334 and 2396-2401.

The recorder's restore() restores method spies but leaves any remaining DOM listener registered. With the original missing release, Collection cleanup already completed; repeating that idempotent cleanup cannot remove the listener. Thus each failing or shrinking run leaves the dead SDK stream reachable from the shared document. ORC-010 requires test resources to be released on failure too.

A direct real-SDK/jsdom diagnostic recorded one actual listener after the original cleanup, one after exact recorder restoration, and zero after explicit SDK release. This is a diagnostic plus source tracing of the test's cleanup path, not a complete generated-campaign teardown experiment.

Preserve the primary assertion, then remove remaining registrations owned by the recorder during final teardown, or retain stream handles for independent test cleanup. Add a deliberate failure case showing both the original mismatch and final resource release. Do not remove listeners before comparing.

Review-evidence gap: preserve the final evidence with the reviewed revision#

The PR adds a new property but no versioned exact-head review record. Its reported RED/GREEN results, reach counts, and rejected incorrect variants live in the editable PR description. ORC-012 requires verdict-critical external evidence in a versioned record, including applicable requirement outcomes and reasons for non-applicable ones. This does not imply the reported runs did not occur. This local review record is tied to the reviewed head; it has not been committed or published by this review.

Contract and scope#

CleanupFn in packages/db/src/types.ts:420-429 and “Sync Implementation” in docs/guides/collection-options-creator.md:70-78 authorize release of resources owned by a completed sync run. After completed cleanup, no run-owned visibility listener may remain. Counting active runs independently of the adapter is sufficient for that upper bound. Allowing zero listeners before cleanup keeps valid freedom for a client that releases earlier, such as on abort. No unsupported production defect or contract revision was established.

The production path is a real Collection, the Electric adapter, installed @electric-sql/client 1.5.15, controlled HTTP, and jsdom document registrations. Experiments used archived copies of the reviewed head and read-only dependency artifacts. Explicit Vite resolution confirms core and db-ivm source came from the reviewed archive, not the dirty primary checkout. Scratch source changes were restored. Coverage instrumentation and TypeScript checking were disabled for runtime experiments; nonfatal unrelated Expo tsconfig diagnostics appeared. No setup failure or timeout was counted as an assertion rejection.

Executed evidence#

Evidence is retained in review-evidence/pr2257-oracle-review/. The partial case patch appends to the reviewed oracle; the reset case text likewise uses its existing helpers. Exact incorrect variants are the two lines above.

From the experimental snapshot's packages/electric-db-collection directory, reviewers used the installed Vitest entry point directly:

node /Users/kyle.mathews/programs/tanstack-db/node_modules/vitest/vitest.mjs run tests/electric-sdk-delivery-oracle.property.test.ts --coverage.enabled=false --typecheck.enabled=false

Selectors restricted individual runs to the listener campaigns, rotation, or appended review cases. Raw logs distinguish each execution and comparison.

Original failure and direct replay#

Removing only stream.unsubscribeAll() reproduces the original defect in both listener campaigns: run 0 cleanup: live listeners, expected at most zero, received one. The fixed campaign reduces to one eager run with no answers and an open ending. Seed 20261024, path 0:0:0:0, and property electric.sdk-source-release select exactly one replay test and reproduce the same cleanup assertion. Restoring the reviewed production makes that identical replay pass. Both scratch source files were restored to reviewed bytes.

TANSTACK_DB_ORACLE_SEED=20261024 TANSTACK_DB_ORACLE_PATH=0:0:0:0 TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-source-release node /Users/kyle.mathews/programs/tanstack-db/node_modules/vitest/vitest.mjs run tests/electric-sdk-delivery-oracle.property.test.ts -t replay --coverage.enabled=false --typecheck.enabled=false

Final review-checkout runtime validation: all 42 SDK delivery tests pass with the installed local dependency override. pnpm lint:changed also passes. Production and oracle source remain unchanged; only local installation files and this review's report/evidence differ from the reviewed head.

ORC outcomes#

Remaining limits and setup#

No live Electric service or React Native AppState run was executed. General EventTarget callback-reuse/capture semantics are not established by this recorder, but the pinned SDK uses one fresh default-capture callback per stream, so those theoretical recorder limitations are not additional findings. Fixed managed-cache rotation is a valid receiving case; lack of arbitrary rotation generation alone was not reported as a defect.

The review worktree is detached at the exact PR head. No remote branch was published. Dependency installation used --ignore-scripts and a local-only pnpm override for baseline-browser-mapping from 2.11.32 to 2.11.29: 2.11.31 also returned 403, and 2.11.30 was absent from registry metadata. The override and resulting lockfile changes must remain uncommitted. Global /Users/kyle.mathews/.codex/AGENTS.md now records that recovery rule.

Repair and review evaluation — 2026-10-26#

This entry evaluates the four raw reviews and records the authorized repairs. The preceding entry describes the initial head, not the state after this entry. Starting head: b585f92f20de9cd89a6783ac67784d4bdf9b7a18. The tested oracle source SHA-256 is 4c997a507c116710a171c6703338b5b3964ff19f35b98ceac8124e9085486dad. The commit containing this entry identifies the corresponding repair tree; production source is unchanged from the starting head. Raw reviewer notes, full logs, and the append-only working ledger remain task-local rather than being published as part of the change.

Laws, experiments, and inference#

The oracle grammar now accepts zero to three answers per run, from row, up-to-date, reset, and retry; one to three runs; all three sync modes; and open, give-up, or abort endings. The same driver also runs 18 minimal histories: two incomplete answers × three endings × three modes. These remain replay examples alongside generated nearby histories, rather than replacing generation. Readiness reach reads public Collection status; pending-answer reach derives only from provider inputs, without inspecting production transaction/reset flags.

Grammar controls: removing row-only or reset loses the demonstrated cases; removing up-to-date loses completed-delivery comparisons; removing retry loses incomplete delivery across retried failure; removing terminal endings loses give-up/abort cleanup; removing modes loses their installed-SDK paths; removing multiple runs loses cleanup/restart and already-aborted restart. Zero answers covers immediate cleanup, three answers can cross reset, row and completion, and three runs cover repeated release. Requests are answered only when the real SDK sent them: after give-up or external abort, no later response is invented. This is a bounded grammar, not a proof for arbitrary history length.

Lossless item ledger#

Raw claims and their original proposed repairs were copied into the working ledger before new tests or edits. Source-order IDs remain distinct even where multiple reviewers identified the same gap.

Original items: 18 = 3 fixed-now + 5 duplicates + 8 accepted-design + 2 refuted. One additional repair-time item, S01, is fixed-now. No item is deferred, awaiting a product decision, or confirmed-open. The final loss audit returned to the four raw reports, including their non-finding hypotheses and scope notes; all are represented above. The working ledger remains local.

Reviewer assessment#

• Law/authority reviewer: hire. Correct public authority and useful separation of product correctness, coverage and documentary evidence; appropriately limited source-only conclusions.
• History reviewer: strong hire. Demonstrated full-file acceptance of a wrong conditional release, supplied a minimal legal case, and verified reviewed source resolution rather than assuming dependency reuse was safe.
• Recorder reviewer: hire. Found a real failure-path resource issue, calibrated physical registrations, and did not promote out-of-domain counting concerns into unsupported findings.
• Independent variant reviewer: strong hire. Supplied the distinct reset case across all modes and a second incorrect condition. Correctly distinguished a coverage defect from a production defect.

Prioritization and proposed repairs were sound. The initial direct SDK teardown diagnostic was narrower than a full generated failure-path test; the new bounded calibration supplies executable regression evidence. Independent rereviews found no substantive issue with the grammar or teardown repair; the readiness wording caveat was resolved by S01.

RED, GREEN, and replay evidence#

Unchanged PR production passes the expanded resource-release campaigns. Before recorder repair, the new teardown calibration fails because a retained callback is called once after cleanup; the identical test passes after repair. Thus no product defect is attributed to this test-only update.

Each incorrect production variant is run separately in an archived checkout with the updated oracle. Both fixed/random campaigns reject each at the post-cleanup listener assertion, not setup, timeout, or unrelated errors:

Each captured path was replayed directly with TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-source-release, the listed seed/path, and -t replay; each incorrect source fails the same cleanup assertion and unchanged PR production passes the identical replay. Experimental source is restored after execution.

Reach counts are histories, not sync-run totals. A scratch copy logged the existing reach counters without changing generation, comparison or the 40-history campaign budget:

Commands from the repository root:

pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false
pnpm exec eslint packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts
pnpm lint:changed
pnpm --filter @tanstack/electric-db-collection... build

The Electric package run passes 1,130 runtime tests (one skipped), with no type errors. The changed-file ESLint and oracle-rule checks pass. Builds pass after linking required cached workspace dependencies. Initial missing dependency and build-output errors were setup failures, not successful checks. Production source has no diff, so shipped production-byte weight is unchanged; only tests and contract/evidence documentation grow. No new changeset is needed for this test-only follow-up to the PR's existing release changeset.

Final requirement outcomes and limits#

ORC-001/002/003: authority, independent active-run judgment, and literate layers preserved. ORC-004: row/reset reconstruction plus ablation/range/exclusion accounted for above. ORC-005: real SDK, actual HTTP request fences, listener comparisons after every answer/terminal step/completed cleanup; no concrete missing-input hypothesis. ORC-006/007: original and two conditional variants rejected by fixed/random campaigns; direct failing and passing replays checked. ORC-008/009: model unchanged; authored pending answers are explicitly driver reach bookkeeping and public readiness is read directly. ORC-010: primary failure preserved and actual registrations released by the calibrated finally path. ORC-011 is not triggered: no supported shared semantic-model fault needs a second expected-result formulation. ORC-012: this versioned exact-base and source-digest record closes the documentary gap. ORC-013: row/reset premises and nearby completed/terminal histories distinguish the incorrect conditions. ORC-014: installed SDK supplies stream/reset/listener behavior; controlled HTTP supplies responses. ORC-015: seven declared reaches are checked per campaign, including the two previously missing premises.

The claims remain bounded to these generated legal histories, three sync modes, the installed SDK, controlled HTTP, browser document in jsdom, and existing managed-cache rotation receiver. There is no live-service or React Native AppState execution claim. There is no known reachable counterexample inside this bounded repair claim; sampled campaigns are not a universal proof. Whole-PR merge readiness is not assessed by this review evaluation; remote CI and later PR changes remain separate from the local checks above.

Second review: enforcement repairs — 2026-10-26#

Starting head: 1a5ca0edeacf0600f6f6a0d04df32ea90b7a4bea. Tested oracle SHA-256: 5917bd5b125d71d952804aca26e513db99c75e7d46a8efb458cb91a2d563b543. The commit containing this entry identifies the repair tree. Production is unchanged from the starting head. Four fresh reviewers independently examined authority, histories, recorder behavior, and receiving paths. Raw reports and the append-only evaluation ledger remain task-local; this entry preserves the verdict-critical evidence.

Law, experiment, inference, enforcement#

Completed cleanup already releases all resources owned by the ended sync run (CleanupFn, packages/db/src/types.ts:419-429; creator guide, Sync Implementation). This deadline includes supported asynchronous error decisions that have not settled. It does not require disposal on external abort alone, zero listeners synchronously at cleanup entry, or any minimum listener count while active. The active upper bound and one-add-per-start control are now explicitly identified as installed-provider/driver premises.

The expanded grammar retains row-only, up-to-date, reset, and retried-error prefixes; all three modes; one to three runs; and the previous open, give-up, and abort endings. Its fixed partial/reset examples now cross all five endings, 30 histories. Expected resource ownership remains the independent active run count. No production branch or internal retry/reset classifier computes that result.

RED, GREEN, reach, and replay#

Recorder calibration was added before repairing its observer. On the old recorder it fails a legal remove/remove/add history: recorded 0, actual dispatch 1. The identical calibration passes after repair, including capture mismatch, remove-before-add, re-add, duplicate-add, callback identity, dual capture, and equivalent capture spellings. Existing final-release/primary-error calibration still passes. Comparison remains before recorder.restore.

Unchanged PR production passes the expanded fixed/random property. Each campaign uses the same generator, observer, comparison and 40-history budget. A private copy printed existing reach counters without changing semantics:

Two supplementary 40-history random campaigns pass all reaches, with pending reach 28 and 23. They supplement the normal pair and do not replace it.

All four incorrect release designs fail both expanded campaigns at the intended post-cleanup listener assertion (actual 1, allowed 0), not setup or a timeout:

Three captured pending-decision replays, including the latest random path above and 778119691 / 2:0:0, fail the incorrect design and pass unchanged production. Each selects exactly one replay test. The latest random witness fails cleanup of a restarted run. The wrong-capture SDK variant also fails with the final oracle at seed 20261024/path 0; the unmodified SDK passes that same replay. Experimental production and SDK changes remain isolated from the branch.

Commands from repository root:

pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false
pnpm lint:changed
pnpm exec prettier --check packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts docs/contributing/oracle-coverage.md docs/contributing/oracle-reviews/2026-10-26-pr-2257.md

Package result: 1,131 runtime tests pass, one skipped, no type errors. Changed-file lint and formatting pass. The new bounded calibration is one additional test; production bytes and behavior are unchanged. No changeset is needed for this test-only follow-up.

Authority clarification and remaining decision#

The completed-run cleanup law above already has authority. Partial rows, reset, and pending error decisions introduce no new exception or product rule. The one-listener active bound and exact construction count are pinned SDK premises, not universal API requirements.

Same-run cache rotation is a separate timing question. The public restart hook requires immediate old-callback retirement and replacement after cache rotation (types.ts:435-443; SQLite guide, managed generations). It does not explicitly state that every old host resource must be released before replacement. Current Electric source already awaits session cleanup before replacement, while the existing rotation assertion runs later, after replacement demands settle and a late old response. That assertion does not establish the earlier deadline.

Candidate contract: release all retired provider-session resources before starting its replacement. Rival: permit inert resources until enclosing-run cleanup, while fencing old rows/acknowledgements. The recommendation is the candidate, to prevent accumulation over repeated rotations. A user decision was requested; no new deadline or earlier expectation was silently adopted. The two independent enforcement repairs above do not depend on that decision.

Review evaluation, requirement outcomes, and limits#

The 41 source-order items remain accounted for: 27 accepted-design, 2 fixed-now (R01/H01), 2 already-fixed, 8 duplicates, 1 refuted, 1 design-decision; none deferred. Each retains its original claim, evidence and durable destination in the local ledger. The previous review-only stopping interpretation was superseded after re-reading evaluate-review's explicit authorization to repair enforcement gaps. All four reviewers merit hire for their bounded tasks: concrete observer and history counterexamples, careful authority distinctions, and receiving-path checks with honest environment limits. A separate source rereview of the final repair found no further supported issue; runtime results above supply its remaining execution evidence.

ORC-001/002/003: existing resource authority and independent active-run result preserved, with provider calibration distinguished. ORC-004: new pending endings reconstruct the reported trace and partial/reset/restart neighbors; removing that ending loses the demonstrated distinction. Recorder enumeration spans all stated operation/callback/capture sequences; removing an axis loses the named identity/normalization witness, and length 3 reaches re-add. ORC-005: real installed SDK receives 503 and enters onError before cleanup; native dispatch checks actual listener ownership before teardown. No missing source-information hypothesis is needed to release known owned resources. ORC-006/007: old-observer RED, final GREEN, incorrect-design assertions and direct fixed/random replays recorded above. ORC-008/009: semantic model unchanged; held decisions are authored driver promises, not copied adapter state. ORC-010: primary failure, secondary diagnostics and independent final fixture release remain intact. ORC-011: native dispatch supplies a different ownership formulation for the named shared capture/order fault. ORC-012/013: exact-source record, distinguishing pending/capture witnesses, and remaining rotation decision recorded here. ORC-014: installed SDK supplies error-decision and listener behavior; HTTP and jsdom supply explicitly controlled premises. ORC-015: all 8 declared states reached in each normal campaign; pending-decision reach is based on actual callback entry, not merely an authored ending token. Bounded recorder enumeration is not an important generated property and asserts its exact 8,421-history count.

Claims remain bounded to installed SDK 1.5.15, controlled HTTP, browser document in jsdom, the stated captures and passive callbacks, and these finite histories. Once/signal automatic removal, mutable/exotic option objects, arbitrary callback mutation during dispatch, actual native hosts, every accepted SDK version, arbitrary streaming/acceptance schedules, and post-decision effects after fixture teardown are not established. Separate two-Collection and exact SDK 1.5.23-source controlled AppState probes pass current production and reject the base missing-release path, but do not claim checked-in generated peer isolation or actual iOS/Android execution. No current production defect was found in these paths. Whole-PR readiness is not assessed by this evaluation.

Approved rotation deadline and final rereview — 2026-10-26#

Parent commit: c73f47984c54c8625f9614f698a7b98b1d354e20. Final SDK-delivery owner SHA256: f046cb9cbdf26a8ffc8c746bf762f00d949faf054bc6cbe7e4e5545fd7d11b1f. Unchanged Electric production SHA256: 4919ad548c416952fe51822b9e1d06c20dd5807b6dda40909bc3ed7046b66015. These source identities cover the executable change accompanying this entry.

Law decision and current production#

The user explicitly selected “Yes — require release before replacement.” A03 is now implemented in the Electric guide: release the retired provider session's adapter-owned resources before constructing its replacement ShapeStream. Callback retirement remains immediate; replacement follows cache-rotation completion. An HTTP request that ignores cancellation may finish later without gaining authority over replacement rows or waits.

This is the new explicit deadline that the earlier contract left ambiguous. Current Electric already satisfies it; no production edit was needed. The shared restart hook is unchanged: Query recovery reuses observers and shared resources rather than constructing a replacement provider session.

Experiments and repairs#

The existing real-SDK rotation driver now generates one to three sequential rotations in the same Collection sync run. A retired snapshot arrives during held rotation, before replacement snapshots, or after replacement settlement. Fresh IDs and demand unloads preserve an actual pending old snapshot in every round. A forwarding Proxy records document-listener ownership immediately before invoking the real installed SDK constructor. It neither disposes resources nor substitutes SDK behavior. The model requires zero old listeners at that boundary, one replacement listener after delivery, and zero after completed Collection cleanup.

The following experiments distinguish that deadline and preserve its freedom:

• Disposal immediately after replacement construction fails the new comparison: expected zero, actual one. Removing only that comparison lets both 40-history campaigns pass, including all later row, demand, and listener comparisons.
• Disposal after cache rotation fulfills but immediately before construction passes both campaigns. A diagnostic replay observes one listener while rotation is held and zero before construction. The oracle therefore does not require synchronous disposal at rotation entry.
• Disposal only for the initial session fails when a generated second rotation retires its replacement. A one-rotation example alone would miss this rule.
• Exact final-owner replay pairs use property electric.sdk-rotation-release, seed 20261026, and paths 0:0:0 and 0:1:1, respectively. The two incorrect variants fail at the constructor comparison; unchanged production passes both. These are assertion failures, not setup failures or timeouts.

Independent rereview found two additional oracle issues. Both are repaired:

S01's provisional reviewer label “R03” is an alias only; the original ledger's R03 primary-error item retains its identity. A broad variant that returns early for every load fails the held-rotation pending comparison. The more selective retired-demand variant fails the later pre-response comparison, so both neighboring regimes remain distinguishable.

Reach, GREEN, and review requirements#

Both normal rotation campaigns run 40 histories with the same grammar, observations, comparison, and budget; only seed selection differs. The property is registered in both the oracle registry and named replay manifest. Final-source diagnostics print counts without changing expectations or driver behavior:

All eight source-release states also reach their minimum on this final source. Their fixed/random counts, in declaration order, are 21/22, 13/10, 13/15, 14/15, 27/31, 6/14, 11/21, 18/16.

Validation:

• Full Electric package after S01: 1,133 runtime tests pass, one skipped, no type errors. After S02's diagnostic snapshots, the complete changed owner passes all 49 runtime and three type tests, including both generated laws.
• Core replay/manifest suite: all 38 tests pass, no type errors.
• Changed-file lint, Prettier, and whitespace checks pass.
• R01 wrong-capture and H01 pending-decision release replay pairs were also rerun after introducing the constructor wrapper: each incorrect design fails the cleanup assertion; its unchanged-production partner passes.

ORC-001/002/003: approved deadline and existing subset law are explicit beside independent zero-listener and pending-demand rules. ORC-004: length 1 reconstructs the original case; lengths 2–3 distinguish replacement retirement; three delivery cuts preserve legal late-response timings. Removing the earlier observation admits the measured wrong ordering. The grammar answers admitted requests and does not construct replacement before releasing the cache result. ORC-005/006: real constructor/HTTP path reached; ordering and settlement variants fail their intended comparisons. ORC-007: equal fixed/random budgets and exact direct replays pass/fail as stated. ORC-008/009: no copied production state machine; session/run and physical work/demand settlement remain distinct. ORC-010: release the held gate before cleanup, retain primary/secondary diagnostics, release fixture resources, and snapshot primitive observations. ORC-011: no new shared semantic fault needing a second resource model was identified; R01's native-dispatch formulation remains. ORC-012/013: this source-bound record, legal-before/incorrect-after neighbor, and initial/replacement distinction supply review and boundary evidence. ORC-014: installed SDK supplies real construction, parsing, listener behavior, and promise delivery; HTTP and the Map-backed cache supply explicitly controlled premises. ORC-015: all six new states and eight existing release states are measured and required.

Final accounting and limits#

All original raw reports and the two new sibling findings were revisited. Final totals: 43 = 27 accepted-design + 5 fixed-now + 2 already-fixed + 8 duplicates + 1 refuted. There are no confirmed-open, deferred, or pending design-decision items. A03 moved from design-decision to fixed-now after the explicit approval and implementation. Independent rereview found no further supported issue; the reviewers merit hire for concrete distinguishing examples, authority discipline, and checking their own diagnostic limitations.

This closes the named enforcement gaps within installed SDK 1.5.15, jsdom, controlled HTTP, Map-backed persistence, sequential one-to-three rotations, and the stated comparison cuts. Overlapping rotations, actual native hosts, every supported SDK version, arbitrary failure schedules, every future private SDK resource, and separate mutation-evidence wait semantics are not established. No production code changed. Whole-PR readiness remains unassessed by this targeted evaluation; CI for earlier commits does not cover these changes.

Package ESLint follow-up — 2026-10-26#

CI on 04b1c4b2299a95746c6f64521d54ca4b2804a194 exposed two package ESLint errors that the narrower lint:changed oracle check did not report. Use a type-only namespace import for the real SDK module type, and remove a null comparison excluded by the typed listener-call domain. The installed SDK and bounded calibration both supply non-null callbacks. The measured histories, expected results, and checkpoints remain unchanged.

Final owner SHA256: f6d2a06d3cab1e1c5b18a2c2b6285b0b8cadb4f805d679feefc45caadd519a66. Package ESLint passes for the changed Electric owner and core registry/manifest. The complete owner passes all 49 runtime and three type tests, including the 8,421-history native calibration and both generated laws. This is a mechanical follow-up to the evidence above; the 43-item review accounting is unchanged.

CodeRabbit follow-up review — 2026-10-26#

Review 5657996284 covers 04b1c4b2299a95746c6f64521d54ca4b2804a194. Its three reported spacing defects in this record were confirmed and corrected. The intervening package-lint commit changes no oracle law or checkpoint. Source and formatting checks are the appropriate evidence for these text edits.

The review body and mutable summary were inventoried separately from the 43-item agent evaluation above. Their 43 source-order entries, including individual endorsed ranges, repeated claims, metadata, and suggestions, resolve as 35 accepted-design + 3 fixed-now + 1 already-fixed + 1 refuted + 3 duplicates. No confirmed-open or deferred item was introduced. The CI suggestion concerns the lint failure already repaired by 997d21d79.

The reported 60% docstring score is a vendor metric; no repository rule imposes its proposed 80% threshold. The owner already documents its contract, model, histories, driver, comparisons, and limits. Adding comments solely for that ratio would not improve the evidence. The native AppState caveat remains valid: the checked-in lane observes installed SDK 1.5.15 in jsdom. The separately recorded exact 1.5.23-source probe reaches automatic AppState selection with controlled native premises, passes current production, and rejects the original missing release. It does not establish actual iOS/Android runtime behavior or all supported SDK versions. These limits remain explicit; no native-wide closure or whole-PR readiness is inferred.

Reviewer assessment: the spacing correction is precise and useful; endorsements and the scope caveat are consistent with the recorded evidence. The unsupported documentation threshold and lack of a new distinguishing experiment limit this review's depth. Do not hire for independent oracle review on this evidence alone. The final loss audit revisited the full review body and summary, including ancillary suggestions and repeated details. No behavioral repair or new experiment was required by this review.

Retired durable-target observation — 2026-10-26#

CodeRabbit review 5658197144, item N01, identifies an observation gap in the managed-rotation owner. The review covers 997d21d7900bd6a9deed692942ea8d54bf2fdc6b; this evaluation starts at c88dcfe5902be80892d2108f16b9ec764041dbe7, whose intervening change affects only this record. The reviewed owner hash is the f6d2a06d hash above. N01 is fixed-now. It reveals no reproduced production routing defect.

Law and repair#

The SQLite persistence guide's managed-generation contract requires immediate retirement of expired source callbacks. The Electric guide's “Cleanup and resume safety” contract fences the retired provider session's late responses. Its adjacent recovery contract permits another run with a valid claim to keep using a retired persisted cache generation. Therefore this expired session's late row cannot enter either durable target; the whole retired map need not be empty or immutable.

The independent source model already says that the old predicate has no row. Each round uses a fresh odd key and now remembers its retired storage target. The oracle compares that key's absence after the late HTTP response and after replacement settlement. All prior current-cache, public-row, constructor, demand-settlement, and cleanup comparisons remain. The grammar still generates one to three rotations and all three delivery cuts. This adds an observation and a seventh required reach state, without changing production or model rules.

Evidence block#

• Law: expired Electric provider-session callbacks have no authority to persist their late row through either generation; the public guides above supply the authority. A valid run's retained generation remains usable.
• Reach: normal fixed/random campaigns each run 40 histories. In declaration order, the seven final counts are 19/23, 25/18, 17/21, 40/40, 26/22, 40/40, 40/40: during rotation, before snapshots, after snapshots, initial retirement, replacement retirement, demands awaiting replacement, and retired target observed. Every minimum is one history.
• RED: the old owner accepts a forbidden oldId write into the captured retired map through the fixture's real applyCommittedTx, in fixed 40 and random 40 histories. This confirms the missing observation. With the repaired owner, both campaigns reject that incorrect result at retired response in retired cache: expected true to be false.
• GREEN: unchanged production passes the repaired owner in fixed 40 and random 40 histories. The complete owner passes 49 runtime and three type tests with no type errors. Electric package ESLint passes.
• Mutant: this is a wrong-result control at the durable fixture boundary, not a production mutation or evidence that production misroutes callbacks. The fixed RED starts with ["after-snapshots", "before-snapshots"] and shrinks to ["during-rotation"], seed 20261026, path 0:0:0, preserving the assertion. Exact replay fails with the control and passes unchanged production. A second direct replay inserts the wrong row only at the final cut and fails retired response in retired cache after replacement.
• Limits: real installed SDK 1.5.15, controlled HTTP, jsdom, one on-demand Collection, Map-backed durable storage, sequential one-to-three rotations, and the stated observation cuts. Actual SQLite peer-claim enforcement, overlapping rotations, native hosts, all supported SDK versions, and a write inserted and removed entirely between cuts are not established.

A neighboring-state control seeds an unrelated negative key before expiry and checks that it remains in retired storage after replacement. Both campaigns pass. This calibrates acceptance of allowed retained contents; it does not execute a real peer claim. An earlier scratch control named valid-peer-write used the fixture's one claim ID and is not credited as peer authorization.

Final owner SHA256: 7ccf1eb989a5d5a33876601bbca816b35069a5c70352d45ade2631bf58217005. Unchanged Electric production SHA256: 4919ad548c416952fe51822b9e1d06c20dd5807b6dda40909bc3ed7046b66015. The diagnostic baseline owner hash is 1b2ed73a4177382b726445f6b028d945e466561e33f0b41d93b4ee99556b1af4; the immediate wrong-write owner hash is 9db1697989749a49fc9a22fb2ea944c6a691928cb2730d3ee90ea83e40a6dcc0. Only diagnostics and the specified control distinguish these executed files from the final owner. The private Vite config resolves the private production source and real installed SDK explicitly; logs record the positive source witness. The snapshot owner is restored after the controls.

The normal command is:

pnpm --dir packages/electric-db-collection exec vitest run tests/electric-sdk-delivery-oracle.property.test.ts --coverage.enabled=false --maxWorkers=2

The direct replay uses the same command with -t replay and TANSTACK_DB_ORACLE_SEED=20261026, TANSTACK_DB_ORACLE_PATH=0:0:0, and TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-rotation-release. Wrong-result controls run that replay in the private source-bound snapshot, without editing shared production. Raw owners, patches, manifests, commands, and logs remain in the task's /tmp/pr2257-ci-loop/retired-map/ evidence directory.

Guide conformance and disposition#

ORC-001/002/003: public authority and the absent-key prediction are explicit beside the model; the five responsibilities remain distinguishable. ORC-004: one round reconstructs the observation gap; repeated rounds distinguish replacement retirement; each delivery cut supplies a different retirement interval. The grammar answers only admitted requests. ORC-005/006: real SDK/Collection/persistence paths run, and both new durable comparisons reject their intended wrong result. ORC-007: equal fixed/random budgets and the direct replay fail/pass pair are recorded. ORC-008 adds no stateful-model distinction; the captured target is a driver observation. ORC-009 preserves the glossary's separate provider session, sync run, and persisted cache generation. ORC-010: shrinking retains the durable failure, primitive observations survive cleanup, and fixture resources are released. ORC-011 has no named shared semantic computation requiring a second formulation; the expected absent key comes from the source model. ORC-012 is this source-bound record. ORC-013 distinguishes immediate/final wrong writes and allowed retained contents. ORC-014 credits real SDK delivery and limits the durable premise to the Map fixture, without a real SQLite/native handoff claim. ORC-015 requires and measures seven reach states.

The old comparison's false green came from an unobserved durable target, not missing histories or a copied expected result. Capturing that target and observing it across the existing grammar is the smallest general repair. No known reachable in-scope counterexample remains from N01. This bounded observation repair does not establish whole-PR readiness. N02, N03, and U05 repeat N01 and retain their separate ledger identities.

Reviewer assessment for N01: accurate, concrete, and appropriately low severity. The proposed small assertion repair is useful. The valid-retained-generation distinction required additional examination. Hire for this focused enforcement review; this evidence alone does not establish broader law-design depth.

A fresh read-only rereview checked final owner 7ccf1eb9 and found no further supported defect. It independently passed the targeted three-test rotation baseline. The complete second CodeRabbit inventory contains 21 source-order items, including repeated prompts and mutable-summary metadata: 9 accepted-design + 1 fixed-now + 11 duplicates. No item from that review remains open or deferred. This accounting is separate from the earlier agent and CodeRabbit inventories.

CF01 — ordered replay oracle classification repair#

The DB CI counterexample is an oracle boundary-classification defect under the accepted demand/replay contracts. Production is unchanged. Baseline is PR head c88dcfe5902be80892d2108f16b9ec764041dbe7; shared integration is based on 5e1b3ff0f09b176feac1c39ba47938c1ad79e35a.

• Law: a newly initiated lazy keyed request may fail terminally even when truncate causes it. A failed reacquisition of an established request is an ordinary replay and retains the last complete publication until authoritative replacement. Authority: the architecture's Demand plane/current-demand contract and “Replay participants and failure,” plus the coverage map's explicit terminal failDemand policy. Nonterminal current-demand recovery remains a future contract.
• Boundary repair: marker truncate synchronously creates fresh include demand, while established marker reacquisitions start later. The old markerReplaying call-stack flag misclassifies both. The driver now observes initiating keyed requestSnapshot result receipts, matching rejection only to exact authored root/marker load errors in a dedicated WeakSet. Release faults cannot supply the allowance. No predicate identity, production replay state/classifier, or terminal-status observation computes that allowance.
• Reach: replay.keyed-request-failures constructs both failure placements, varying head rank, ascending/descending order and marker 3/4 membership before failure. Only recoverable histories get generated later actions. Each fixed and random campaign has 40 generated pairs, hence 80 concrete histories; initiating-keyed failure reaches 40 histories and keyed-reacquisition failure reaches 40. Reach records actual receipt/acquisition failures, not the selected placement. A broad-random reach miss (zero initiating failures) was retained as sampling evidence and repaired constructively, without weakening reach.
• RED: original property replay.ordered-window-faults, seed -82695597, path 43:2:7:4:4:4:4, fails convergence: terminal error, false versus true, on unchanged original owner and production. The trace is hold, truncateMarkers, settle(false), move(root 1, rank 1); scenario is ascending, offset 0, limit 1, anti-join, on-demand markers, includes, no ties/peer. The failed oldest load is a fresh include request, so the existing terminal lazy-demand policy applies.
• GREEN: the repaired complete owner passes 31 tests, including broad fixed 300/random 300 and boundary fixed 40/random 40 campaigns. The original CI coordinates still replay exactly. Guarded original and new-property replays each report one executed property; the latter uses seed 20261026, path 0:0:0:0. Named neighbors preserve established include/marker replay failures and a pending include whose initiating adapter succeeds before reacquisition fails.
• Mutant: private production control makes every onLoadSubsetError terminal via recordSubsetError(error, true). Both boundary campaigns reject it at the established-replay terminal-error assertion. Fixed seed 20261026, path 0:0:0:0, shrinks to [[], "asc", 1, false, false]: exact replay is RED with the control and GREEN after restoring production. The empty suffix shows rejection at the intended boundary. Rebuilding every acquisition predicate as and(where, where) passes both campaigns with 40/40 reach, preserving freedom to reconstruct equivalent expressions. All production controls were restored byte-for-byte.
• Limits: this status relation does not independently establish correct settlement of the initiating receipt. The pre-existing history-level failure allowance remains shared in peer scenarios, so per-receiver failure isolation is unproved. The coverage map names the existing owner and a needed witness that fails one receiver while checking another at the same cut. These laws are not retired or claimed closed. Real-provider cancellation, framework timing, every replay interleaving and nonterminal recovery of failed current demand remain outside this result.

Final oracle Git blob: 68c8339969fe4a87380e83e0194fdddc67f0f990. Final oracle SHA256: 7a476bec755a566d6eb59bac73dd272c386fa618b4b5aa3d9d00e887d776a66d. Original oracle SHA256: 382f2f2f1975251d77ecaaa16e410fb4048b379c83d4e91834cd630ea6e98ada. Unchanged subscription/subscriber SHA256: c446932a8a1f8b2efd79d00846f1a110e65a6c6df75d2b24658053e6964b530b / 74e97fe498b44446d5ee21912175afab6a3e58d2787e04e890a26771d5c8e1a6.

Runtime evidence uses the private source-bound archive at /tmp/pr2257-ci-loop/db1-snapshot and its db1.config.mts; coverage/typechecking are disabled. Full commands and raw log hashes are in /tmp/pr2257-ci-loop/db1-evaluation.md. The two exact guarded commands are:

TANSTACK_DB_ORACLE_SEED=-82695597 TANSTACK_DB_ORACLE_PATH=43:2:7:4:4:4:4 TANSTACK_DB_ORACLE_PROPERTY=replay.ordered-window-faults node --import tsx packages/db/tests/oracle-replay.ts --config db1.config.mts
TANSTACK_DB_ORACLE_SEED=20261026 TANSTACK_DB_ORACLE_PATH=0:0:0:0 TANSTACK_DB_ORACLE_PROPERTY=replay.keyed-request-failures node --import tsx packages/db/tests/oracle-replay.ts --config db1.config.mts

Package ESLint, source/registry Prettier, pnpm lint:changed and git diff --check pass. The manifest registers both replay targets and selects only their replay campaign. No production edit, commit or push is part of this repair. A fresh law/independence review accepts the final owner blob above; whole-PR readiness remains with the parent CI evaluation.

CF01 guide applicability#

ORC-001/002/003: existing contract authority, independently authored load-error identity, and the initiating-request observation are explicit beside the law. ORC-004: constructive prefixes reach both distinctions, with useful pre-failure variation and recoverable continuations; no full ablation of the inherited checker grammar was performed or claimed. ORC-005/006: the real Collection and live-query path reaches the intended comparison, which rejects the incorrect terminal-error control and accepts equivalent rebuilt predicates. ORC-007: fixed/random budgets match, and original and new exact replay coordinates are recorded. ORC-008/009: no new semantic model state is introduced; driver reach states name request initiation and reacquisition using the existing glossary. ORC-010: inherited final draining and cleanup remain; the added observer is restored and its rejection observation is handled. ORC-011 adds no independent reference computation needing a second formulation; correctness of receipt settlement and per-receiver error isolation remain explicit unproved limits. ORC-012 is this source-bound evidence block. ORC-013: fresh and established request failures, pending success before failure, rebuilt predicates, and the incorrect terminal-error control distinguish the repaired boundary. ORC-014: the internal receiving boundary runs through real DB code; the controlled provider establishes no real-provider, framework or host handoff. ORC-015: actual receipt/acquisition failures measure both declared states at 40 histories per campaign. This accounting applies to CF01's bounded observation repair and does not replace the earlier cleanup-review outcomes.

The private full/reach and boundary-control runs add only console output of failureReach.counts() to the shared owner; expectations, generated inputs and production behavior are unchanged. The recorded final owner hashes identify the shared file without that diagnostic output.

Production reduction after 42e2d9ca8#

The user requested less production code and fewer shipped bytes. This follow-up removes the mutable callback-release handle and its no-op initial value. Each of the four terminal paths now calls the private stream's unsubscribeAll() before the existing abort. Cleanup no longer calls both release methods. Earlier release at terminal resume/durability failure is permitted by the accepted cleanup contract; this change introduces no new deadline or law. The approved release-before-replacement deadline remains unchanged.

The final production source is three lines and 149 bytes smaller than merge-base 5649a07d4. With dependencies external, the production comparison reports +1 byte gzip and -5 bytes brotli against that base (gzip 10,162 to 10,163 bytes). The prior pushed implementation measured +9 gzip/+15 brotli. The clean direct-call implementation was smaller than either a stop helper or a release-only alias. Inlining the queued-batch temporary increased brotli size and was not retained. This is not a claim of reduction in both formats.

Law and evidence#

• Law: cleanup releases resources owned by its sync run, under CleanupFn and the collection-options creator guide. The installed-SDK source-release and rotation owners retain their earlier laws, histories, observations and sensitivity evidence. Removing the returned handle is valid because each Electric provider session privately owns its stream; full release removes that stream's callback as well as host listeners. Abort still owns request cancellation. SDK subscription registration precedes synchronous delivery, so full release also works before subscribe() returns its handle.
• Reach: no new product law, history dimension or scope claim is added. Existing fixed/random campaigns and declared reach checks pass in the full Electric package. The fixture calibration enumerates both release cuts: during synchronous subscription and after its return.
• RED: a wrapper that only assigns the callback release after mockSubscribe() returns fails the synchronous calibration: expected one release, observed zero. It passes the after-return neighbor. This is an assertion failure at callback release, not a setup or timeout result.
• GREEN: pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false --maxWorkers=2 passes 30 files, 1,136 runtime tests, one skipped test, and typechecking on the exact source identities below. The calibration's two cases pass with the wrapper's stopped flag. Package ESLint has zero errors (23 existing warnings), Prettier, pnpm lint:changed and whitespace checks pass.
• Mutant: the calibration rejects the missing-stopped-flag wrapper above. Earlier installed-SDK listener, release-order, demand-settlement and retired storage controls remain applicable; their results are recorded above rather than presented as a new production defect.
• Limits: the descriptor fixture deliberately retains a raw callback to deliver late responses. Its release-call observation does not establish that the callback became unreachable. The installed-SDK owner remains the receiving witness for actual SDK release. Native execution, every SDK version, arbitrary overlapping rotations, real SQLite peer claims, and the separate core receipt/isolation limits remain unproved.

The two shared mock streams now create separate callback ownership per instance. Prototype inheritance keeps request and resume controls live. Full release is idempotent and handles synchronous release during subscription. Scheduler restoration reinstates the same wrapper. The descriptor fixture rejects pending snapshots on abort, matching the SDK responsibility boundary, instead of making callback release cancel HTTP work. Its late-delivery control is named ignoreAbort to match that premise.

An independent reviewer checked the production reduction and fixture changes. It identified the synchronous wrapper gap above. After its repair, the reviewer accepted the instance ownership, live controls, scheduler restoration, signal-owned cancellation and explicit raw-callback limit. No further supported finding remained within that scope. The optional queue inlining was then reverted to the original source. This is a bounded review of the reduction, not a new whole-PR readiness verdict.

ORC-001/002/003 retain the accepted law, independent model and nearby explanations. ORC-004/007/008/009 retain the existing grammar, paired campaigns, model state and vocabulary. ORC-005/006/013 add the two bounded fixture cuts and the wrong-wrapper assertion failure. ORC-010 retains cleanup and failure handling. ORC-011 has no new shared semantic-fault hypothesis. ORC-014 keeps the mock release premise separate from the unchanged installed-SDK receiving witness. ORC-015 retains existing declared product reach, with no expanded coverage claim. ORC-012 is this source-bound append-only record.

Final source identities (Git blobs):

Raw local evidence is retained under /tmp/pr2257-ci-loop/:

Reproduce the bounded calibration with:

pnpm --dir packages/electric-db-collection exec vitest run tests/electric-oracle.property.test.ts --coverage.enabled=false -t 'retires its mock callback'
pnpm size:compare --packages electric-db-collection --no-scenarios --rebuild

Integration with current main#

GitHub reported a conflict after main advanced to 6c1ca8f8f9efe437d3cea61b5b9d0a086e2a5e34, so CI could not start. The normal merge preserves published history. The only conflict was an import reorder in the core replay owner: retain main's order and the PR's CollectionSubscription import. The core model, grammar and comparisons are unchanged by that resolution.

Main also introduces ORC-016, which keeps ordinary unit tests outside oracle files. The new two-case mock calibration now lives in electric.test.ts. Both consumers import the same small electric-stream-mock.ts fixture, so the calibration checks the exact wrapper used by the oracle driver. This extraction removes duplicate mechanics without introducing a model or new expectations. The missing-stopped-flag control was rerun on the shared helper: the synchronous case fails at callback release (zero instead of one); its after-return neighbor passes. Restoring the helper passes both. This is fixture calibration, not a new product-law or broader oracle-conformance claim.

With main integrated, the complete Electric package again passes 1,136 tests and typechecking, with one skipped test. The complete core replay owner passes 31 tests, including both 300-history campaigns and both 40-pair boundary campaigns. Package ESLint, formatting, changed-file lint and whitespace checks pass after the two new helper imports follow the repository order. No further production edit is included. The size comparison remains +1 gzip/-5 brotli; main did not change the Electric production source.

The earlier reduction review applies to unchanged production. Its shared fixture extraction is a mechanical follow-up, verified by the same wrong-wrapper control and full package run. All native/SDK/SQLite and core receipt/isolation limits above remain. ORC-016 applies to the relocated calibration; this entry does not claim a new audit of every inherited test in the repository.

Runtime logs merged-electric-green.log, merged-core-green.log, merged-fixture-red.log, and merged-size.log remain in the same scratch directory as the preceding evidence. The body update passes the STE structural linter and paragraph-formatting check. The GitHub rendered body has no unintended br elements in ordinary paragraphs or list items.

Integration with deferred-demand main#

This append records the normal merge of main 1640de834bca0588f91432ea80a0f4569157e9dc into PR parent f4a1fdbed014192cdbbf4029e18710f6fad0131d. The source identities below bind this evidence to the resolved files. Earlier entries remain unchanged.

• Law: preserve both accepted error-ownership judgments in the replay owner. The opening contract and main's retained-demand contract distinguish ordinary failed demand from renewal of an established demand. Initiating keyed-request results and the independent subscription-token/key-set model each constrain terminal errors after every history command and at final convergence. Neither classification can excuse a result rejected by the other.
• Reach: retain all three properties, their fixed/random budgets, named histories and guarded direct selectors. The broad property runs 300 histories per campaign. Demand-origin runs 75. Keyed-request failure runs 40 pairs, giving 40 initiating failures and 40 reacquisition failures per campaign. The broad campaign's seventeen declared dimensions all reached their minimum.
• RED: no new production defect is claimed. The fresh merge review found row-local expected answers in two incoming named histories. Both now call the same independent comparison as generated histories, under ORC-016. A direct broad replay also exposed an empty unrelated suite after campaign selection. That process exited 1 even though its intended comparison passed. Campaign registrations now remain at file scope. No test-disabling condition is needed, and the identical guarded replay exits 0.
• GREEN: the resolved core owner passes 35 tests and typechecking. The complete Electric package passes 1,136 tests and typechecking, with one skipped test. A broader core run passed 865 tests but one wrapper child process exceeded its 30-second limit. Its focused single-worker rerun passed. This timeout is not presented as a clean complete broad run. ESLint, formatting, changed-file lint and whitespace checks pass.
• Mutant: temporarily making every subset failure terminal fails the keyed-request guarded replay at the intended history: terminal error comparison. Restoring production passes the identical replay. The temporary edit was restored byte-for-byte. Core production matches main.
• Limits: preserve all controlled-provider, predicate, receipt-correctness, per-receiver isolation, native application, SDK-version, overlapping-rotation and SQLite limits recorded above and in the coverage map. This merge adds no new product law or real-host coverage claim.

The fresh merge reviewer accepted the shared-comparison repair and found no remaining supported item. The loss audit records two items, both fixed: source conformance and suite registration. Neither requires a product decision. The merge retains incoming main production unchanged and adds no further Electric production change.

Measured reach from the merged campaigns:

Each cell counts histories, not repeated events. Direct replay commands run from packages/db through node --import tsx tests/oracle-replay.ts against tests/query/load-subset-replay-refinement-oracle.test.ts, with --coverage.enabled=false --maxWorkers=1:

Set TANSTACK_DB_ORACLE_PROPERTY, TANSTACK_DB_ORACLE_SEED and TANSTACK_DB_ORACLE_PATH to the corresponding row. The keyed replay also supplies the terminal-error calibration above.

ORC-001 through ORC-005 retain contract authority, independent judgments, literate explanations, both grammars and public checkpoints. ORC-006 and ORC-013 use the terminal-error calibration. ORC-007 retains paired campaigns and checks all three direct replays. ORC-008 and ORC-009 add no new model state or terminology. ORC-010 retains cleanup and primary-failure handling. ORC-011 keeps the two distinct failure judgments without a new shared-fault hypothesis. ORC-012 is this source-bound record. ORC-014 adds no receiving-path claim. ORC-015 preserves measured declared reach. ORC-016 now shares the named and generated demand-origin comparison without row-local expected answers.

Against the exact integrated main, production source remains three lines and 149 bytes smaller. The Electric package bundle changes by -5 bytes Brotli and +1 byte gzip. The per-package table supplies these values, rather than the size tool's aggregate summary. The local dependency-install workaround stays uncommitted.

Raw command logs and the two-item merge ledger remain under /tmp/pr2257-merge-final/. Relevant logs include core-shared-green.log, core-final-owner-green.log, core-final.log, wrapper-focused-green.log, electric-final.log, replay-original-final-green.log, replay-origin-green.log, replay-keyed-green.log, keyed-reach-green.log, terminal-control-red.log, terminal-control-restored-green.log, eslint-final.log, lint-changed.log and size.log.