# Content temporarily unavailable # PR #2257 oracle review — 2026-10-26 Reviewed PR: https://github.com/TanStack/db/pull/2257 Reviewed head: `b585f92f20de9cd89a6783ac67784d4bdf9b7a18`. Four independent reviewers used the repository's oracle-review skill to examine contract authority, generated histories, listener recording, and deliberately incorrect cleanup variants. Oracle-authoring was read before experimental test changes. Production and oracle source in the shared review checkout remain unchanged. ## Findings ### P2: Generate cleanup during partial delivery and reset Location: `packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts:2415-2417`, with the response driver at 2337-2359. Every successful generated response includes both a row and `up-to-date`. Consequently `cleanup-while-loading` means no delivered rows or only retries; it never includes a transaction opened by a partial row batch, or an active reset awaiting replacement data. The law promises listener release whatever state the source reached. These are legal ordinary stream histories: `electric-sdk-framing.test.ts:29-35` already demonstrates row-only responses and HTTP 409 `must-refetch` delivery through the real SDK. Two single-condition changes to the production cleanup pass the existing fixed/random listener campaigns and managed-cache rotation case: ```ts if (!transactionStarted) stream.unsubscribeAll() // Separately: if (!isResettingSnapshot) stream.unsubscribeAll() ``` The first also passes all 42 existing SDK delivery tests. A row-only response, next actual HTTP request, then cleanup distinguishes the first change: the PR leaves zero listeners; the incorrect variant leaves one. An initial HTTP 409 `must-refetch`, next actual request, then cleanup distinguishes both changes in eager, on-demand, and progressive modes. The Collection remains `loading` before cleanup, and the final listener comparison is the failing assertion. Repair the primary history grammar with row-only and reset answers separate from `up-to-date`. Permit cleanup before that later marker and declare reach for partial-delivery and reset cleanup. Include nearby retry, give-up, abort, and restart histories when claiming coverage of the full stated class. Keep the independent active-run model; do not copy production transaction/reset flags into it. This finding concerns oracle coverage. The PR's unconditional production release passes these cases. ### P2: Release retained listeners after a failing test Location: `packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts:331-334` and 2396-2401. The recorder's `restore()` restores method spies but leaves any remaining DOM listener registered. With the original missing release, Collection cleanup already completed; repeating that idempotent cleanup cannot remove the listener. Thus each failing or shrinking run leaves the dead SDK stream reachable from the shared document. ORC-010 requires test resources to be released on failure too. A direct real-SDK/jsdom diagnostic recorded one actual listener after the original cleanup, one after exact recorder restoration, and zero after explicit SDK release. This is a diagnostic plus source tracing of the test's cleanup path, not a complete generated-campaign teardown experiment. Preserve the primary assertion, then remove remaining registrations owned by the recorder during final teardown, or retain stream handles for independent test cleanup. Add a deliberate failure case showing both the original mismatch and final resource release. Do not remove listeners before comparing. ### Review-evidence gap: preserve the final evidence with the reviewed revision The PR adds a new property but no versioned exact-head review record. Its reported RED/GREEN results, reach counts, and rejected incorrect variants live in the editable PR description. ORC-012 requires verdict-critical external evidence in a versioned record, including applicable requirement outcomes and reasons for non-applicable ones. This does not imply the reported runs did not occur. This local review record is tied to the reviewed head; it has not been committed or published by this review. ## Contract and scope `CleanupFn` in `packages/db/src/types.ts:420-429` and “Sync Implementation” in `docs/guides/collection-options-creator.md:70-78` authorize release of resources owned by a completed sync run. After completed cleanup, no run-owned visibility listener may remain. Counting active runs independently of the adapter is sufficient for that upper bound. Allowing zero listeners before cleanup keeps valid freedom for a client that releases earlier, such as on abort. No unsupported production defect or contract revision was established. The production path is a real Collection, the Electric adapter, installed `@electric-sql/client` 1.5.15, controlled HTTP, and jsdom document registrations. Experiments used archived copies of the reviewed head and read-only dependency artifacts. Explicit Vite resolution confirms core and db-ivm source came from the reviewed archive, not the dirty primary checkout. Scratch source changes were restored. Coverage instrumentation and TypeScript checking were disabled for runtime experiments; nonfatal unrelated Expo tsconfig diagnostics appeared. No setup failure or timeout was counted as an assertion rejection. ## Executed evidence | Case | Reviewed production | Incorrect cleanup variant | | --- | --- | --- | | New fixed/random listener campaigns + rotation | 3 pass | Both variants: 3 pass | | Full existing SDK delivery file | 42 pass | Transaction-condition variant: 42 pass | | Row-only response then cleanup | 1 pass | Transaction-condition variant: listener assertion fails, 1 versus 0 | | HTTP 409 reset then cleanup, three modes | 3 pass | Both variants: 3 listener assertion failures, 1 versus 0 | | Actual listener after recorder restoration | Fixed cleanup releases it | Original missing release: 1 remains; independent SDK teardown removes it | Evidence is retained in `review-evidence/pr2257-oracle-review/`. The partial case patch appends to the reviewed oracle; the reset case text likewise uses its existing helpers. Exact incorrect variants are the two lines above. From the experimental snapshot's `packages/electric-db-collection` directory, reviewers used the installed Vitest entry point directly: ```sh node /Users/kyle.mathews/programs/tanstack-db/node_modules/vitest/vitest.mjs run tests/electric-sdk-delivery-oracle.property.test.ts --coverage.enabled=false --typecheck.enabled=false ``` Selectors restricted individual runs to the listener campaigns, rotation, or appended review cases. Raw logs distinguish each execution and comparison. ## Original failure and direct replay Removing only `stream.unsubscribeAll()` reproduces the original defect in both listener campaigns: `run 0 cleanup: live listeners`, expected at most zero, received one. The fixed campaign reduces to one eager run with no answers and an open ending. Seed `20261024`, path `0:0:0:0`, and property `electric.sdk-source-release` select exactly one replay test and reproduce the same cleanup assertion. Restoring the reviewed production makes that identical replay pass. Both scratch source files were restored to reviewed bytes. ```sh TANSTACK_DB_ORACLE_SEED=20261024 TANSTACK_DB_ORACLE_PATH=0:0:0:0 TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-source-release node /Users/kyle.mathews/programs/tanstack-db/node_modules/vitest/vitest.mjs run tests/electric-sdk-delivery-oracle.property.test.ts -t replay --coverage.enabled=false --typecheck.enabled=false ``` Final review-checkout runtime validation: all 42 SDK delivery tests pass with the installed local dependency override. `pnpm lint:changed` also passes. Production and oracle source remain unchanged; only local installation files and this review's report/evidence differ from the reviewed head. ## ORC outcomes | Requirement | Outcome at reviewed head | | --- | --- | | 001 authority/limits | Supported by public cleanup sources; browser/native limits explicit. | | 002 independent judgment | Active-run count reads no production classifier. | | 003 literate responsibilities | Law, model, grammar, driver and comparison are explained together. | | 004 grammar controls | Gap: row-only and reset cleanup require missing history rules. Other declared bounds/exclusions are stated. Full ablation evidence remains unverified. | | 005 path/observation | Real SDK and cleanup listener comparison executed. No concrete missing-input hypothesis identified. | | 006 calibration | Incorrect conditional variants survive existing checks and fail added cleanup comparisons; original missing-release replay recorded separately. | | 007 campaigns/replay | Both existing fixed/random campaigns executed; direct original-failure replay recorded separately. | | 008 minimality | Active versus cleaned-up run suffices for this resource law; source bookkeeping governs driver legality/reach. | | 009 vocabulary | Sync runs/provider sessions distinguished; active-run abstraction explained. | | 010 failure/cleanup | Primary mismatch preserved; retained DOM resource on failing teardown is a gap. | | 011 second formulation | Not triggered: no supported shared semantic-model fault requiring another expected-result formulation. | | 012 review evidence | PR lacks a versioned exact-head record; known reachable distinctions prevent a full coverage claim. | | 013 distinguishing boundaries | Existing cleanup boundary works; partial-delivery/reset premises absent from generated histories. Added cases distinguish the incorrect conditions. | | 014 receiving witness | Real installed SDK supplies listener/reset behavior; controlled HTTP supplies authored responses. No live-service or native result claimed. | | 015 declared reach | Existing counters execute; loading reach does not establish partial-delivery/reset cleanup. Add those premises and report their counts. | ## Remaining limits and setup No live Electric service or React Native AppState run was executed. General EventTarget callback-reuse/capture semantics are not established by this recorder, but the pinned SDK uses one fresh default-capture callback per stream, so those theoretical recorder limitations are not additional findings. Fixed managed-cache rotation is a valid receiving case; lack of arbitrary rotation generation alone was not reported as a defect. The review worktree is detached at the exact PR head. No remote branch was published. Dependency installation used `--ignore-scripts` and a local-only pnpm override for `baseline-browser-mapping` from 2.11.32 to 2.11.29: 2.11.31 also returned 403, and 2.11.30 was absent from registry metadata. The override and resulting lockfile changes must remain uncommitted. Global `/Users/kyle.mathews/.codex/AGENTS.md` now records that recovery rule. ## Repair and review evaluation — 2026-10-26 This entry evaluates the four raw reviews and records the authorized repairs. The preceding entry describes the initial head, not the state after this entry. Starting head: `b585f92f20de9cd89a6783ac67784d4bdf9b7a18`. The tested oracle source SHA-256 is `4c997a507c116710a171c6703338b5b3964ff19f35b98ceac8124e9085486dad`. The commit containing this entry identifies the corresponding repair tree; production source is unchanged from the starting head. Raw reviewer notes, full logs, and the append-only working ledger remain task-local rather than being published as part of the change. ### Laws, experiments, and inference | Law and authority | Previous evidence | Decisive experiment | Repair and remaining enforcement | | --- | --- | --- | --- | | Completed sync-run cleanup releases its resources (`CleanupFn`, creator guide). | Complete row batches, retries, terminal outcomes and restarts; incomplete rows/reset absent. | Two conditional-release variants passed the old checks but fail expanded generated cleanup comparisons, each leaving one listener instead of zero. | Generate independent row-only/reset answers; preserve pending authored answers across retries and terminal outcomes; clear them after up-to-date/reset/restart. Same active-run model and public cleanup comparison. No known open distinction in these bounded histories. | | Test teardown releases owned registrations and preserves its primary failure (ORC-010). | Method spies restored; physical DOM registrations untested after a failure. | Before repair, retained callback fires after teardown. After repair, all eight subsets of three callbacks are removed and the identical primary Error survives. | Recorder finally removes captured registrations after comparison, then restores spies. An independent EventTarget-dispatch comparison checks actual release. No known open distinction for the fresh default-capture callbacks used by the installed SDK. | | External review evidence remains tied to its reviewed revision (ORC-012). | Evidence only in editable PR prose. | Source inspection of the starting PR; exact-head initial report and tested-source digest recorded here. | This versioned record preserves findings, calibration, reach, limits, and requirement outcomes. This documentary obligation does not need an artificial runtime assertion. | The oracle grammar now accepts zero to three answers per run, from `row`, `up-to-date`, `reset`, and `retry`; one to three runs; all three sync modes; and open, give-up, or abort endings. The same driver also runs 18 minimal histories: two incomplete answers × three endings × three modes. These remain replay examples alongside generated nearby histories, rather than replacing generation. Readiness reach reads public Collection status; pending-answer reach derives only from provider inputs, without inspecting production transaction/reset flags. Grammar controls: removing row-only or reset loses the demonstrated cases; removing up-to-date loses completed-delivery comparisons; removing retry loses incomplete delivery across retried failure; removing terminal endings loses give-up/abort cleanup; removing modes loses their installed-SDK paths; removing multiple runs loses cleanup/restart and already-aborted restart. Zero answers covers immediate cleanup, three answers can cross reset, row and completion, and three runs cover repeated release. Requests are answered only when the real SDK sent them: after give-up or external abort, no later response is invented. This is a bounded grammar, not a proof for arbitrary history length. ### Lossless item ledger Raw claims and their original proposed repairs were copied into the working ledger before new tests or edits. Source-order IDs remain distinct even where multiple reviewers identified the same gap. | ID | Source claim | Evidence and technical verdict | PR action | Durable value / destination | | --- | --- | --- | --- | --- | | L01 | Cleanup authority and active-run upper bound are sound. | Public cleanup sources; early release remains allowed. | accepted-design | Preserve model and contract prose. | | L02 | Partial delivery is missing; generate it before cleanup. | Conditional transaction release passed old full file, fails new campaigns. | fixed-now | Expanded grammar, new reach, minimal replay histories. | | L03 | Failing/shrinking runs retain listeners; add independent final release. | Direct SDK diagnostic and old-recorder RED; bounded dispatch calibration GREEN. | fixed-now | Recorder teardown and primary-error calibration. | | L04 | Exact-head versioned external evidence is absent. | Starting diff had no review record. | fixed-now | Initial-head record plus this repair entry. | | H01 | Row-only cleanup needs a grammar rule; one example is insufficient. | Same-path real SDK witness; old 42-test survival retained as initial evidence. | duplicate of L02 | Independent source-resolution evidence and generated repair. | | H02 | Already-aborted restart sends no requests; dead suffixes are intentionally ignored. | SDK request admission and driver conditions. | accepted-design | Preserve signal continuity and legal-history exclusion. | | H03 | Fixed rotation is a distinct valid receiving case; arbitrary rotation absence alone is not a defect. | Existing replacement-session and final-zero checks remain. | accepted-design | Keep managed-cache rotation receiver and its stated limits. | | H04 | Loading reach is too coarse; partial delivery needs declared reach and adjacent endings. | New partial/reset counters and generated retry/ending/restart combinations. | duplicate of L02 | Explicit partial/reset cleanup reach. | | H05 | Original missing release and direct replay need calibration. | Expanded original-release RED and identical restored-source replay GREEN. | accepted-design | Replayed seed/path coordinates below. | | R01 | Restoring spies leaves the actual original-defect listener alive. | Same diagnostic as L03; independent final cleanup now checked. | duplicate of L03 | Preserve physical-resource observation. | | R02 | Recorder count ignores general callback reuse/capture ordering, but pinned SDK never reuses registrations that way. | SDK uses one fresh default-capture callback per stream. | accepted-design | Explicit narrow recorder domain; no general EventTarget counting claim. | | R03 | Counts alone do not identify old versus current callbacks, but no in-domain surviving incorrect replacement was demonstrated. | Rotation and final zero remain observable; no new product-defect claim inferred. | accepted-design | Retain identity limitation without inventing a finding. | | R04 | Requiring exactly one active listener would add unsupported timing policy. | Model law is an upper bound and exact zero after cleanup. | duplicate of L01 | Keep legitimate early release. | | R05 | Warning suppression might erase secondary cleanup diagnostics. | Helper restores console spy before reporting failures. | refuted | Keep exhaustive helper and distinguish primary/secondary diagnostics. | | R06 | Shrink filtering might erase the original failure. | Original checkpoint is retained; direct replay reproduces it. | refuted | Preserve failure identity and replay evidence. | | M01 | Reset cleanup is also absent; generate reset separately in all modes. | Both conditional variants fail expanded campaigns; minimal reset cases cross every mode/ending. | duplicate of L02 | Distinct reset action and cleanup reach. | | M02 | Active visibility behavior and request cancellation are neighboring obligations. | Release oracle explicitly judges resource ownership; surrounding Electric tests pass. | accepted-design | Keep partial-oracle scope and surrounding suite. | | M03 | Browser/controlled-HTTP evidence does not establish native or live-service behavior. | Actual installed SDK path, explicit original limits. | accepted-design | Preserve external limits in oracle and coverage map. | | S01 | During repair, source snapshot progress could be confused with public readiness in reach labels. | Independent rereview identified the distinction after reset. | fixed-now | Removed driver readiness flag; classify from public Collection status. | Original items: **18 = 3 fixed-now + 5 duplicates + 8 accepted-design + 2 refuted**. One additional repair-time item, S01, is fixed-now. No item is deferred, awaiting a product decision, or confirmed-open. The final loss audit returned to the four raw reports, including their non-finding hypotheses and scope notes; all are represented above. The working ledger remains local. ### Reviewer assessment - Law/authority reviewer: hire. Correct public authority and useful separation of product correctness, coverage and documentary evidence; appropriately limited source-only conclusions. - History reviewer: strong hire. Demonstrated full-file acceptance of a wrong conditional release, supplied a minimal legal case, and verified reviewed source resolution rather than assuming dependency reuse was safe. - Recorder reviewer: hire. Found a real failure-path resource issue, calibrated physical registrations, and did not promote out-of-domain counting concerns into unsupported findings. - Independent variant reviewer: strong hire. Supplied the distinct reset case across all modes and a second incorrect condition. Correctly distinguished a coverage defect from a production defect. Prioritization and proposed repairs were sound. The initial direct SDK teardown diagnostic was narrower than a full generated failure-path test; the new bounded calibration supplies executable regression evidence. Independent rereviews found no substantive issue with the grammar or teardown repair; the readiness wording caveat was resolved by S01. ### RED, GREEN, and replay evidence Unchanged PR production passes the expanded resource-release campaigns. Before recorder repair, the new teardown calibration fails because a retained callback is called once after cleanup; the identical test passes after repair. Thus no product defect is attributed to this test-only update. Each incorrect production variant is run separately in an archived checkout with the updated oracle. Both fixed/random campaigns reject each at the post-cleanup listener assertion, not setup, timeout, or unrelated errors: | Variant | Fixed seed | Shrink path | Reduced case | | --- | --- | --- | --- | | Omit `stream.unsubscribeAll()` | 20261024 | `0:0:0:0` | One eager run, no answers, open ending. | | Release only if `!transactionStarted` | 20261024 | `5:0:1:1:1:1` | One eager run, row-only answer, open ending. | | Release only if `!isResettingSnapshot` | 20261024 | `5:0:1:2:2` | One eager run, reset answer, open ending. | Each captured path was replayed directly with `TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-source-release`, the listed seed/path, and `-t replay`; each incorrect source fails the same cleanup assertion and unchanged PR production passes the identical replay. Experimental source is restored after execution. Reach counts are histories, not sync-run totals. A scratch copy logged the existing reach counters without changing generation, comparison or the 40-history campaign budget: | Declared state | Fixed seed 20261024 | Unseeded campaign | | --- | --- | --- | | cleanup-while-loading | 10 | 10 | | cleanup-after-ready | 8 | 5 | | cleanup-after-give-up | 16 | 16 | | cleanup-after-abort | 19 | 19 | | cleanup-of-restarted-run | 27 | 25 | | cleanup-after-partial-delivery | 4 | 15 | | cleanup-during-reset | 10 | 12 | Commands from the repository root: ```sh pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false pnpm exec eslint packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts pnpm lint:changed pnpm --filter @tanstack/electric-db-collection... build ``` The Electric package run passes 1,130 runtime tests (one skipped), with no type errors. The changed-file ESLint and oracle-rule checks pass. Builds pass after linking required cached workspace dependencies. Initial missing dependency and build-output errors were setup failures, not successful checks. Production source has no diff, so shipped production-byte weight is unchanged; only tests and contract/evidence documentation grow. No new changeset is needed for this test-only follow-up to the PR's existing release changeset. ### Final requirement outcomes and limits ORC-001/002/003: authority, independent active-run judgment, and literate layers preserved. ORC-004: row/reset reconstruction plus ablation/range/exclusion accounted for above. ORC-005: real SDK, actual HTTP request fences, listener comparisons after every answer/terminal step/completed cleanup; no concrete missing-input hypothesis. ORC-006/007: original and two conditional variants rejected by fixed/random campaigns; direct failing and passing replays checked. ORC-008/009: model unchanged; authored pending answers are explicitly driver reach bookkeeping and public readiness is read directly. ORC-010: primary failure preserved and actual registrations released by the calibrated finally path. ORC-011 is not triggered: no supported shared semantic-model fault needs a second expected-result formulation. ORC-012: this versioned exact-base and source-digest record closes the documentary gap. ORC-013: row/reset premises and nearby completed/terminal histories distinguish the incorrect conditions. ORC-014: installed SDK supplies stream/reset/listener behavior; controlled HTTP supplies responses. ORC-015: seven declared reaches are checked per campaign, including the two previously missing premises. The claims remain bounded to these generated legal histories, three sync modes, the installed SDK, controlled HTTP, browser document in jsdom, and existing managed-cache rotation receiver. There is no live-service or React Native AppState execution claim. There is no known reachable counterexample inside this bounded repair claim; sampled campaigns are not a universal proof. Whole-PR merge readiness is **not assessed** by this review evaluation; remote CI and later PR changes remain separate from the local checks above. ## Second review: enforcement repairs — 2026-10-26 Starting head: `1a5ca0edeacf0600f6f6a0d04df32ea90b7a4bea`. Tested oracle SHA-256: `5917bd5b125d71d952804aca26e513db99c75e7d46a8efb458cb91a2d563b543`. The commit containing this entry identifies the repair tree. Production is unchanged from the starting head. Four fresh reviewers independently examined authority, histories, recorder behavior, and receiving paths. Raw reports and the append-only evaluation ledger remain task-local; this entry preserves the verdict-critical evidence. ### Law, experiment, inference, enforcement Completed cleanup already releases all resources owned by the ended sync run (`CleanupFn`, `packages/db/src/types.ts:419-429`; creator guide, Sync Implementation). This deadline includes supported asynchronous error decisions that have not settled. It does not require disposal on external abort alone, zero listeners synchronously at cleanup entry, or any minimum listener count while active. The active upper bound and one-add-per-start control are now explicitly identified as installed-provider/driver premises. | Item | Evidence before repair | Repair and resulting evidence | | --- | --- | --- | | R01: removal attempts mistaken for actual listener release | An SDK 1.5.15 variant removes with capture=true after registering capture=false. The previous release campaigns pass, but actual EventTarget dispatch invokes the retained handler. Five of seven focused identity/order traces disagree with the old recorder. | Recorder replays add/remove calls in global invocation order, keyed by callback and normalized capture; duplicate adds coalesce. Native dispatch before fixture teardown independently calibrates every length 0..3 history over two callbacks, add/remove, and five capture spellings: 8,421 histories. The original SDK variant now fails the cleanup comparison. | | H01: pending async error decision absent from release histories | A conditional release that skips `unsubscribeAll()` only while a user decision remains pending passes all 46 original runtime tests. A held-decision probe rejects it after cleanup, while current production passes all 6 mode/future-outcome cells. | Generate held retry/give-up endings, observe entry into real installed-SDK `onError`, keep each promise unresolved through cleanup and later runs, and resolve only in teardown. Declare pending-decision cleanup reach. Both campaigns reject the conditional design; direct replays fail it and pass unchanged production. | The expanded grammar retains row-only, up-to-date, reset, and retried-error prefixes; all three modes; one to three runs; and the previous open, give-up, and abort endings. Its fixed partial/reset examples now cross all five endings, 30 histories. Expected resource ownership remains the independent active run count. No production branch or internal retry/reset classifier computes that result. ### RED, GREEN, reach, and replay Recorder calibration was added before repairing its observer. On the old recorder it fails a legal remove/remove/add history: recorded 0, actual dispatch 1. The identical calibration passes after repair, including capture mismatch, remove-before-add, re-add, duplicate-add, callback identity, dual capture, and equivalent capture spellings. Existing final-release/primary-error calibration still passes. Comparison remains before recorder.restore. Unchanged PR production passes the expanded fixed/random property. Each campaign uses the same generator, observer, comparison and 40-history budget. A private copy printed existing reach counters without changing semantics: | Declared reach | Fixed 20261024 | Random | | --- | ---: | ---: | | cleanup-while-loading | 21 | 22 | | cleanup-after-ready | 13 | 10 | | cleanup-after-give-up | 13 | 15 | | cleanup-after-abort | 14 | 11 | | cleanup-of-restarted-run | 27 | 24 | | cleanup-after-partial-delivery | 6 | 17 | | cleanup-during-reset | 11 | 17 | | cleanup-during-retry-decision | 18 | 21 | Two supplementary 40-history random campaigns pass all reaches, with pending reach 28 and 23. They supplement the normal pair and do not replace it. All four incorrect release designs fail both expanded campaigns at the intended post-cleanup listener assertion (actual 1, allowed 0), not setup or a timeout: | Incorrect release design | Fixed seed/path | Random seed/path | | --- | --- | --- | | Release only after user error decision settles | `20261024 / 1:1:2` | `-93353169 / 3:0:2:2:3` | | Omit whole-stream release | `20261024 / 0:0:0:0` | `1599666023 / 0:0:0` | | Release only without a pending source transaction | `20261024 / 5:0:1:1:1:1` | `-795275110 / 1:0:0:1:0:1:1` | | Release only outside source reset | `20261024 / 5:0:1:2:2` | `-1735334928 / 0:0:1:4:3` | Three captured pending-decision replays, including the latest random path above and `778119691 / 2:0:0`, fail the incorrect design and pass unchanged production. Each selects exactly one replay test. The latest random witness fails cleanup of a restarted run. The wrong-capture SDK variant also fails with the final oracle at seed 20261024/path 0; the unmodified SDK passes that same replay. Experimental production and SDK changes remain isolated from the branch. Commands from repository root: ```sh pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false pnpm lint:changed pnpm exec prettier --check packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts docs/contributing/oracle-coverage.md docs/contributing/oracle-reviews/2026-10-26-pr-2257.md ``` Package result: 1,131 runtime tests pass, one skipped, no type errors. Changed-file lint and formatting pass. The new bounded calibration is one additional test; production bytes and behavior are unchanged. No changeset is needed for this test-only follow-up. ### Authority clarification and remaining decision The completed-run cleanup law above already has authority. Partial rows, reset, and pending error decisions introduce no new exception or product rule. The one-listener active bound and exact construction count are pinned SDK premises, not universal API requirements. Same-run cache rotation is a separate timing question. The public restart hook requires immediate old-callback retirement and replacement after cache rotation (`types.ts:435-443`; SQLite guide, managed generations). It does not explicitly state that every old host resource must be released before replacement. Current Electric source already awaits session cleanup before replacement, while the existing rotation assertion runs later, after replacement demands settle and a late old response. That assertion does not establish the earlier deadline. Candidate contract: release all retired provider-session resources before starting its replacement. Rival: permit inert resources until enclosing-run cleanup, while fencing old rows/acknowledgements. The recommendation is the candidate, to prevent accumulation over repeated rotations. A user decision was requested; no new deadline or earlier expectation was silently adopted. The two independent enforcement repairs above do not depend on that decision. ### Review evaluation, requirement outcomes, and limits The 41 source-order items remain accounted for: 27 accepted-design, 2 fixed-now (R01/H01), 2 already-fixed, 8 duplicates, 1 refuted, 1 design-decision; none deferred. Each retains its original claim, evidence and durable destination in the local ledger. The previous review-only stopping interpretation was superseded after re-reading evaluate-review's explicit authorization to repair enforcement gaps. All four reviewers merit hire for their bounded tasks: concrete observer and history counterexamples, careful authority distinctions, and receiving-path checks with honest environment limits. A separate source rereview of the final repair found no further supported issue; runtime results above supply its remaining execution evidence. ORC-001/002/003: existing resource authority and independent active-run result preserved, with provider calibration distinguished. ORC-004: new pending endings reconstruct the reported trace and partial/reset/restart neighbors; removing that ending loses the demonstrated distinction. Recorder enumeration spans all stated operation/callback/capture sequences; removing an axis loses the named identity/normalization witness, and length 3 reaches re-add. ORC-005: real installed SDK receives 503 and enters onError before cleanup; native dispatch checks actual listener ownership before teardown. No missing source-information hypothesis is needed to release known owned resources. ORC-006/007: old-observer RED, final GREEN, incorrect-design assertions and direct fixed/random replays recorded above. ORC-008/009: semantic model unchanged; held decisions are authored driver promises, not copied adapter state. ORC-010: primary failure, secondary diagnostics and independent final fixture release remain intact. ORC-011: native dispatch supplies a different ownership formulation for the named shared capture/order fault. ORC-012/013: exact-source record, distinguishing pending/capture witnesses, and remaining rotation decision recorded here. ORC-014: installed SDK supplies error-decision and listener behavior; HTTP and jsdom supply explicitly controlled premises. ORC-015: all 8 declared states reached in each normal campaign; pending-decision reach is based on actual callback entry, not merely an authored ending token. Bounded recorder enumeration is not an important generated property and asserts its exact 8,421-history count. Claims remain bounded to installed SDK 1.5.15, controlled HTTP, browser document in jsdom, the stated captures and passive callbacks, and these finite histories. Once/signal automatic removal, mutable/exotic option objects, arbitrary callback mutation during dispatch, actual native hosts, every accepted SDK version, arbitrary streaming/acceptance schedules, and post-decision effects after fixture teardown are not established. Separate two-Collection and exact SDK 1.5.23-source controlled AppState probes pass current production and reject the base missing-release path, but do not claim checked-in generated peer isolation or actual iOS/Android execution. No current production defect was found in these paths. Whole-PR readiness is not assessed by this evaluation. ## Approved rotation deadline and final rereview — 2026-10-26 Parent commit: `c73f47984c54c8625f9614f698a7b98b1d354e20`. Final SDK-delivery owner SHA256: `f046cb9cbdf26a8ffc8c746bf762f00d949faf054bc6cbe7e4e5545fd7d11b1f`. Unchanged Electric production SHA256: `4919ad548c416952fe51822b9e1d06c20dd5807b6dda40909bc3ed7046b66015`. These source identities cover the executable change accompanying this entry. ### Law decision and current production The user explicitly selected “Yes — require release before replacement.” A03 is now implemented in the Electric guide: release the retired provider session's adapter-owned resources before constructing its replacement `ShapeStream`. Callback retirement remains immediate; replacement follows cache-rotation completion. An HTTP request that ignores cancellation may finish later without gaining authority over replacement rows or waits. This is the new explicit deadline that the earlier contract left ambiguous. Current Electric already satisfies it; no production edit was needed. The shared restart hook is unchanged: Query recovery reuses observers and shared resources rather than constructing a replacement provider session. | Law | Authority and relation to production | | --- | --- | | Completed sync cleanup releases owned resources, including during partial delivery, reset, and a pending error decision. | Existing `CleanupFn` and creator guide. Base production violated this; the PR's unconditional stream release satisfies the measured paths. R01/H01 strengthen observation and reach, without changing this law. | | Retired Electric session resources are released before replacement construction. | Newly approved A03 deadline, now in the Electric guide. Current production already awaits private cleanup before constructing a replacement. The earlier settled-rotation comparison did not prove this ordering. | | Each retained subset demand completes after its replacement snapshot applies. | Existing Electric scoped-recovery guide and `LoadSubsetFn`. Current production passes; final rows alone had allowed a plausible early-settlement implementation. | ### Experiments and repairs The existing real-SDK rotation driver now generates one to three sequential rotations in the same Collection sync run. A retired snapshot arrives during held rotation, before replacement snapshots, or after replacement settlement. Fresh IDs and demand unloads preserve an actual pending old snapshot in every round. A forwarding Proxy records document-listener ownership immediately before invoking the real installed SDK constructor. It neither disposes resources nor substitutes SDK behavior. The model requires zero old listeners at that boundary, one replacement listener after delivery, and zero after completed Collection cleanup. The following experiments distinguish that deadline and preserve its freedom: - Disposal immediately after replacement construction fails the new comparison: expected zero, actual one. Removing only that comparison lets both 40-history campaigns pass, including all later row, demand, and listener comparisons. - Disposal after cache rotation fulfills but immediately before construction passes both campaigns. A diagnostic replay observes one listener while rotation is held and zero before construction. The oracle therefore does not require synchronous disposal at rotation entry. - Disposal only for the initial session fails when a generated second rotation retires its replacement. A one-rotation example alone would miss this rule. - Exact final-owner replay pairs use property `electric.sdk-rotation-release`, seed `20261026`, and paths `0:0:0` and `0:1:1`, respectively. The two incorrect variants fail at the constructor comparison; unchanged production passes both. These are assertion failures, not setup failures or timeouts. Independent rereview found two additional oracle issues. Both are repaired: | ID | Original claim and decisive evidence | Repair and disposition | | --- | --- | --- | | S01 | A retired demand can start correct replacement work in the background and report success before its source response. The earlier owner accepted this variant in its example and both generated campaigns. A private public-promise probe observed early fulfillment. | Track both demands and compare pending outcomes while rotation is held and before the first replacement response; require both fulfilled afterward. The same generated histories now reject the variant with `[fulfilled, pending]` versus `[pending, pending]`. Final seed `20261026`, path `0:0:0` fails the variant and passes baseline. `fixed-now`. | | S02 | Cleanup mutated the settlement array retained by an assertion: the message described `[fulfilled, pending]`, but the later Received diff showed both fulfilled. This lost diagnostic evidence while preserving the failed checkpoint. | Copy primitive settlement/construction arrays at comparison time. The final fixed-example failure preserves `[fulfilled, pending]` in both message and Received after cleanup. `fixed-now`, under ORC-010. | S01's provisional reviewer label “R03” is an alias only; the original ledger's R03 primary-error item retains its identity. A broad variant that returns early for every load fails the held-rotation pending comparison. The more selective retired-demand variant fails the later pre-response comparison, so both neighboring regimes remain distinguishable. ### Reach, GREEN, and review requirements Both normal rotation campaigns run 40 histories with the same grammar, observations, comparison, and budget; only seed selection differs. The property is registered in both the oracle registry and named replay manifest. Final-source diagnostics print counts without changing expectations or driver behavior: | Rotation state | Fixed seed 20261026 | Unseeded | | --- | ---: | ---: | | Old response during held rotation | 19 | 23 | | Old response before replacement snapshots | 25 | 18 | | Old response after replacement settlement | 17 | 22 | | Initial-session retirement | 40 | 40 | | Replacement-session retirement | 26 | 28 | | Both demands await replacement responses | 40 | 40 | All eight source-release states also reach their minimum on this final source. Their fixed/random counts, in declaration order, are `21/22, 13/10, 13/15, 14/15, 27/31, 6/14, 11/21, 18/16`. Validation: - Full Electric package after S01: 1,133 runtime tests pass, one skipped, no type errors. After S02's diagnostic snapshots, the complete changed owner passes all 49 runtime and three type tests, including both generated laws. - Core replay/manifest suite: all 38 tests pass, no type errors. - Changed-file lint, Prettier, and whitespace checks pass. - R01 wrong-capture and H01 pending-decision release replay pairs were also rerun after introducing the constructor wrapper: each incorrect design fails the cleanup assertion; its unchanged-production partner passes. ORC-001/002/003: approved deadline and existing subset law are explicit beside independent zero-listener and pending-demand rules. ORC-004: length 1 reconstructs the original case; lengths 2–3 distinguish replacement retirement; three delivery cuts preserve legal late-response timings. Removing the earlier observation admits the measured wrong ordering. The grammar answers admitted requests and does not construct replacement before releasing the cache result. ORC-005/006: real constructor/HTTP path reached; ordering and settlement variants fail their intended comparisons. ORC-007: equal fixed/random budgets and exact direct replays pass/fail as stated. ORC-008/009: no copied production state machine; session/run and physical work/demand settlement remain distinct. ORC-010: release the held gate before cleanup, retain primary/secondary diagnostics, release fixture resources, and snapshot primitive observations. ORC-011: no new shared semantic fault needing a second resource model was identified; R01's native-dispatch formulation remains. ORC-012/013: this source-bound record, legal-before/incorrect-after neighbor, and initial/replacement distinction supply review and boundary evidence. ORC-014: installed SDK supplies real construction, parsing, listener behavior, and promise delivery; HTTP and the Map-backed cache supply explicitly controlled premises. ORC-015: all six new states and eight existing release states are measured and required. ### Final accounting and limits All original raw reports and the two new sibling findings were revisited. Final totals: **43 = 27 accepted-design + 5 fixed-now + 2 already-fixed + 8 duplicates + 1 refuted**. There are no confirmed-open, deferred, or pending design-decision items. A03 moved from design-decision to fixed-now after the explicit approval and implementation. Independent rereview found no further supported issue; the reviewers merit hire for concrete distinguishing examples, authority discipline, and checking their own diagnostic limitations. This closes the named enforcement gaps within installed SDK 1.5.15, jsdom, controlled HTTP, Map-backed persistence, sequential one-to-three rotations, and the stated comparison cuts. Overlapping rotations, actual native hosts, every supported SDK version, arbitrary failure schedules, every future private SDK resource, and separate mutation-evidence wait semantics are not established. No production code changed. Whole-PR readiness remains unassessed by this targeted evaluation; CI for earlier commits does not cover these changes. ## Package ESLint follow-up — 2026-10-26 CI on `04b1c4b2299a95746c6f64521d54ca4b2804a194` exposed two package ESLint errors that the narrower `lint:changed` oracle check did not report. Use a type-only namespace import for the real SDK module type, and remove a null comparison excluded by the typed listener-call domain. The installed SDK and bounded calibration both supply non-null callbacks. The measured histories, expected results, and checkpoints remain unchanged. Final owner SHA256: `f6d2a06d3cab1e1c5b18a2c2b6285b0b8cadb4f805d679feefc45caadd519a66`. Package ESLint passes for the changed Electric owner and core registry/manifest. The complete owner passes all 49 runtime and three type tests, including the 8,421-history native calibration and both generated laws. This is a mechanical follow-up to the evidence above; the 43-item review accounting is unchanged. ## CodeRabbit follow-up review — 2026-10-26 Review `5657996284` covers `04b1c4b2299a95746c6f64521d54ca4b2804a194`. Its three reported spacing defects in this record were confirmed and corrected. The intervening package-lint commit changes no oracle law or checkpoint. Source and formatting checks are the appropriate evidence for these text edits. The review body and mutable summary were inventoried separately from the 43-item agent evaluation above. Their 43 source-order entries, including individual endorsed ranges, repeated claims, metadata, and suggestions, resolve as **35 accepted-design + 3 fixed-now + 1 already-fixed + 1 refuted + 3 duplicates**. No confirmed-open or deferred item was introduced. The CI suggestion concerns the lint failure already repaired by `997d21d79`. The reported 60% docstring score is a vendor metric; no repository rule imposes its proposed 80% threshold. The owner already documents its contract, model, histories, driver, comparisons, and limits. Adding comments solely for that ratio would not improve the evidence. The native AppState caveat remains valid: the checked-in lane observes installed SDK 1.5.15 in jsdom. The separately recorded exact 1.5.23-source probe reaches automatic AppState selection with controlled native premises, passes current production, and rejects the original missing release. It does not establish actual iOS/Android runtime behavior or all supported SDK versions. These limits remain explicit; no native-wide closure or whole-PR readiness is inferred. Reviewer assessment: the spacing correction is precise and useful; endorsements and the scope caveat are consistent with the recorded evidence. The unsupported documentation threshold and lack of a new distinguishing experiment limit this review's depth. Do not hire for independent oracle review on this evidence alone. The final loss audit revisited the full review body and summary, including ancillary suggestions and repeated details. No behavioral repair or new experiment was required by this review. ## Retired durable-target observation — 2026-10-26 CodeRabbit review `5658197144`, item N01, identifies an observation gap in the managed-rotation owner. The review covers `997d21d7900bd6a9deed692942ea8d54bf2fdc6b`; this evaluation starts at `c88dcfe5902be80892d2108f16b9ec764041dbe7`, whose intervening change affects only this record. The reviewed owner hash is the `f6d2a06d` hash above. N01 is **fixed-now**. It reveals no reproduced production routing defect. ### Law and repair The SQLite persistence guide's managed-generation contract requires immediate retirement of expired source callbacks. The Electric guide's “Cleanup and resume safety” contract fences the retired provider session's late responses. Its adjacent recovery contract permits another run with a valid claim to keep using a retired persisted cache generation. Therefore this expired session's late row cannot enter either durable target; the whole retired map need not be empty or immutable. The independent source model already says that the old predicate has no row. Each round uses a fresh odd key and now remembers its retired storage target. The oracle compares that key's absence after the late HTTP response and after replacement settlement. All prior current-cache, public-row, constructor, demand-settlement, and cleanup comparisons remain. The grammar still generates one to three rotations and all three delivery cuts. This adds an observation and a seventh required reach state, without changing production or model rules. ### Evidence block - **Law:** expired Electric provider-session callbacks have no authority to persist their late row through either generation; the public guides above supply the authority. A valid run's retained generation remains usable. - **Reach:** normal fixed/random campaigns each run 40 histories. In declaration order, the seven final counts are `19/23, 25/18, 17/21, 40/40, 26/22, 40/40, 40/40`: during rotation, before snapshots, after snapshots, initial retirement, replacement retirement, demands awaiting replacement, and retired target observed. Every minimum is one history. - **RED:** the old owner accepts a forbidden `oldId` write into the captured retired map through the fixture's real `applyCommittedTx`, in fixed 40 and random 40 histories. This confirms the missing observation. With the repaired owner, both campaigns reject that incorrect result at `retired response in retired cache: expected true to be false`. - **GREEN:** unchanged production passes the repaired owner in fixed 40 and random 40 histories. The complete owner passes 49 runtime and three type tests with no type errors. Electric package ESLint passes. - **Mutant:** this is a wrong-result control at the durable fixture boundary, not a production mutation or evidence that production misroutes callbacks. The fixed RED starts with `["after-snapshots", "before-snapshots"]` and shrinks to `["during-rotation"]`, seed `20261026`, path `0:0:0`, preserving the assertion. Exact replay fails with the control and passes unchanged production. A second direct replay inserts the wrong row only at the final cut and fails `retired response in retired cache after replacement`. - **Limits:** real installed SDK 1.5.15, controlled HTTP, jsdom, one on-demand Collection, Map-backed durable storage, sequential one-to-three rotations, and the stated observation cuts. Actual SQLite peer-claim enforcement, overlapping rotations, native hosts, all supported SDK versions, and a write inserted and removed entirely between cuts are not established. A neighboring-state control seeds an unrelated negative key before expiry and checks that it remains in retired storage after replacement. Both campaigns pass. This calibrates acceptance of allowed retained contents; it does not execute a real peer claim. An earlier scratch control named `valid-peer-write` used the fixture's one claim ID and is not credited as peer authorization. Final owner SHA256: `7ccf1eb989a5d5a33876601bbca816b35069a5c70352d45ade2631bf58217005`. Unchanged Electric production SHA256: `4919ad548c416952fe51822b9e1d06c20dd5807b6dda40909bc3ed7046b66015`. The diagnostic baseline owner hash is `1b2ed73a4177382b726445f6b028d945e466561e33f0b41d93b4ee99556b1af4`; the immediate wrong-write owner hash is `9db1697989749a49fc9a22fb2ea944c6a691928cb2730d3ee90ea83e40a6dcc0`. Only diagnostics and the specified control distinguish these executed files from the final owner. The private Vite config resolves the private production source and real installed SDK explicitly; logs record the positive source witness. The snapshot owner is restored after the controls. The normal command is: ```sh pnpm --dir packages/electric-db-collection exec vitest run tests/electric-sdk-delivery-oracle.property.test.ts --coverage.enabled=false --maxWorkers=2 ``` The direct replay uses the same command with `-t replay` and `TANSTACK_DB_ORACLE_SEED=20261026`, `TANSTACK_DB_ORACLE_PATH=0:0:0`, and `TANSTACK_DB_ORACLE_PROPERTY=electric.sdk-rotation-release`. Wrong-result controls run that replay in the private source-bound snapshot, without editing shared production. Raw owners, patches, manifests, commands, and logs remain in the task's `/tmp/pr2257-ci-loop/retired-map/` evidence directory. ### Guide conformance and disposition ORC-001/002/003: public authority and the absent-key prediction are explicit beside the model; the five responsibilities remain distinguishable. ORC-004: one round reconstructs the observation gap; repeated rounds distinguish replacement retirement; each delivery cut supplies a different retirement interval. The grammar answers only admitted requests. ORC-005/006: real SDK/Collection/persistence paths run, and both new durable comparisons reject their intended wrong result. ORC-007: equal fixed/random budgets and the direct replay fail/pass pair are recorded. ORC-008 adds no stateful-model distinction; the captured target is a driver observation. ORC-009 preserves the glossary's separate provider session, sync run, and persisted cache generation. ORC-010: shrinking retains the durable failure, primitive observations survive cleanup, and fixture resources are released. ORC-011 has no named shared semantic computation requiring a second formulation; the expected absent key comes from the source model. ORC-012 is this source-bound record. ORC-013 distinguishes immediate/final wrong writes and allowed retained contents. ORC-014 credits real SDK delivery and limits the durable premise to the Map fixture, without a real SQLite/native handoff claim. ORC-015 requires and measures seven reach states. The old comparison's false green came from an unobserved durable target, not missing histories or a copied expected result. Capturing that target and observing it across the existing grammar is the smallest general repair. No known reachable in-scope counterexample remains from N01. This bounded observation repair does not establish whole-PR readiness. N02, N03, and U05 repeat N01 and retain their separate ledger identities. Reviewer assessment for N01: accurate, concrete, and appropriately low severity. The proposed small assertion repair is useful. The valid-retained-generation distinction required additional examination. Hire for this focused enforcement review; this evidence alone does not establish broader law-design depth. A fresh read-only rereview checked final owner `7ccf1eb9` and found no further supported defect. It independently passed the targeted three-test rotation baseline. The complete second CodeRabbit inventory contains 21 source-order items, including repeated prompts and mutable-summary metadata: **9 accepted-design + 1 fixed-now + 11 duplicates**. No item from that review remains open or deferred. This accounting is separate from the earlier agent and CodeRabbit inventories. ## CF01 — ordered replay oracle classification repair The DB CI counterexample is an oracle boundary-classification defect under the accepted demand/replay contracts. Production is unchanged. Baseline is PR head `c88dcfe5902be80892d2108f16b9ec764041dbe7`; shared integration is based on `5e1b3ff0f09b176feac1c39ba47938c1ad79e35a`. - **Law:** a newly initiated lazy keyed request may fail terminally even when truncate causes it. A failed reacquisition of an established request is an ordinary replay and retains the last complete publication until authoritative replacement. Authority: the architecture's Demand plane/current-demand contract and “Replay participants and failure,” plus the coverage map's explicit terminal `failDemand` policy. Nonterminal current-demand recovery remains a future contract. - **Boundary repair:** marker truncate synchronously creates fresh include demand, while established marker reacquisitions start later. The old `markerReplaying` call-stack flag misclassifies both. The driver now observes initiating keyed `requestSnapshot` result receipts, matching rejection only to exact authored root/marker load errors in a dedicated WeakSet. Release faults cannot supply the allowance. No predicate identity, production replay state/classifier, or terminal-status observation computes that allowance. - **Reach:** `replay.keyed-request-failures` constructs both failure placements, varying head rank, ascending/descending order and marker 3/4 membership before failure. Only recoverable histories get generated later actions. Each fixed and random campaign has 40 generated pairs, hence 80 concrete histories; initiating-keyed failure reaches 40 histories and keyed-reacquisition failure reaches 40. Reach records actual receipt/acquisition failures, not the selected placement. A broad-random reach miss (zero initiating failures) was retained as sampling evidence and repaired constructively, without weakening reach. - **RED:** original property `replay.ordered-window-faults`, seed `-82695597`, path `43:2:7:4:4:4:4`, fails `convergence: terminal error`, false versus true, on unchanged original owner and production. The trace is hold, truncateMarkers, settle(false), move(root 1, rank 1); scenario is ascending, offset 0, limit 1, anti-join, on-demand markers, includes, no ties/peer. The failed oldest load is a fresh include request, so the existing terminal lazy-demand policy applies. - **GREEN:** the repaired complete owner passes 31 tests, including broad fixed 300/random 300 and boundary fixed 40/random 40 campaigns. The original CI coordinates still replay exactly. Guarded original and new-property replays each report one executed property; the latter uses seed `20261026`, path `0:0:0:0`. Named neighbors preserve established include/marker replay failures and a pending include whose initiating adapter succeeds before reacquisition fails. - **Mutant:** private production control makes every `onLoadSubsetError` terminal via `recordSubsetError(error, true)`. Both boundary campaigns reject it at the established-replay terminal-error assertion. Fixed seed `20261026`, path `0:0:0:0`, shrinks to `[[], "asc", 1, false, false]`: exact replay is RED with the control and GREEN after restoring production. The empty suffix shows rejection at the intended boundary. Rebuilding every acquisition predicate as `and(where, where)` passes both campaigns with 40/40 reach, preserving freedom to reconstruct equivalent expressions. All production controls were restored byte-for-byte. - **Limits:** this status relation does not independently establish correct settlement of the initiating receipt. The pre-existing history-level failure allowance remains shared in peer scenarios, so per-receiver failure isolation is unproved. The coverage map names the existing owner and a needed witness that fails one receiver while checking another at the same cut. These laws are not retired or claimed closed. Real-provider cancellation, framework timing, every replay interleaving and nonterminal recovery of failed current demand remain outside this result. Final oracle Git blob: `68c8339969fe4a87380e83e0194fdddc67f0f990`. Final oracle SHA256: `7a476bec755a566d6eb59bac73dd272c386fa618b4b5aa3d9d00e887d776a66d`. Original oracle SHA256: `382f2f2f1975251d77ecaaa16e410fb4048b379c83d4e91834cd630ea6e98ada`. Unchanged subscription/subscriber SHA256: `c446932a8a1f8b2efd79d00846f1a110e65a6c6df75d2b24658053e6964b530b` / `74e97fe498b44446d5ee21912175afab6a3e58d2787e04e890a26771d5c8e1a6`. Runtime evidence uses the private source-bound archive at `/tmp/pr2257-ci-loop/db1-snapshot` and its `db1.config.mts`; coverage/typechecking are disabled. Full commands and raw log hashes are in `/tmp/pr2257-ci-loop/db1-evaluation.md`. The two exact guarded commands are: ```sh TANSTACK_DB_ORACLE_SEED=-82695597 TANSTACK_DB_ORACLE_PATH=43:2:7:4:4:4:4 TANSTACK_DB_ORACLE_PROPERTY=replay.ordered-window-faults node --import tsx packages/db/tests/oracle-replay.ts --config db1.config.mts TANSTACK_DB_ORACLE_SEED=20261026 TANSTACK_DB_ORACLE_PATH=0:0:0:0 TANSTACK_DB_ORACLE_PROPERTY=replay.keyed-request-failures node --import tsx packages/db/tests/oracle-replay.ts --config db1.config.mts ``` Package ESLint, source/registry Prettier, `pnpm lint:changed` and `git diff --check` pass. The manifest registers both replay targets and selects only their replay campaign. No production edit, commit or push is part of this repair. A fresh law/independence review accepts the final owner blob above; whole-PR readiness remains with the parent CI evaluation. ### CF01 guide applicability ORC-001/002/003: existing contract authority, independently authored load-error identity, and the initiating-request observation are explicit beside the law. ORC-004: constructive prefixes reach both distinctions, with useful pre-failure variation and recoverable continuations; no full ablation of the inherited checker grammar was performed or claimed. ORC-005/006: the real Collection and live-query path reaches the intended comparison, which rejects the incorrect terminal-error control and accepts equivalent rebuilt predicates. ORC-007: fixed/random budgets match, and original and new exact replay coordinates are recorded. ORC-008/009: no new semantic model state is introduced; driver reach states name request initiation and reacquisition using the existing glossary. ORC-010: inherited final draining and cleanup remain; the added observer is restored and its rejection observation is handled. ORC-011 adds no independent reference computation needing a second formulation; correctness of receipt settlement and per-receiver error isolation remain explicit unproved limits. ORC-012 is this source-bound evidence block. ORC-013: fresh and established request failures, pending success before failure, rebuilt predicates, and the incorrect terminal-error control distinguish the repaired boundary. ORC-014: the internal receiving boundary runs through real DB code; the controlled provider establishes no real-provider, framework or host handoff. ORC-015: actual receipt/acquisition failures measure both declared states at 40 histories per campaign. This accounting applies to CF01's bounded observation repair and does not replace the earlier cleanup-review outcomes. The private full/reach and boundary-control runs add only console output of `failureReach.counts()` to the shared owner; expectations, generated inputs and production behavior are unchanged. The recorded final owner hashes identify the shared file without that diagnostic output. ## Production reduction after `42e2d9ca8` The user requested less production code and fewer shipped bytes. This follow-up removes the mutable callback-release handle and its no-op initial value. Each of the four terminal paths now calls the private stream's `unsubscribeAll()` before the existing abort. Cleanup no longer calls both release methods. Earlier release at terminal resume/durability failure is permitted by the accepted cleanup contract; this change introduces no new deadline or law. The approved release-before-replacement deadline remains unchanged. The final production source is three lines and 149 bytes smaller than merge-base `5649a07d4`. With dependencies external, the production comparison reports **+1 byte gzip and -5 bytes brotli** against that base (gzip 10,162 to 10,163 bytes). The prior pushed implementation measured +9 gzip/+15 brotli. The clean direct-call implementation was smaller than either a stop helper or a release-only alias. Inlining the queued-batch temporary increased brotli size and was not retained. This is not a claim of reduction in both formats. ### Law and evidence - **Law:** cleanup releases resources owned by its sync run, under `CleanupFn` and the collection-options creator guide. The installed-SDK source-release and rotation owners retain their earlier laws, histories, observations and sensitivity evidence. Removing the returned handle is valid because each Electric provider session privately owns its stream; full release removes that stream's callback as well as host listeners. Abort still owns request cancellation. SDK subscription registration precedes synchronous delivery, so full release also works before `subscribe()` returns its handle. - **Reach:** no new product law, history dimension or scope claim is added. Existing fixed/random campaigns and declared reach checks pass in the full Electric package. The fixture calibration enumerates both release cuts: during synchronous subscription and after its return. - **RED:** a wrapper that only assigns the callback release after `mockSubscribe()` returns fails the synchronous calibration: expected one release, observed zero. It passes the after-return neighbor. This is an assertion failure at callback release, not a setup or timeout result. - **GREEN:** `pnpm --dir packages/electric-db-collection exec vitest run --coverage.enabled=false --maxWorkers=2` passes 30 files, 1,136 runtime tests, one skipped test, and typechecking on the exact source identities below. The calibration's two cases pass with the wrapper's stopped flag. Package ESLint has zero errors (23 existing warnings), Prettier, `pnpm lint:changed` and whitespace checks pass. - **Mutant:** the calibration rejects the missing-stopped-flag wrapper above. Earlier installed-SDK listener, release-order, demand-settlement and retired storage controls remain applicable; their results are recorded above rather than presented as a new production defect. - **Limits:** the descriptor fixture deliberately retains a raw callback to deliver late responses. Its release-call observation does not establish that the callback became unreachable. The installed-SDK owner remains the receiving witness for actual SDK release. Native execution, every SDK version, arbitrary overlapping rotations, real SQLite peer claims, and the separate core receipt/isolation limits remain unproved. The two shared mock streams now create separate callback ownership per instance. Prototype inheritance keeps request and resume controls live. Full release is idempotent and handles synchronous release during subscription. Scheduler restoration reinstates the same wrapper. The descriptor fixture rejects pending snapshots on abort, matching the SDK responsibility boundary, instead of making callback release cancel HTTP work. Its late-delivery control is named `ignoreAbort` to match that premise. An independent reviewer checked the production reduction and fixture changes. It identified the synchronous wrapper gap above. After its repair, the reviewer accepted the instance ownership, live controls, scheduler restoration, signal-owned cancellation and explicit raw-callback limit. No further supported finding remained within that scope. The optional queue inlining was then reverted to the original source. This is a bounded review of the reduction, not a new whole-PR readiness verdict. ORC-001/002/003 retain the accepted law, independent model and nearby explanations. ORC-004/007/008/009 retain the existing grammar, paired campaigns, model state and vocabulary. ORC-005/006/013 add the two bounded fixture cuts and the wrong-wrapper assertion failure. ORC-010 retains cleanup and failure handling. ORC-011 has no new shared semantic-fault hypothesis. ORC-014 keeps the mock release premise separate from the unchanged installed-SDK receiving witness. ORC-015 retains existing declared product reach, with no expanded coverage claim. ORC-012 is this source-bound append-only record. Final source identities (Git blobs): | Source | Git blob | | --- | --- | | `packages/electric-db-collection/src/electric.ts` | `1db20a316ae255ea6c479838bd2d45439286faf5` | | `packages/electric-db-collection/tests/electric.test.ts` | `62a858e17e2a0404fe8cfe2e2d499ce207f421fb` | | `packages/electric-db-collection/tests/electric-oracle.property.test.ts` | `81fb0f2f45ab089f3a0e5d16f041e0fb1dc57bab` | | `packages/electric-db-collection/tests/electric-descriptor-isolation-oracle.test.ts` | `c1c4bbd4717a208b82046bf0251e5cbd923f401b` | Raw local evidence is retained under `/tmp/pr2257-ci-loop/`: | Log | SHA256 | | --- | --- | | `net-negative-reentrant-fixture-red.log` | `fd5decfa4ac4979d8a23dd4de4bcba87946b8a5bb981c8af3af52043c0d7a972` | | `net-negative-exact-final-green.log` | `d4c7aa80b57adc70959eb20a59360b30b23480bad42b8234e2457a04adf6eb4c` | | `net-negative-direct.log` | `3fe347113cbd673a169a470f3e950cd67d8c6f6bdc8adfa1d88462af2a4068bd` | | `net-negative-lint-changed.log` | `89d7da780deb04850db632f478bc4155d23659849c0e5bec6d114c74dc9d5168` | | `net-negative-eslint-final.log` | `2540c43d9881aa2984d5fb39cd006db954c7dd0083eb841b17d032713273a12d` | Reproduce the bounded calibration with: ```sh pnpm --dir packages/electric-db-collection exec vitest run tests/electric-oracle.property.test.ts --coverage.enabled=false -t 'retires its mock callback' pnpm size:compare --packages electric-db-collection --no-scenarios --rebuild ``` ### Integration with current main GitHub reported a conflict after main advanced to `6c1ca8f8f9efe437d3cea61b5b9d0a086e2a5e34`, so CI could not start. The normal merge preserves published history. The only conflict was an import reorder in the core replay owner: retain main's order and the PR's `CollectionSubscription` import. The core model, grammar and comparisons are unchanged by that resolution. Main also introduces ORC-016, which keeps ordinary unit tests outside oracle files. The new two-case mock calibration now lives in `electric.test.ts`. Both consumers import the same small `electric-stream-mock.ts` fixture, so the calibration checks the exact wrapper used by the oracle driver. This extraction removes duplicate mechanics without introducing a model or new expectations. The missing-stopped-flag control was rerun on the shared helper: the synchronous case fails at callback release (zero instead of one); its after-return neighbor passes. Restoring the helper passes both. This is fixture calibration, not a new product-law or broader oracle-conformance claim. With main integrated, the complete Electric package again passes 1,136 tests and typechecking, with one skipped test. The complete core replay owner passes 31 tests, including both 300-history campaigns and both 40-pair boundary campaigns. Package ESLint, formatting, changed-file lint and whitespace checks pass after the two new helper imports follow the repository order. No further production edit is included. The size comparison remains +1 gzip/-5 brotli; main did not change the Electric production source. The earlier reduction review applies to unchanged production. Its shared fixture extraction is a mechanical follow-up, verified by the same wrong-wrapper control and full package run. All native/SDK/SQLite and core receipt/isolation limits above remain. ORC-016 applies to the relocated calibration; this entry does not claim a new audit of every inherited test in the repository. | Integrated source | Git blob | | --- | --- | | `packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts` | `1818dea39be8895d7116bba552f8a71ab7b98d98` | | `packages/electric-db-collection/tests/electric.test.ts` | `ea82d75c06af0ddd1f36ce71524583a4dac69b4f` | | `packages/electric-db-collection/tests/electric-oracle.property.test.ts` | `dd4d13e0785e174c749c8ec8c02a5413e27ddaec` | | `packages/electric-db-collection/tests/electric-stream-mock.ts` | `d66a7ebc9114ac1db0c6da1d87e37241c2f6cb86` | Runtime logs `merged-electric-green.log`, `merged-core-green.log`, `merged-fixture-red.log`, and `merged-size.log` remain in the same scratch directory as the preceding evidence. The body update passes the STE structural linter and paragraph-formatting check. The GitHub rendered body has no unintended `br` elements in ordinary paragraphs or list items. ### Integration with deferred-demand main This append records the normal merge of main `1640de834bca0588f91432ea80a0f4569157e9dc` into PR parent `f4a1fdbed014192cdbbf4029e18710f6fad0131d`. The source identities below bind this evidence to the resolved files. Earlier entries remain unchanged. - **Law:** preserve both accepted error-ownership judgments in the replay owner. The opening contract and main's retained-demand contract distinguish ordinary failed demand from renewal of an established demand. Initiating keyed-request results and the independent subscription-token/key-set model each constrain terminal errors after every history command and at final convergence. Neither classification can excuse a result rejected by the other. - **Reach:** retain all three properties, their fixed/random budgets, named histories and guarded direct selectors. The broad property runs 300 histories per campaign. Demand-origin runs 75. Keyed-request failure runs 40 pairs, giving 40 initiating failures and 40 reacquisition failures per campaign. The broad campaign's seventeen declared dimensions all reached their minimum. - **RED:** no new production defect is claimed. The fresh merge review found row-local expected answers in two incoming named histories. Both now call the same independent comparison as generated histories, under ORC-016. A direct broad replay also exposed an empty unrelated suite after campaign selection. That process exited 1 even though its intended comparison passed. Campaign registrations now remain at file scope. No test-disabling condition is needed, and the identical guarded replay exits 0. - **GREEN:** the resolved core owner passes 35 tests and typechecking. The complete Electric package passes 1,136 tests and typechecking, with one skipped test. A broader core run passed 865 tests but one wrapper child process exceeded its 30-second limit. Its focused single-worker rerun passed. This timeout is not presented as a clean complete broad run. ESLint, formatting, changed-file lint and whitespace checks pass. - **Mutant:** temporarily making every subset failure terminal fails the keyed-request guarded replay at the intended `history: terminal error` comparison. Restoring production passes the identical replay. The temporary edit was restored byte-for-byte. Core production matches main. - **Limits:** preserve all controlled-provider, predicate, receipt-correctness, per-receiver isolation, native application, SDK-version, overlapping-rotation and SQLite limits recorded above and in the coverage map. This merge adds no new product law or real-host coverage claim. The fresh merge reviewer accepted the shared-comparison repair and found no remaining supported item. The loss audit records two items, both fixed: source conformance and suite registration. Neither requires a product decision. The merge retains incoming main production unchanged and adds no further Electric production change. Measured reach from the merged campaigns: | Broad declared state | Fixed | Random | | -------------------------------------- | ----: | -----: | | settlementThrows | 12 | 19 | | throwsAfterReplay | 50 | 45 | | replayStartThrows | 56 | 66 | | heldAcrossTruncate | 26 | 23 | | failedLoads | 9 | 10 | | settledWindowChecks | 246 | 234 | | tiedWindows | 15 | 13 | | peerChecks | 127 | 119 | | windowMoves | 92 | 67 | | descendingRuns | 139 | 143 | | joinedRuns | 225 | 236 | | includeChecks | 152 | 149 | | markChanges | 87 | 73 | | antiJoinedRuns | 76 | 81 | | innerJoinedRuns | 81 | 76 | | markerLoads | 132 | 144 | | markerTruncates | 80 | 94 | | new-demand-failed-during-marker-replay | 9 | 11 | | settled-marker-demand-replay-failed | 32 | 35 | | initiating-keyed-request-failed | 40 | 40 | | keyed-reacquisition-failed | 40 | 40 | Each cell counts histories, not repeated events. Direct replay commands run from `packages/db` through `node --import tsx tests/oracle-replay.ts` against `tests/query/load-subset-replay-refinement-oracle.test.ts`, with `--coverage.enabled=false --maxWorkers=1`: | Property | Seed | Shrink path | Result | | --------------------------------- | --------: | -------------- | ----------------------------- | | replay.ordered-window-faults | -82695597 | 43:2:7:4:4:4:4 | One guarded execution, exit 0 | | replay.subscription-demand-origin | 2233 | 0 | One guarded execution, exit 0 | | replay.keyed-request-failures | 20261026 | 0:0:0:0 | One guarded execution, exit 0 | Set `TANSTACK_DB_ORACLE_PROPERTY`, `TANSTACK_DB_ORACLE_SEED` and `TANSTACK_DB_ORACLE_PATH` to the corresponding row. The keyed replay also supplies the terminal-error calibration above. ORC-001 through ORC-005 retain contract authority, independent judgments, literate explanations, both grammars and public checkpoints. ORC-006 and ORC-013 use the terminal-error calibration. ORC-007 retains paired campaigns and checks all three direct replays. ORC-008 and ORC-009 add no new model state or terminology. ORC-010 retains cleanup and primary-failure handling. ORC-011 keeps the two distinct failure judgments without a new shared-fault hypothesis. ORC-012 is this source-bound record. ORC-014 adds no receiving-path claim. ORC-015 preserves measured declared reach. ORC-016 now shares the named and generated demand-origin comparison without row-local expected answers. Against the exact integrated main, production source remains three lines and 149 bytes smaller. The Electric package bundle changes by -5 bytes Brotli and +1 byte gzip. The per-package table supplies these values, rather than the size tool's aggregate summary. The local dependency-install workaround stays uncommitted. | Resolved source | Git blob | | ---------------------------------------------------------------------- | ------------------------------------------ | | `packages/db/tests/oracle-config.ts` | `d225d933c301c226d6b2ae071e810caac07bc4c5` | | `packages/db/tests/oracle-replay-manifest.ts` | `0a5591e77abf27d0303391081ab5ba1ecd81d79f` | | `packages/db/tests/query/load-subset-replay-refinement-oracle.test.ts` | `2550b374e0894bb321507eba99c2a76c894d3c9c` | Raw command logs and the two-item merge ledger remain under `/tmp/pr2257-merge-final/`. Relevant logs include `core-shared-green.log`, `core-final-owner-green.log`, `core-final.log`, `wrapper-focused-green.log`, `electric-final.log`, `replay-original-final-green.log`, `replay-origin-green.log`, `replay-keyed-green.log`, `keyed-reach-green.log`, `terminal-control-red.log`, `terminal-control-restored-green.log`, `eslint-final.log`, `lint-changed.log` and `size.log`.