PR #2171: oracle challenge#

Reviewed source: 858b174a65f160d13d01f0324c7481cc8e4eba3a. This is a self-review. The author of the repairs designed these challenges after inspecting the tests; they are not independent or held-out evidence.

The initial task was to identify concrete oracle improvements. The initial pass below proposes 15. Two have executed distinguishing experiments. The remaining proposals identify source-inspected gaps and experiments still needed. They are not confirmed production bugs or completed oracle repairs. No production change or permanent oracle extension was made during this audit.

The follow-up audit expands this plan to 26 checks and maps 53 review items plus four evidence caveats in the review coverage matrix. That includes overlapping reports, non-runtime findings, and accepted product choices. Three current failures now have executable witnesses: cached SSR admission, hydration replacement of local option claims, and an unconfirmed successful write in a documentation example. The follow-up evidence below supersedes the initial pass's statement that it established no production defect.

Why the previous green results were insufficient#

The cache oracle compared admission alone. Its grammar coupled the two options when both were present. The metadata oracle checked a broad set of query shapes over a narrow history: one row, one held update, and successful settlement. Its union fixtures always had an empty branch. The neighboring publication oracle intentionally removed virtual fields before comparison.

Those instruments provide useful evidence, but their combination does not establish the interactions they omit. More runs of the same grammar would not repair these omissions. Earlier counts such as 144 cache cases and 409 metadata cases describe executions, not comprehensive protection of the contracts.

Authority remains the maintainer decisions recorded in the existing owners, the virtual-property contract in docs/guides/live-queries.md, and the live-query architecture's Collection boundary and publication laws. These proposals do not revise the accepted release policy, metadata attribution, or option retention decisions.

Executed challenges#

All runs used the unchanged source revision above plus the stated temporary edit. Source and test files were restored after each experiment. Raw logs are task-local under /private/tmp/rc2171-oracle-challenge/.

Command, from packages/db:

../../node_modules/.bin/vitest run --config vite.config.ts \
  --coverage.enabled=false --typecheck.enabled=false \
  tests/live-query-cache-options-oracle.test.ts

M1: reject only when every supplied option differs#

Location: packages/db/src/client.ts, _assertLiveQuerySources. Keep the original rowOptions.some(...) check, but additionally require:

rowOptions.every(
  (option, index) =>
    (option === undefined && record.rowOptions![index] === undefined) ||
    option !== record.rowOptions![index],
)

This wrong rule accepts two callers with different getKey references when their configured schema reference is the same. The approved rule rejects either differing reference under the same reusable identity.

The distinguishing driver edit keeps the schema reference unchanged in the existing option === 'both' histories, while still changing getKey:

schema: different && option !== `both` ? { ...schema } : schema

The failures were missing synchronous conflict errors or fulfilled promises where observer preload owed a rejection. They were not setup or timeout errors. This demonstrates improvement 1; it does not calibrate every proposed option presence or framework path.

M2: overwrite the claim before rejecting a conflicting caller#

Location: the conflict branch of the same method. Insert this immediately before the conflict error:

record.rowOptions = rowOptions

The first rejection still looks correct. A second attempt with the conflicting options can now borrow the corrupted claim.

The distinguishing checker invokes the rejected synchronous action again and requires the same conflict rejection. It retains the original model and first comparison. This experiment extends preload and subscribe retries; the async observer-preload retry remains future work.

Failures occurred at the repeated-admission assertion. This demonstrates the claim-preservation part of improvement 2. It does not establish row, listener, or resource non-interference after rejection.

Concrete improvements#

1. Vary cache options independently, including absence#

Owner: packages/db/tests/live-query-cache-options-oracle.ts, its core driver, and packages/react-db/tests/cache-options-oracle.test.tsx.

Gap: the both cell changes both references together. First and second callers always have the same option presence.

Change: generate first/second declarations independently for each option: absent, same reference, or different reference. Derive conflict from the pair of declarations and query identity, rather than a single different flag. Keep the default/default success case and both directions of absent/custom. Use transforming schema fixtures where that boundary permits schemas.

Witness and cut: cache (keyA, schemaA); request (keyB, schemaA) under the same identity. Reject at admission; a distinct query key must succeed. Declare reach for each single-axis conflict and each presence transition. M1 is the executed calibration for the first missing distinction.

2. Compare cache state after rejection#

Owner: the same cache model and receiving drivers.

Gap: the check ends at throw/rejection. It never asks whether the first caller's result or resources remain usable.

Change: extend each rejection history with a repeated conflict, a compatible third caller, and a source update. Compare original keys, schema output, rows, and surviving subscriber delivery. Record public subscriber ownership before and after the rejected attach, without requiring incidental private layouts.

Witness and cut: A establishes a result; B conflicts twice; A's compatible peer still reads A's keys and receives the next update. No rejected listener remains. Observe admission, the next source publication, and final cleanup. M2 demonstrates one missing distinction. Also challenge a listener retained before validation and a rejection that evicts the first result.

3. Control pending delivery and vary which caller establishes the result#

Owner: the core cache driver and React receiving driver.

Gap: the first caller is always explicit preload. The source is a ready local-only Collection. Omitting await initial exercises immediate result reuse, but does not hold source delivery or prove a transport-pending premise.

Change: add an explicitly held source load. Assert that it started and remains unresolved before the second caller. Cross preload-first and supported observer-first registration with preload, subscribe, and render consumers. Record reach separately for each path and pending/settled cut.

Witness and cut: attach a conflicting observer while A's source delivery is held; it rejects immediately. Release A and verify its exact result. A wrong implementation that validates options only after readiness must fail before the release. A healthy compatible peer must continue waiting and then succeed.

4. Model option claims through hydration, failure, and consumption#

Owner: extend the cache option model using the public lifecycle paths in packages/db/tests/db-client-preload-identity.test.ts.

Gap: those paths already have source-object witnesses, but the row-option oracle does not intersect them. A one-shot admission predicate cannot judge when a claim begins or stops applying.

Change: retain the first local declarations while a result is reusable; model retirement when a failed or consumed result is no longer reusable. Generate pending/settled hydration, first local claim, a later hydration chunk, conflicting reuse, result consumption/failure, and replacement reuse. Server function references must never become local identity claims.

Witness and cut: hydrate, claim with A, hydrate a newer chunk, reject B; consume or fail that stream, then allow a fresh B result. Compare public dehydration, local row keys, and caller outcomes. Challenge both overwritten local claims and claims retained forever. These experiments remain unrun.

5. Receive option laws in the other actual framework bindings#

Owner: packages/db/tests/conformance/contract.ts, the shared conformance suite, and each materially affected framework driver.

Gap: the new option-specific receiving evidence is React. Source-ID and general conformance evidence does not establish this option-specific handoff.

Change: reuse the option judgment for independent DbClient callers through each supported config entry point. Reuse inline-retention histories for identity-comparing bindings, including Preact. Reactive bindings without a DbClient follow their own documented recompilation law; do not impose React's identity policy on them. Run real native scheduler cuts and render budgets.

Witness and cut: a normal render retains a comparing binding's Collection; identity replacement applies new options; a separate conflicting cached caller rejects before returning rows. A compare-options-by-reference-on-every-render mutant must fail in each applicable host, not just a controlled core driver.

6. Compare complete metadata results and independently judged keys#

Owner: packages/db/tests/query/virtual-row-fields-oracle.test.ts.

Gap: the 400 attribution histories read live.toArray[0], check its label, and compare metadata. Projected keys come from a clean sibling compiled by the same machinery. Extra rows and shared key mistakes can escape that comparison.

Change: have the model predict every selected ordinary field, every row, and multiplicity. Compare complete arrays or multisets as the query contract requires. For ordinary projected roots, add explicit getKey functions with independent expected keys. Keep default-key differential checks as supplemental evidence; do not invent an undocumented composite-key encoding.

Witness and cut: two rows with distinct labels and model-derived projected keys, followed by deletion of one. Observe preload and every publication. Challenge an extra row, a missing non-first row, a lost id, and an incorrect projected key shared by both compiler paths. None is calibrated here.

7. Populate multiple union branches simultaneously#

Owner: the same metadata owner.

Gap: every union attribution history has one populated branch and one empty branch. Either branch position is covered, simultaneous contributors are not.

Change: generate nonempty branches with different source Collection IDs, typed source keys, overlapping ordinary values, and independent pending writes. Vary branch order, branch removal/reinsertion, and QueryRef consumption. Compare all occurrences without collapsing them into a value-keyed Map.

Witness and cut: A and B both contribute; hold a mutation only on B, then remove A's last contribution. Each remaining row must retain its own branch's attribution at pending and settled cuts. Challenge a union-wide first-source metadata owner and deduplication of distinct contributions. Duplicate public key handling must follow the existing key contract, rather than inventing a winner. These experiments remain unrun.

8. Change outer-join match topology during the history#

Owner: the nullable-spread grammar in the metadata owner.

Gap: matched, spread order, and pending side vary, but match presence remains static throughout each history.

Change: generate unmatched → matched → unmatched → matched transitions through join-key updates and legal delete/reinsert actions. Cross both spread orders and retain an untouched second parent as an isolation check. Compute the last present source from the authored query and independent source rows.

Witness and cut: { ...a, ...b } initially takes A's metadata, switches to B when B matches, and returns to A after B leaves. Compare after each action and inside its public callbacks. Challenge sticky ownership, first-spread ownership, and clearing metadata when a later spread becomes null.

9. Exercise attribution through rejection and overlapping transactions#

Owner: the metadata owner, receiving the settlement contract protected by the optimistic-history owners.

Gap: its attribution histories use one held update followed by fulfillment. They do not combine attribution with rejection or two independently pending source transactions.

Change: generate fulfill/reject decisions, both settlement orders, and a source update while an optimistic transaction remains held. Track authored source snapshots and surviving overlays independently. Predict attribution from the accepted source-versus-output rule at each cut.

Witness and cut: mutate A and B in a joined query; reject one while the other persists. The selected source's pending state and origin must follow the remaining transaction. New projections still receive output metadata. Challenge premature clearing of pending state and retention of the rejected source's metadata. Do not change optimistic snapshot policy to fit output.

10. Keep virtual fields in publication and downstream observations#

Owner: the metadata owner plus the observation machinery of packages/db/tests/query/includes-publication-oracle.test.ts.

Gap: the metadata owner checks snapshots at three cuts. The neighboring publication oracle's stripVirtualProperties removes all $ fields, so its callback comparisons cannot supply metadata publication evidence.

Change: add a separate metadata observation alongside the existing ordinary-value projection. Capture callback payloads, synchronous Collection reads, and downstream selections of the four virtual fields. Require callbacks for histories that owe them. Preserve prior observations before later writes.

Witness and cut: an optimistic source update changes label and pending state in one publication. A callback must never see the new label with stale attribution. Compare each layer at its own callback; do not require a downstream layer to advance during its upstream callback. Challenge event-only stale metadata and correct-after-a-microtask publication.

11. Run the attribution grammar through Collection facades and inline controls#

Owner: the metadata owner, with a receiving driver using the facade lifecycle histories owned by the includes Collection oracle.

Gap: facade projection and inline collision witnesses are supplemental fixed tests in virtual-row-fields.test.ts. They do not receive the broad attribution grammar or exercise attribution through bucket departure and reactivation.

Change: feed the same projection/collision model through root Collections, Collection-valued includes, and inline-value controls. Vary active/empty/shared buckets, route moves, child updates, and cleanup. Model facade lifetime separately from row attribution; reuse the existing owner rather than creating a competing lifecycle model.

Witness and cut: two parents share one child facade; one leaves while the child has a pending write. The remaining parent's facade retains the right source/output metadata. Inline projected $key values retain authored shape. Challenge using the parent Collection ID for projected facade rows and enriching inline values as Collection rows. Calibration remains unrun.

For A12's Effect claim, first inspect its public value contract separately. An Effect does not publish through an output Collection. Do not infer an output Collection ID law from the facade contract or treat every reserved authored scalar as illegal. Its receiving driver must compare the contract that actually applies; unresolved authority remains a limit of this plan.

12. Observe metadata inside functional callbacks#

Owner: the metadata owner and packages/db/tests/query/includes-functional-projection-oracle.test.ts.

Gap: the metadata grammar's functional QueryRef consumer returns the row directly. Its final output check does not prove a callback could not use spoofed input metadata to compute an ordinary scalar. The functional-input owner checks materialized values, but does not supply this reserved-field collision grammar.

Change: generate a colliding inner projection through direct, QueryRef, join, and union forms; capture public callback inputs and return an ordinary observedCollectionId or pending badge derived from them. Keep the existing rejection of compiled Collection-valued functional inputs.

Witness and cut: an inner new projection selects a fake $collectionId; an outer callback copies its observed value into an ordinary field. Assert the legitimate metadata at callback invocation and on the resulting scalar. An outer-publication-only sanitizer must fail this check. Sanitizing the final reserved fields is insufficient once user JavaScript consumed the fake value.

Maintainer decision, 2026-10-28: new projected subquery objects have their reserved fields removed before a downstream .fn.select() callback. Direct source rows retain source metadata. Inline include values retain authored shape. This resolves O12's authority question; its receiving oracle remains to be authored and independently reviewed before production repair.

Subsequent clarification, 2026-10-28: structured whole-row source spreads also retain genuine source metadata at callback entry. The stripping rule applies to projections that create their own row shape; it does not override the existing source-owned spread rule.

13. Model release histories and receive them through packed artifacts#

Owner: a new release-law model adjacent to scripts/version-packages.test.mjs and scripts/publish-packages.test.mjs. Keep their useful fixed regressions as replay inputs or supplemental tests.

Gap: version and publish tests use small separate workspaces and written answers. The publishing callback records public names and prerelease state; it does not observe the real Changesets command's registry operations or packed dependency capabilities. Manifest peer strings alone cannot prove API support.

Change: generate legal sequences of changesets, version runs, repeated no-op runs, publish failures/retries, and RC exit. Independently model patch suffixes, minor candidate increments, precedence, consumed changesets, stable 1.x lines, and dist-tags. Include candidate and patch counters around 9/10. Run the command boundary against a local registry fixture, never npm production. Pack the real package inventory and receive representative application paths with supported DB versions. Check that excluded 0.15 combinations are rejected and RC combinations can execute newly required APIs.

Witness and cut: patch → patch → minor → repeated version → failed publish → retry → exit. Every packed manifest, selected tag, and consumed changeset must match the model. Exercise Query failure reporting and offline outbox restoration in installed fixtures. Challenge double-consumption, lexical RC ordering, incorrect stable-package tags, and peers that claim absent methods. The stable Query minor decision remains accepted policy, not an oracle defect.

14. Generate type inputs from the same boundary descriptions#

Owner: packages/db/tests/query/virtual-row-fields-oracle.test-d.ts, with ordinary mutation-handler type tests as supporting evidence.

Gap: the metadata type file has reusable expected type aliases but applies them to hand-authored concrete queries. That does not meet ORC-016's generated legal-input requirement or cover the runtime grammar's composition axes.

Change: generate legal TypeScript query inputs from row/value, projection, nullability, union, and composition descriptions. A reusable independent law predicts exposed metadata and nullability. Compile the generated inputs through the public package exports, preserving diagnostic identity and source locations. Add adapter handler-result forms with an independent Promise admission rule; runtime legacy-value tolerance is a separate JavaScript promise.

Witness and cut: vary a projected inline object, a whole-row child, a nullable joined row, and discriminated union members without adding expected answers. Reject enriched projected-value types, lost optionality, and accepted legacy handler-result types. Do not use any, casts, or an unreachable callback to manufacture a successful compile. These experiments remain unrun.

15. Preserve oracle failures when teardown also fails#

Owner: both cache-option drivers and their shared test lifetime support.

Gap: their finally blocks run cleanup sequentially. An early cleanup exception can replace the comparison failure and stop later cleanup. The metadata owner already uses checkWithCleanup, including a calibration test; that protection does not extend to the cache drivers.

Change: use cleanup support that attempts every owned release, preserves the original law/checkpoint as the primary cause, and retains secondary errors. Register partially acquired resources before subsequent steps can fail.

Witness and cut: cause a cache comparison mismatch, make observer disposal fail, and verify that view, client, and source cleanup still run. The reported cause must remain the comparison mismatch. Also check a failed mount before an unmount handle becomes available. This is harness evidence, not a new product recovery promise. Its fault-injection calibration remains unrun.

Initial pass: implementation order and evidence limits#

Start with 1–2: both have demonstrated survivors. Then add 6–10, since those histories exercise the metadata boundaries that repeatedly escaped review. Follow with cache lifecycle/host receiving work, facade/callback receiving work, and release/type boundaries. Apply 15 to each driver as it changes.

For every implemented improvement, keep the old regressions, add the missing grammar or observation, declare per-path reach, and run the unchanged baseline before considering production changes. Demonstrate a relevant mutant failure at the named comparison. Do not mark an item complete because this report describes its experiment. No claim of universal correctness or zero future reviewer findings follows from this audit.

The two demonstrated gaps remain open in the checked-in oracle. The remaining 13 proposals still need calibration. No production defect was established by the experiments here. Only core cache comparisons were mutation-tested; the React and other native-host counterparts were not run with these mutants.

After restoring every temporary edit, the core metadata and cache owners pass together: 553 tests across two files. The existing release tests also pass: 11 tests. These are baseline checks; they do not implement the proposals or establish full PR CI success. pnpm lint:changed, the report's Prettier check, and git diff --check pass. pnpm reports the existing node_modules/lockfile override mismatch; this audit did not install dependencies or change the manifest or lockfile.

Follow-up: make the plan account for every review item#

The original 15 were insufficient. They concentrated on cache and metadata interactions. They did not explicitly preserve several already repaired laws, exercise documentation behavior, or require clean build and exact-head evidence. Runtime oracles also cannot decide a maintainer's version policy or establish that unused code has been removed.

The matrix preserves A01–A15 from the first supplied review, B01–B10 from the next, C01–C15 from the latest supplied review, G01–G11 from GitHub review comments, and W01–W02 from the bot's pre-merge warnings. B10 and C01 retain both of their subclaims. Overlaps retain separate IDs. Four source caveats remain explicit. The bot's reach-wording suggestion is separate from its remaining isPersisted comment; the first inventory accidentally conflated them.

No new product decision is needed for these checks. The accepted policies remain the authority. A request to identify sufficient improvements does not make proposed checks into implemented coverage. Confirmed failures remain open.

16. Check cached server reads before any subscription#

Owner: the shared cache option model and core driver, with a React renderToString receiving driver alongside cache-options-oracle.test.tsx.

Law and gap: independent callers cannot borrow conflicting local row behavior. The current owner reaches preload, observer preload, subscription, and client render; it does not reach a cached getServerSnapshot() before subscription. An SSR hook never subscribes, so that later guard cannot help.

Change: generate cached/uncached server reads, source-only/query preloads, same/different/absent options, and keyed/derived identities. Reuse the admission model. Require a cached row to be present before the conflicting read. Add a browser hydration control under the same law, without inventing transportable function identity.

Witness and cut: preload A, then server-render B with the same identity and a different getKey or schema. Reject before returning A's snapshot. A same-option caller succeeds. A guard placed only in subscription must fail. The core and actual React server paths both fail this comparison on the current head.

17. Preserve mutation outcomes and explicit confirmation across adapters#

Owner: Query's mutation histories in ownership-lifecycle.oracle.test.ts and Electric's handler histories in electric-oracle.property.test.ts.

Law and gap: the handler's fulfilled/rejected outcome remains its outcome; legacy return values are ignored at runtime. Query performs no automatic refetch. A confirmed write survives settlement; an unconfirmed optimistic row reverts. Types reject non-void handler results. These are approved decisions, not an invitation to reinstate old automatic behavior.

Change: keep the existing 18 Query and 12 Electric histories in the required validation set. Extend their grammar across CRUD, fulfillment/rejection, legacy/void results, and no confirmation versus explicit refetch/direct write or Electric acknowledgement. Cross delayed confirmation and ordered consumers where those existing owners apply. Compare exact handler error identity, fetch counts, public rows, and transaction outcome while held and at settlement.

Witness and cut: a successful server write followed by a legacy result must not become a caller failure. A Query handler with no confirmation starts no fetch. A documented successful-write example must use a confirmed history. Earlier records calibrate the Electric rejection wrapper and Query automatic refetch removal; this audit does not newly implement those owners.

18. Enforce external completion through transaction state and Offline restore#

Owner: optimistic-history-oracle.ts, its outcomes driver, and the real Offline restoration/settlement receiving paths.

Law and gap: external completion is admitted only for pending work. It cannot turn failure into success or override persisting/completed work. The first 15 proposals omitted this law even though the previous review added its missing action to the primary model.

Change: retain pending/persisting/completed/failed starting states and repeated completion attempts. Intersect them with restored outbox work, peer ownership, and mutation outcomes that the Offline owners already express. Compare public rows, terminal outcome, and transaction state after each action; observe outbox deletion and caller settlement at the receiving boundary.

Witness and cut: fail a transaction, attempt external completion, and require rejection without changed rows/outcome. Restore permitted pending work as a compatible control. Removing the admission guard previously failed four state histories. Packaged API availability is a separate O13/O22 check.

19. Release descriptor deferrals after failed or uncommitted renders#

Owner: React's source-ID reuse oracle and descriptor-query binding driver; use shared conformance receiving paths where another framework owns this law.

Law and gap: a rejected render cannot leave a descriptor Collection unable to start for a later consumer. Mounted identity retention does not prove partial-construction cleanup. The existing React owner already covers rejected source-ID reuse, Suspense, infinite hooks, and multiple throwing starts; retain that evidence rather than claiming a new model is needed.

Change: inventory render preparation steps that acquire deferrals. Generate failure before/after each acquisition, suspended and abandoned renders, and subsequent direct readers. Reuse the existing lifecycle judgment. Register cleanup for partial construction and require per-hook reach.

Witness and cut: reject preparation after deferring a shared descriptor; a later direct preload must reach ready and expose the authored row. A second source throwing during release must not prevent a healthy third source from starting. Mutants that omit release or stop after one failure must be rejected at those public cuts, rather than by an unrelated cleanup error.

20. Observe proxy expressions through diagnostics and actual UI consumers#

Owner: the virtual-field query law, index-suggestion tests, and a receiving witness for the React Native shopping-list projection and badge.

Law and gap: the selected ordinary pending indicator must follow the source row. JavaScript !proxy is a constant, not a query expression. An outer reserved field receives output metadata. Correct generic metadata cannot prove that the example actually consumes the ordinary field.

Change: generate pending/settled and true/false source states through supported predicate, order, and projection expressions. Check both actual result variation and the intended diagnostic path. Compile the example and receive those states through its actual component, not a copied projection.

Witness and cut: hold a list write, observe the Saving badge, settle it, and observe the badge clear. Ordinary projected hasPendingWrites must vary while output $hasPendingWrites remains governed by the projection law. Calibrate a JavaScript-negation replacement and a badge reading the reserved property. Static wiring plus a core query test is useful but does not establish native component execution.

21. Execute authored documentation and check migration/API consistency#

Owner: scripts/check-doc-snippets.mjs, package type checks, and behavior receivers reusing the relevant mutation/query models. Handwritten guide and skill references are in scope; generated reference output remains CI-owned.

Law and gap: runnable guidance must resolve public exports and demonstrate the behavior it promises. Existing removed-symbol searches and snippet compilation cannot detect a successful POST whose optimistic row disappears. An existing snippet baseline can also preserve a newly introduced diagnostic.

Change: extract the actual fenced snippet, supply only its documented external collaborators, and run its successful and failing histories through the matching model. Compile examples and skills against exports. Reject new removed-symbol references outside explicitly marked historical/before examples; compare diagnostic identities against the baseline without expanding it to waive new regressions. Check prose for source/output attribution, explicit confirmation, internal helpers, stable-minor upgrade costs, and removed APIs.

Witness and cut: the documented POST succeeds and the server owns the row; at transaction settlement the Collection must show the confirmed row. An unexported migration helper fails compilation. A remaining isPersisted reference fails the current-API check. The successful POST witness is RED at this head; broader generated docs receiving coverage remains proposed.

22. Validate the actual workspace before versioning and packed consumers after it#

Owner: workspace install/build/typecheck CI, actual package inventory, and the release model's package-consumer receiving fixture.

Law and gap: a truthful published peer range does not guarantee a local workspace can build before the RC versions are written. Existing node_modules can retain a symlink that a clean install will not create. The first plan's packed-consumer checks omitted that pre-versioning boundary.

Change: use a disposable, clean, frozen install and the repo's package build graph. Resolve every imported workspace API, including declaration/test inputs and examples. Check the actual non-private inventory against the RC changeset after main integration, including Convex and Preact. Verify local workspace dev dependencies independently from published peer ranges. Then version, pack, install, and execute supported consumers through O13.

Witness and cut: Offline has an RC-only peer while the local DB is still 0.15.2; workspace builds must resolve the local source via a workspace build dependency. A persisted Query handler returning {} must fail the new void contract's typecheck. Neither failure is established by an already linked runtime test. Both source findings remain open; no fresh install was run here.

23. Check dead exports, branches, and duplicated wrappers with source evidence#

Owner: production caller/export inventory, TypeScript control-flow checks, and the shipped-byte comparison. This is a static review check, not a runtime state model.

Gap and change: behavior tests cannot reject an unused warning helper, an impossible SSR branch, an unused recompile mode, or equivalent duplicated wrappers. Enumerate callers and exported uses before deletion; check narrowed types and every framework's policy modes. Compare consolidated wrappers/types and run their unchanged behavioral owners. Do not delete a shared policy merely because React alone supplies a constant argument.

Witness and cut: leave an unreferenced warning export or dead mode in the production inventory; require the source check to report it. Preserve a real reactive-framework caller as a negative control for overbroad deletion. Compare size after consolidation, without declaring a harmless internal branch a product failure.

24. Measure repeated work independently from result correctness#

Owner: a narrow compiler work probe and pnpm size:compare, supplementing the metadata/functional-projection owners.

Gap and change: correct rows do not expose an alias-array or copy-closure allocation per row. Instrument the relevant compile/evaluation site or use a source/AST placement check. Compile once and process increasing row counts; require compile-invariant source discovery to happen once per compilation. Count copies only under the conditions that require a copy. Keep output comparisons alongside these counters.

Witness and cut: hoistable alias discovery or closure construction inside the row loop fails its deterministic count. An allocation required by a changed row remains permitted. This is a proposed engineering work check; no new wall-clock performance promise or measured slowdown is claimed.

25. Receive coded diagnostics and public APIs through published build artifacts#

Owner: production error census, scripts/test-production-errors.mjs, and scripts/test-minified-db.mjs, with affected adapter artifact checks.

Law and gap: adding a plain Error can bypass coded diagnostics and ship its full text. Source-only testing does not establish production message erasure or public export/name stability. The original plan omitted these existing independent observations.

Change: include newly reachable identity/mutation errors and all affected packages in the development census. Build actual ESM/CommonJS and minified consumer entries; compare error codes/names and test message erasure. Keep intentionally removed errors distinct from missing public exports in docs.

Witness and cut: an uncoded preparation error is reported by the census; a newly introduced literal survives production bundling and fails erasure. A documented helper missing from the public entry fails O21/O22 compilation. Use existing calibrated owners; no new artifact run was performed here.

26. Tie all validation to the exact head and the path actually exercised#

Owner: a validation manifest joining package/test inventory, oracle reach, build fingerprints, and review-item reconstruction. This is execution gating, not a universal correctness model.

Gap and change: three reported failures were in tests already on the PR. They needed an ordinary full affected-test run. Other review runs lacked Changesets dependencies, loaded stale DB builds, or reviewed a moving branch. Record source head, build inputs/dist age, resolved DB entry/copy, test selection, exit status, and per-host comparison reach. Run every affected changed test; include newly merged packages. Rebuild before adapter receiving tests. A new head invalidates affected evidence. Preserve every raw review ID, outside-diff comment, additional suggestion, and setup caveat in the validation inventory.

Witness and cut: restore each stale assertion and require its own test to fail. Remove a required host from the test selection and require the missing reach to fail validation. A second/stale DB or absent Changesets dependency must produce invalid setup, never a GREEN product result. Unrun checks remain unrun even when another suite has thousands of passing cases.

Follow-up experiments at unchanged 858b174a6#

These were temporary production drivers; no source repair or permanent test extension was retained. The core/React drivers reuse checkCacheOptionAdmission from the existing independent cache model. They vary getKey, schema, and both, each with same/different references. Fixture schema validation is an identity operation; these probes judge declaration admission, not schema transformation.

The server runs stub window as undefined and do not subscribe. The hydration run dehydrates the established query, checks its row exists, hydrates a stream with dehydratedAt + 1, and checks that the newer timestamp replaced it before admission. This distinguishes the real replacement path from ignored hydration. The documentation run extracts the fenced setup before // Usage in ## Transaction Error Handling, transpiles it, and evaluates it with the real Query Collection/QueryClient and a successful in-memory fetch collaborator. It preloads an empty server, inserts the documented todo, awaits settlement, and compares all authored ordinary fields with the server's independent row.

Commands used the root Vitest binary from each package, --config vite.config.ts, --coverage.enabled=false, and --typecheck.enabled=false. Temporary test paths were tests/cache-review-coverage-probe.test.ts in DB, tests/cache-server-review-probe.test.tsx in React, and tests/doc-success-review-probe.test.ts in Query. Drivers and logs are retained in /private/tmp/rc2171-oracle-challenge/ for this task. These paths are scratch artifacts, not checked-in replay interfaces. The witness construction above states the inputs and observations needed to reconstruct them.

The first documentation driver used a non-file import.meta.url under Vite and failed setup. That run supplied no product evidence. Reading the actual doc from the package working directory reached the row comparison and failed there. All other RED results above were intended assertion failures, not timeouts or teardown errors. No repair GREEN or hostile-mutant result is claimed for these three current defects.

The existing external-completion, core option-identity, and index-warning files also pass at this head: 58 tests across three files. Earlier review records supply their historical RED/GREEN evidence. This bounded baseline does not execute the new SSR/hydration histories in the checked-in test suite.

What the expanded plan does and does not establish#

Every identified review item has a concrete check and a distinguishing witness in the matrix. Behavioral findings map to independent laws and receiving paths; source/build/documentation findings map to appropriate checks. Accepted release policies remain explicit costs, rather than defects a test should reject.

This is plan accounting, not demonstrated interception of all 53 items. The expanded checks would need implementation and replay against each original failure or a suitable mutant before making that stronger claim. Known gaps remain assigned to their existing owners in the coverage map. The current SSR, hydration, and documentation counterexamples prevent a readiness or bug-class closure claim. No production fix, permanent oracle extension, commit, push, generated-document edit, dependency installation, or lockfile change was made in this audit.