PR #2171 oracle implementation chunks#

Production baseline: 858b174a65f160d13d01f0324c7481cc8e4eba3a. All entries below describe test/document changes on that unchanged production. The maintainer requires every oracle chunk to finish before production repair. RED results are therefore retained; no product-readiness or bug-class closure claim is made. The 26-check proposal and 53-item matrix remain the work inventory. Generated API documentation is excluded.

Chunk 1: independent cached options and public observations#

Law and authority. The maintainer's independent-caller decision requires same-identity getKey/schema declarations to agree by reference, including absence. Distinct query keys permit independent behavior. SSR initial views remain frozen at their capture cut (docs/guides/ssr.md, “Prepare every server snapshot”). Mounted inline retention is a separate owner.

Inventory and grammar. Six declaration pairs per option cross independently with derived/keyed identity and same/distinct key: 144 bounded histories. Core adds held/settled writes and five paths: explicit preload, observer preload, subscribe, cached server read and preload after positively observed newer hydration replacement. React supplies mounted hooks and actual renderToString; these are separate receiving paths, never inferred from a core result. Schemas test runtime declaration identity only; no transform/type support is claimed. The domains are exhaustive at these bounds, so ORC-007 random campaigns do not add a missing finite case. A key cannot change under the same model identity without a conflict; a distinct key is its legal neighboring control.

Observations and reach. Each core path reaches 288 histories, including 144 held deliveries. Each path reaches 32 getKey-only, 32 schema-only and 64 both conflict premises; 144 distinct-key controls; getKey/schema addition 48 each and removal 24 each. These premise counts are recorded before the actual admission comparison; a failed comparison does not claim later checkpoints ran. Preload, observer preload and subscribe each complete admission/retry/original reuse/ source-update comparisons in all 288. Server-read completes those in 224; hydrate-preload in 160. Each React receiver reaches 16/16/32 independent/both conflict premises, 72 distinct-key controls, additions 24 each, removals 12 each. Client admission/retry/original reuse and settled keyed-row comparisons run in all 144 histories. SSR completes admission/retry/original reuse in 80.

Original custom keys use first-id, second custom keys use other-id, and the default uses id; losing any declaration is observable. Both successful callers and the original after rejected retries retain exact keys and ordinary fields. Core checks every callback after the next atomic source publication and no callback for a refused listener. React checks accepted rows immediately and after its async act flush. The server held-row check compares the initial empty view, rather than incorrectly requiring later writes to rewrite the capture.

Baseline result. Run the root Vitest binary from each package with run --config vite.config.ts --coverage.enabled=false --typecheck.enabled=false. Core selector: tests/live-query-cache-options-oracle.test.ts: 192 assertion failures and 1,314 passes (1,440 histories plus 66 checker controls). The failures are missing conflicts at 64 settled SSR and 128 held/settled hydration admissions. React selector: tests/cache-options-oracle.test.tsx: 64 SSR assertion failures, 224 passes; zero scheduling warnings after the native handoff correction. tests/utils.test.ts: 132 passes, including three cleanup-failure positions. DB/React TypeScript checks pass. These are intended assertion failures, not setup, runtime or timeout evidence. Scratch logs: chunk1-core-final.log, chunk1-react-settled.log, and chunk1-core-rereview.log under /private/tmp/rc2171-oracle-challenge/. Set TANSTACK_DB_ORACLE_STATISTICS=1 to print the reach counts.

Calibration. The shared comparison rejects accepted conflicts on both retry attempts, wrong second/original keys, and an earlier wrong callback followed by a correct callback. The prior challenge record retains executed production mutants for all-options-must-differ and overwrite-before-throw guards. Those historical experiments are not fresh mutation evidence for the expanded paths. The cleanup fault injection varies the failing release position and checks the original mismatch remains the cause, the secondary failure stays distinct, and all later releases run. No production edit, even a temporary repair, was made.

Review. Independent subagents cache_oracle_review and cache_receivers_review applied oracle-review. Their first rounds found last-only callbacks, weak reach cells, indistinguishable original keys and a missing React settled observation. These are corrected. Final rounds found no further supported defect in this bounded scope. The receiver reviewer separately ran the three cleanup controls: three passed. Challenges that shaped this chunk are retained evidence, not held-out evidence.

ORC accounting. 001–005: authority, independent declaration model, literate layers, bounded reference/presence grammar and public receiving cuts described above. 006: wrong-observation controls described above. 007: finite exhaustive grammar, random/shrink campaigns inapplicable. 008: stateless comparison, no stateful transition revision. 009: declaration labels denote references or absence, not production cache state. 010: fault injection and all-resource cleanup. 011: no concrete shared semantic hypothesis requiring a second model; the accepted reference rule is independent of hash/guard internals. 012: this versioned record, without a closure claim. 013: single-axis conflicts and added/ removed neighbors distinguish wrong coupled rules. 014: actual React client and server receiving paths; broader hosts remain pending. 015: per-path counts above. 016: oracle tests use shared judgments; cleanup examples stay in ordinary utils tests.

Remaining work. O01 and O02 are implemented within the declared boundary; O03 held-delivery and O16 cached-SSR witnesses are implemented, while O03 first-registrant variation and O04 failure/consumption/transport remain pending. O15 has generic cleanup fidelity evidence but is not closed for every partially constructed native host. Other frameworks, hydrateRoot, semantic equivalence of functions and schema transformations remain outside this chunk. Product GREEN and fresh production-mutant campaigns are deferred until all oracle chunks finish. The reachable SSR/hydration counterexamples keep the product class open.

Chunk 2: hydrated claim lifetime and framework receiving paths#

Law and inventory. A portable result contains no server getKey/schema references. Its first local caller claims them; a newer payload retains those claims, while failure or consumption retires them. Authority: the maintainer's option decision, the source-claim lifetime in db-client-preload-identity.test.ts, and the SSR guide's matching-result configuration requirement. React and Preact compare inline query identity; Preact has no DbClient hook input. Svelte is the other public client-backed hook. Vue, Solid and Angular expose no DbClient input; their client-free reactive compilation policy is not changed into React retention.

Model, grammar and observations. The lifecycle owner uses one independent active/retired judgment over named declarations. It runs 2,160 bounded histories: 72 same-identity declaration pairs, three first local claimants (preload, observer preload and server read), active/replaced/failed/consumed results, pending/settled transport, plus replacement and failure before original pending transport release. Server configuration has equivalent key/schema semantics with independent references. Actual server dehydration is scanned for callables before a JSON round trip, so serialization cannot silently hide leaked claims. Pending conflicts/retries are checked before delivery; compatible promises stay pending. Newer payloads have different ordinary labels. A pending replacement is checked immediately and again after obsolete transport settles. Initial transport failure checks exact error identity on the claimant and compatible pending peers, then fresh local admission. Consumed/failed results accept the new declaration and expose its independent local keys after live handoff.

Per first-claimant path: 720 portable premises, 432 pending premises; 384 pending-conflict and 48 pending-compatible histories reach comparison. Pending replacement reaches 64 conflicts and eight compatible controls; pending failure reaches the same split. All 72 pending-failure histories reach failed-stream absence and retired reuse. On the unchanged RED baseline only eight compatible pending replacements reach the post-obsolete comparison; 64 stop earlier at the intended missing-conflict assertion. The later check is present, but no evidence claims those blocked conflict histories completed it. Phase × conflict/compatible reach prevents borrowing a retirement witness from an active-result case. Full counts print with TANSTACK_DB_ORACLE_STATISTICS=1.

Result and calibration. The DB lifecycle selector tests/live-query-cache-lifecycle-oracle.test.ts gives 640 admission assertion failures and 1,526 passes, including six checker controls. There are 576 missing replacement conflicts and 64 settled server-first missing claims. No setup, timeout or unhandled-error failure is counted. The shared judgments reject leaked callables, a no-claim policy and a forever-claim policy. The same pending and replacement comparisons observe the actual open product defects; production GREEN and fresh repaired-production mutants remain deferred.

The shared immutable capture/checker in live-query-bound-options-oracle.ts is received by the existing 12 React retention histories and six new Preact histories. Each Preact history reaches rerender, source update and changed identity; each option has two histories and each identity mode three. A render budget rejects rebuild loops. Six hostile in-place config replacements prove that mutating the original Collection cannot mutate the expected references. React cleanup now attempts every returned mount's release while retaining the primary mismatch. Svelte receives the 144 independent cached-option histories through actual effect roots and flushSync; all admission/retry/original reads pass, including 16 key-only, 16 schema-only, 32 both conflicts and 72 distinct key controls. It compares accepted keyed rows after native effect delivery.

Commands use each package's root Vitest binary/config with coverage/typecheck disabled for runtime. Preact selector tests/bound-options-oracle.test.ts: 12 passed (six host histories plus six controls). Svelte selector tests/cache-options-oracle.svelte.test.ts: 144 passed. React selector tests/source-id-reuse-oracle.test.tsx -t 'retains inline options': 12 passed, 80 other histories outside that selector. DB/Preact/React TypeScript checks and Svelte's test:types pass. Lint:changed passes with only the pre-existing installed lockfile/override mismatch warning. Scratch logs use chunk2-* under the task's existing scratch directory; lifecycle final is chunk2-lifecycle-r4.log.

Review and ORC accounting. Fresh independent reviewers cache_lifecycle_review and framework_options_review applied oracle-review. Their findings added before-release pending comparisons, pending replacement, phase/schedule-specific conflict reach, equivalent server keys, immutable option capture, and failure-preserving React cleanup. The lifecycle reviewer reran the final full suite and confirmed the same 640/1,526 split. The framework reviewer independently ran all three host selectors. Final reviews found no additional supported defect within these boundaries.

ORC-001–005: authority, independent active/retired rule, literate responsibilities, finite legal timelines and positively observed native/transport cuts above. 006: callable, opposite-policy and in-place-mutation controls. 007: bounded exhaustiveness rather than random sampling. 008: retaining a claim distinguishes changed-declaration reuse; failure/consumption removes it, with active neighbors proving the distinction is needed. 009: declaration labels denote local refs; portable results and local claims remain distinct. 010: error identity and all returned-resource cleanup; generic throwing-cleanup calibration is in chunk 1. 011: no remaining named shared semantic hypothesis requiring a second model. 012: this record preserves open product results. 013: active/retired and before/after transport neighbors. 014: actual Preact/Svelte schedulers receive the shared judgment. 015: per-path phase/schedule reach above. 016: all oracle cases replay common judgments; controls supply hostile observations to them.

Limits and next work. This completes the declared O04 transport, first-local claim and retirement timelines, and O05's applicable native receiving paths. It does not prove arbitrary stream interleavings, hydrateRoot, Svelte SSR, Svelte continuing source publications, schema transformations, or cleanup before a native mount returns. O15 still needs partial-construction fault injection; O03 first result registration without an existing transported result remains separate. These limits remain owned by the cache/binding owners. No production file, dependency installation, generated doc, commit or push changed.

Chunk 3: complete metadata results and populated unions#

Law and authority. Public virtual-row properties and ARCHITECTURE's facade boundary require structured whole-row/spread and functional direct-source results to retain source metadata. New projected objects receive output Collection metadata (maintainer decision). Authored reserved names cannot choose attribution. This chunk extends O06/O07's snapshot boundary; it does not claim callback, facade-lifecycle or functional-input coverage.

Model and legal grammar. Authored source facts and pending-key sets predict every ordinary selected field and all four virtual fields. No source row or compiler classifier supplies expected values. The 1,056 attribution histories retain all prior compositions, add a second source row and its deletion, and cross independently configured keys with default-key differential checks. Only the latter consult a sibling query for undocumented compiler key encoding. Both boolean collision values and legal local origin distinguish authored values from output metadata. Direct-source callbacks cannot add collisions; that nearby invalid combination is excluded by grammar. Collisions cross single/joined sources and direct, recursive, joined, functional and union consumers, so removing any such axis loses its receiving path.

Another 264 histories populate two union branches with numeric 1 and string "1", different source IDs and equal labels. They cross branch order, QueryRef consumption, either pending branch, five projection shapes and reserved-name collisions. A peer is deleted and reinserted while the other branch persists; settlement without confirmation restores its independent authored base. The custom public key preserves typed identity, avoiding an invalid duplicate-key winner policy. Model objects never cross into production without copies.

Observation and calibration. Public toArray snapshots are compared at preload, held mutation, peer deletion/reinsertion and settlement. The comparison normalizes only unspecified order and retains duplicates, every ordinary field and all metadata. Fourteen wrong-result controls cover both source/output policy and reject omitted/duplicated second rows, missing ordinary IDs, wrong keys, union-wide ownership and stale pending/origin. Allowed reverse order passes. These are checker calibrations, not fresh production mutants. Full production repair and its RED/GREEN/mutant record remain deferred by instruction.

Reach and unchanged baseline. 1,343 tests pass: 1,320 attribution histories, eight prior nullable-spread histories, one prior classification case and14 checker controls. Multi-row/deletion reach1,056 each, independent-output-key reach384, simultaneous populated/typed/reinserted union reach264 each, and true-authored output-pending discrimination reach192. Each of24 union path × source/output policy × pending-side × held/reinserted/settled cells reaches18 source-owned or48 output-owned histories. The oracle asserts all these states; a missing receiving path cannot borrow another path's count. Command: package-root Vitest with config, coverage and runtime typecheck flags listed above, selector tests/query/virtual-row-fields-oracle.test.ts. Final log: chunk3-metadata-collisions.log. DB tsc --noEmit was clean before the final collision-value grammar addition; the final type/lint check is recorded below.

Independent review. metadata_complete_review and metadata_union_review applied oracle-review and ran the tests independently. Findings corrected: position-dependent pending wait, source/model object sharing, aggregate reach, missing row2 metadata controls, and false-only authored pending collisions. Final union review independently passed1,343 tests with all required reach (chunk3-union-review-final.log). No further supported executable defect was found in this bounded scope.

ORC accounting. 001–003: authority, independent authored-fact judgment and literate boundaries above. 004: reconstruction of prior forms, meaningful composition/key/branch/collision axes, typed-key margins and direct-return collision exclusion. 005: full public snapshots at positively reached cuts. 006:14 calibrated controls, including legal reordered positives. 007: finite exhaustive grammar, random/shrink campaigns inapplicable. 008: direct recomputation; pending facts distinguish held/settled rows. 009: authored facts and pending-key sets denote source state and active optimistic overlays. 010: held gates settle before all-resource failure-preserving cleanup. 011: independent configured keys address the shared-default-key hypothesis; no further named shared fault requires another formulation. 012: this record and updated coverage map preserve limits. 013: true/false collisions and source/output, either branch and peer-return neighbors distinguish wrong laws. 014: controlled core only, no real-provider/framework handoff claim. 015: per-path counts above. 016: new histories and controls use the shared model/check.

Limits. Dynamic join matches, rejection/overlap, callback/downstream metadata, facade activation/retirement, functional callback inputs and generated public types remain separate work. Default compiler-key encoding remains a supplemental differential observation. No production file or generated doc changed. No commit or push was made.

Chunk 4: join transitions, independent write outcomes and publication#

Law and authority. The accepted source/output attribution rule applies at each publication. ARCHITECTURE's coherent-publication law requires installed reads and change payloads to agree; downstream callbacks are judged at their own layer, without requiring downstream advancement inside an upstream callback. The optimistic-history owner supplies settlement and first-queued-confirmation origin rules. This is O08–O10's bounded core receiving witness.

Model, grammar and observations. A full left join is recomputed from independent authored rows and separate optimistic snapshots. The driver has 112 finite histories: five projection shapes, spread order where meaningful, join-key versus membership transitions, independent success/rejection with separate errors, and either settlement order. A held left write spans unmatched, matched, unmatched and rematched cuts. A right write then overlaps and receives a queued same-key source update. The unconfirmed left row restores its base; the right source confirmation becomes local only after successful work. A later remote write distinguishes consumed attribution. An untouched parent remains.

Every action compares full root/downstream snapshots and every recorded callback's installed read, change value and previous value. Raw metadata is captured at callback time. Deltas across the entire callback trace must equal the independent before/after delta; message multiplicity survives capture. Batch partition is permitted. Initial-state subscriptions establish subscriber replicas before update classification is judged. The first attempted driver omitted that premise and got valid insert messages for first delivery; that was a fixture error, not product RED. Another run failed only on undeclared reach names; that was harness setup, also not product evidence.

Reach and unchanged baseline. Full owner: 1,463 passed, including prior 1,343 cases,112 histories and eight new checker controls. For each projection shape/topology, all rematched-held/two-pending/first-settled/both-settled/remote cuts and root/downstream held callbacks run. Spread shapes reach16 histories per such cell; other shapes reach8. Either rejection reaches8/4, both rejection reaches4/2, and either settlement order reaches8/4 respectively. All120 required states are asserted by createOracleReach. Final runtime log: chunk4-metadata-r2.log. Commands use the same package Vitest invocation as above. No unchanged-production defect was found in these histories. Controls reject stale installed metadata, stale event origin, wrong previous values, duplicated messages/whole batches, missing messages/callbacks and an earlier bad callback followed by a correct final read. No production-mutant or repaired-production GREEN is claimed.

Review. Fresh metadata_timeline_review and metadata_publication_review applied oracle-review. They identified duplicated whole batches passing the checker, grouped unsubscribe cleanup, and missing both-reject histories with separate caller errors. All are repaired. Both independently passed1,463 tests (chunk4-metadata-independent-r2.log and chunk4-publication-review.log). The final bounded verdict found no further supported executable defect.

ORC accounting. 001–003: authorities and literate, independent recomputation above. 004: initial absence/presence, both topology transitions, meaningful spread order, caller outcomes and settlement order distinguish the grammar; missing-key updates and same-source overlap are excluded from this domain. 005: public snapshots, callback reads/payloads and downstream scalar projection at named cuts. 006: eight wrong-observation controls, including duplicate traces. 007: exhaustive finite grammar, random/shrink campaigns inapplicable. 008: separate base/overlay/pending/origin facts distinguish acceptance, settlement and later writes. 009: model facts map to applied source rows, optimistic snapshots and pending writes, not D2 graph state. 010: both gates settle and independent subscription/Collection cleanup entries attempt all resources; capture preserves earlier metadata. 011: no identified shared semantic fault needs a second formulation. 012: this record and coverage map. 013: matched/unmatched, held/settled, local/remote and separate errors distinguish nearby wrong rules. 014: controlled core scope; no provider/framework handoff. 015:120 path states above. 016: histories and calibrations use shared judgments.

Limits. Same-source overlapping writes, truncate, dynamic joins beyond LEFT, provider/framework scheduling, facades and partial-construction cleanup remain open under their recorded owners. Production files, generated docs, package manifests and lockfiles remain unchanged; no commit or push was made.

Chunk 5: facade metadata, active intervals and inline values#

Law and authority. ARCHITECTURE's Nested materialization section applies the Collection metadata boundary to facade rows and preserves authored inline values. Parents sharing an active bucket share its ready facade. Last-route departure retires that interval; reactivation gets a new facade. These histories have no facade-local optimistic mutations, which could legally keep retired handles nonempty. This is bounded O11 receiving coverage.

Model and grammar. The primary includes owner now recomputes active bucket intervals from the complete current route groups. Model-only interval tokens name lifetimes, not production IDs. Complete inputs avoid redundant route-count state. The metadata receiver crosses 33 projection/collision descriptions, populated/empty destinations and child success/rejection: 132 histories. Sharing, one-route departure, last-route departure, held reactivation, settlement, later source update and resharing compare every child row and all four metadata fields. Facade output uses its public ID; source-owned rows use the independently supplied source ID. Inline toArray/materialize comparisons preserve authored shape. Reads of all four source virtual fields make inline spread values explicit rather than depending on property enumerability.

Results and calibration. Unchanged production passes 1,632 tests across both owners (1,599 metadata, 33 includes). Six lifetime controls reject split sharing, retargeting, stale retired rows/status, missing groups and a cleaned-up active empty facade; four inline controls reject facade enrichment. The first checker accepted that active-empty survivor. The review's actual checker probe now fails at the intended readiness assertion. No production repair GREEN or production mutant is claimed. Logs: chunk5-ready-final.log, chunk5-facade-lifecycle-rereview.log and chunk5-active-empty-probe-rejected.log. DB types and lint:changed pass (chunk5-db-types-final.log and chunk5-lint-final.log).

Reach and review. Every declared lifecycle cut reaches 32 histories per ordinary shape and four for direct functional returns. Each facade/inline form reaches nonempty held/reactivated observations. Active-empty-ready has the same 32/four counts. facade_metadata_review and facade_lifecycle_review used oracle-review; the latter found the readiness gap, verified its rejection and independently passed the full suite. No further supported bounded defect found.

ORC accounting. 001–003: authority, limits and literate independent models. 004: shared/sole/absent routes, populated/empty destinations, return intervals and caller outcomes distinguish each axis; inactive groups have no route. 005: actual public facades and inline values at every named cut. 006: ten hostile controls plus the actual former checker survivor. 007: exhaustive finite grammar, so random/replay campaign requirements do not apply. 008–009: active interval and next token are minimal lifetime facts mapped to public facade sharing; complete route inputs supply current activity. 010: pending mutation settles before all-resource failure-preserving cleanup. 011: no new shared-fault hypothesis requires another formulation. 012: this versioned record at unchanged 858b174a65f160d13d01f0324c7481cc8e4eba3a. 013: last-route and reactivation neighbors distinguish reuse/retargeting. 014: controlled core receiving scope. 015: per-shape/form cuts above. 016: histories and controls use shared judgments.

Limits. Single-source string child keys only; composite key encoding, facade-local mutations, construction failures, Effects and provider/framework scheduling remain separate work. No production or generated docs changed.

Chunk 6: generated public metadata types and nullable facade receiving path#

Law and authority. VirtualRowProps and ARCHITECTURE's Nested materialization section supply readonly metadata at Collection roots, source-row metadata on whole rows and authored shapes for inline values. A nullable selection is either a complete source row or an empty object. Publishing that object through a facade supplies required metadata in both cases, while ordinary fields remain absent in the empty case. The ordinary optional-fields type tests also establish required selected properties whose value can be undefined. This is bounded O14 core-source coverage; adapter handler-result generation remains pending.

Model and grammar. Twenty-four finite row descriptions cross three key domains, two ordinary scalar types, nested optionality and discriminated unions. Each receives the five projection/eight composition descriptions shared with the runtime owner. Seven child shapes cross the legal facade/toArray/materialize/findOne forms: 66 query witnesses per description, plus query/index nested refs and virtual-field removal. Array/Date facade projections are illegal and excluded; their inline forms remain. Inputs import the public source entry. Every generated body also executes public query/index construction before compilation, with reverse-order failure-preserving cleanup. The generated index explicitly chooses BTreeIndex. Two admission controls preserve the illegal opaque-facade and missing-index-type fixtures as rejected grammar neighbors. Type erasure prints import-free source before rebinding; an earlier emit-only removal produced db_1 setup errors and supplies no product evidence. A recursive type signature preserves per-member keys, values, optionality and readonly modifiers; Date built-ins stay opaque while their extra properties are checked. Arrays retain element shape, mutability and extra fields. Bidirectional signature comparison permits duplicate equivalent union members, which strict generic Equal incorrectly rejected in the first draft. Missing whole rows use a complete-or-absent alternative rather than Partial, which would admit partial source rows. Expected types come from declarations and authoring shape.

Concrete helper examples moved from virtual-row-fields-oracle.test-d.ts to the ordinary virtual-row-fields-reference-types.test-d.ts. They remain supplemental. The normal package oracle script selects the generated owner. Every compiler diagnostic, including dependencies, is retained with its file/span/code.

Baseline and receiving evidence. On unchanged production, all 24 generated descriptions fail only Observation_nullable_whole_facade: inferred ordinary fields are falsely required because the empty alternative disappears. This is a new production type defect, deliberately unrepaired. Every one of 69 declared type-comparison states and construction-admitted reaches in all 24 histories; this counts comparison reach, not successful histories. The runtime owner adds two legal correlated histories, initially matched/unmatched, each changing match presence twice. Complete source rows retain source metadata; empty facade rows receive output metadata, while inline values stay empty. The runtime owner passes 1,604 tests, including three nullable-boundary checker controls. Default empty-row key encoding is only checked against the facade's own public keys, so no independent encoding claim is made. Generated imports judge public source types, not published declaration resolution.

The first generator used invalid root/union API calls. The first runtime draft omitted required include correlation, and another draft omitted explicit index type. Those runs failed setup and supply no product RED. After fixture repair, the source compiler reaches only the intended law mismatch, and the runtime receiving comparisons pass. Logs: chunk6-independent-types-review-v3.log, chunk6-independent-runtime-review.log and chunk6-runtime-final.log. Final DB TypeScript and lint results appear with the construction evidence below. Final-delta runtime review passes 1,604 tests; the second reviewer independently passed all 24 public construction bodies before the permanent construction driver was added.

Calibration and review. Seven controls reject enriched inline values, lost nullability, one mutable metadata union branch, nested any, Date metadata any, optional nested metadata and nested readonly changes. Each starts with an accepted generated neighbor. Its hostile compilation must contain only TS2344 Assert failures at generated Observation/Removal aliases; syntax/setup errors cannot count. metadata_types_review found the per-union-member readonly, Date-any and nested-shape survivors; the revised checker rejects each at the intended type comparison. Its independent complete run has 24 intended RED and seven calibration passes, with every type state reached 24 times. A second receiver review found the illegal opaque facade and optionless index inputs. Both are corrected and retained as actual admission calibrations. Its independent two-owner run has 24 intended RED and 1,611 passes. The permanent construction driver then passed independent re-review: 24 intended type failures and nine controls pass; all 70 states reach 24 histories, including construction admission. Log: chunk6-construction-independent-final.log. Main agrees (chunk6-construction-r3.log). Final package types and lint pass: chunk6-construction-types-r2.log and chunk6-construction-lint.log.

ORC accounting. 001–003: public/architecture authority and visible textual models, source grammar, compiler and comparison. 004: key domains, optional nested values, discriminated unions and every meaningful projection/composition cell; invalid boolean keys and nullable source Collections are excluded. 005: real compiler public-source imports and actual runtime facade transitions. 006: seven intended diagnostic controls, three nullable-runtime controls, two construction admission controls and rejected actual checker survivors. 007: exhaustive finite domains, no random campaign obligation. 008: stateless type judgment, so state minimization does not apply. 009: authoring descriptions map directly to user syntax; signatures are model-only type observations. 010: compiler source is memory-only, all diagnostics retained; runtime resources use failure-preserving cleanup. 011: runtime nullable receiving witness supplies the distinguishing non-type observation for the lost-empty-row hypothesis. 012: this record at unchanged 858b174a65f160d13d01f0324c7481cc8e4eba3a. 013: matched/unmatched, projected/whole, nullable/required and per-member modifier neighbors reject nearby wrong laws. 014: core-source type and controlled runtime scope; built/npm/provider receiving claims remain open. 015: 69 type cells plus construction-admitted at 24 histories plus two runtime match states reached by both initial conditions. 016: generated public consumers use one independent law; retained concrete assertions are ordinary supplemental files.

Limits. Built declarations/npm, adapter handler admission, opaque facade forms (rejected by admission), nullable QueryRef-facade runtime paths and provider/framework scheduling remain separate work. Known production type RED prevents a closure claim. No production, generated documentation, manifest dependency or lockfile repair was made; the package change only selects the test owner.

Chunk 6 reviewed test-source SHA-256 fingerprints (before later chunks):

• packages/db/tests/query/virtual-row-fields-types-oracle.test.ts: 65508306911b9c1082181cad2b7467a858a86823bc33228665f2affe5f1edfe4
• packages/db/tests/query/virtual-row-fields-grammar-oracle.ts: e9587864267256821b898d671c982dc81b3403e8fdb0ef7f20b6d96f0fb1c23b
• packages/db/tests/query/virtual-row-fields-oracle.test.ts: a2e1e963a9e365cc0ff6cfaa1223c1aacd3e1fc62aa9f5b7aea9c20dc3eaa2c8

Chunk 7 — mutation outcome versus explicit confirmation#

Law and scope. Handler Promise outcomes and source confirmation are independent. Discarded values affect neither. Query handler completion starts no fetch. Authority: accepted first-RC maintainer decisions and the optimistic-history acceptance/settlement contract. The shared pure model rebuilds one edited key and an optional peer from authored inputs. It contains no Query/SDK classifier. This chunk does not close O17's ordered/later-application paths.

Grammar, path and cuts. 78 Query +42 Electric bounded histories cross CRUD, absent/present peer, fulfilled void/legacy results, reject-before-write and reject-after-write. Only fulfilled handlers have a return-value axis; only written histories request confirmation. Query uses none/refetch/direct write; Electric uses none/explicit txid. An actual QueryClient and Electric adapter receive held provider responses. Cuts separately observe handler entry, server write, requested acknowledgement, accepted acknowledgement, the settlement waiter, final settlement, and later source confirmation for unconfirmed writes. Complete ordinary rows include an unchanged scalar and peer when present. Exact error identity, transaction state, utility outcome and real work counters are retained. Frozen settlement rows are rechecked after later confirmation.

Baseline. Unchanged production 858b174a65f160d13d01f0324c7481cc8e4eba3a. Full Query owner 253 passes; full Electric owner105 passes; shared13 controls pass. Logs chunk7-query-r2.log, chunk7-electric-r2.log, chunk7-model-r2.log. No new production RED was established by this chunk. Query/Electric package types pass (chunk7-querytypes-r2.log, chunk7-electrictypes-r2.log); lint exits0 after import-order correction (two existing warnings in the large Query owner). No production change, repair GREEN or source-mutant execution is claimed.

Reach. Every declared description cell reaches once. Query cuts: entry78, server-written72, requested-refetch24, accepted-confirmation48, settlement78, waiter78 and late-confirmation24. Electric: entry42, server-written36, requested-txid18, accepted-txid18, settlement42, waiter42 and late-confirmation18. Each local history asserts its applicable cut reach.

Calibration/review. Thirteen shared controls reject extra Query or SDK work, omitted peers, partial server replacement, changed success/failure verdicts, replaced error identity, lost accepted data, leaked optimistic rows, premature waiter state, duplicated writes and early acknowledgement. Controls first pass a legal neighbor through the same comparison. Query reviewer caught lost empty Collection margins and unconditional afterAll reach that broke unrelated replay. Peer absence restores the margins, and nested suites isolate reach. Electric reviewer caught a constant work recorder and immediate stream delivery hiding early acknowledgement. Actual SDK counters and the requested-wait cut fix both. Independent final review: Query78 +controls13; Electric42 +controls13. Logs chunk7-query-r3-independent-review.log, chunk7-electric-independent-r2.log, chunk7-shared-controls-independent-review.log, chunk7-calibration-independent-r2.log. Unrelated filtered tests pass in both packages. Reviewers named two next witnesses: post-handler external refetch application (leaked active-handler count) and rejecting ordered handlers. Those are required next-subchunk work, not waived.

ORC accounting.001–003: accepted contract, independent row recomputation, visible grammar/driver/check.004: every meaningful finite cell, empty/peer margins, CRUD and outcome ablations; returned values after throws and prewrite confirmation are excluded.005: real public Collection mutations, utility calls and waiter cuts; server facts are supplied before each claimed observation.006:13 intended wrong-observation controls.007: exhaustive finite grammar, no random obligation. 008: model retains only edited-key membership/version and outcome distinctions that change these public cuts.009: server-written combines backend write/response; source acceptance and transaction settlement remain separate.010: all gates release; verdict/Collection/client cleanup each receive an attempt and primary errors survive.011: no new shared-fault hypothesis needing a second reference; independent reviewers reconstructed post-write rejection from the acceptance law. 012:this exact-head record.013:no-confirmation versus explicit confirmation, rejection before/after write and requested/accepted neighbors.014:controlled ShapeStream boundary only, no live-provider claim.015:per-description and local cut reach above.016:shared model/check and generated receivers; calibration-only owner contains no standalone product examples.

Chunk 8 — ordered mutation outcomes and refetch after handler exit#

Law. Handler failure and accepted source confirmation remain independent through the ordered Query receiver. After every handler exits, a later public refetch again waits for its application obligation. Authority: optimistic settlement, Query explicit-refetch documentation and the wrapping-sync receipt contract. A wrapping sync may publish rows before its durable receipt settles; pending receipt and old public rows are not synonyms.

Owners/model. optimistic-ordered-refetch-oracle.test.ts recomputes the window by filtering/sorting/slicing the independent backend ledger. The existing Query ownership call-obligation ledger governs post-handler settlement, composed with checkPostHandlerRefetch's whole-snapshot and waiter checks. Neither model imports Query's handler count, result classifiers or persistence queue.

Grammar/path. Ordered: CRUD ×fulfilled void/legacy or rejection before a write/after explicit confirmation ×optional invalidation while held =24 histories. They observe immediate optimistic windows and callbacks, bounded refill, held invalidation/report, exact handler failure/state and the final ordered fixed point. The original two update/fulfilled-void traces retain invalidation head5. Insert uses head6 to avoid colliding with its local key5. Source/index/live-query acquisitions register cleanup before subsequent setup can fail. Three controls reject lost committed data, legacy-value failure and reversed order.

Post-handler: six CRUD ×fulfilled/rejected histories use a real persisted Query Collection. After its handler settles, a later refetch's actual durable commit is held, with no optimistic transaction remaining. A task boundary lets the utility process completed Query fetch work while the receipt remains held. The utility must remain pending; either whole old/new snapshot is allowed then. After release its own waiter must read the complete new rows. Three controls reject premature receipt fulfillment, partial rows and stale waiter rows.

Calibration failures repaired in the oracle. The first draft required old rows during the durable hold; source rows already publish there, so those six failures were a wrong observation/model cut, not a production defect. The next draft read pending at Query's early flag change. A reviewer removed only the handler-count decrement with a Vite in-memory transform; production files were never edited. It ran the faulty wrapper but all9 tests survived, exposing the timing gap. Keeping the receipt held through a task boundary then rejected all six histories at the intended pending-versus-resolved comparison; three controls still pass. Logs chunk8-leaked-count-mutant-independent-review.log, chunk8-leaked-count-instrumented-independent-review.log and chunk8-leaked-count-task-turn-independent-review.log. Permanent-source rerun and final reviewer verdicts follow below.

Final chunk8 evidence. Query full ownership262 +ordered27 =289 passes (chunk8-runtime-final.log). Package types and lint exit0; lint retains two existing warnings in the large ownership file. Reviewer mutation_query_review passes the permanent nine-test post-handler scope and confirms the in-memory counter mutant fails all six histories at the intended comparison, with all three controls passing (chunk8-post-handler-r3-independent-review.log, chunk8-leaked-count-r3-independent-review.log). All12 declared cut/description states reach once. Reviewed owner fingerprint: d9699cf0554bcc58bc9966be51d0b5f8c622b9f6f14e61344fce05420535029b. Reviewer mutation_ordered_review passes27 tests and the control-only selector passes3 with24 skipped. Every ordered description state reaches once; local cuts:optimistic24, fixed-point24, bounded-refill16, held-report12 and handler-confirmation18. Logs chunk8-ordered-resumed-final-review.log and chunk8-ordered-selector-resumed-review.log. Ordered fingerprint: 462f432f7b20797b8326dc50ae9feb9db177354c802c40d3aad53a46e65a493d. No further supported oracle defect remains within either bounded scope.

ORC accounting.001–003: contract authority and independent ledger/window models beside the driver/comparison.004: CRUD, before/after rejection and invalidation axes; old update witnesses retained; never returning after a throw and duplicate insert keys are excluded.005: actual Query/Collection/ persisted adapter paths, controlled backend/receipt premises supplied before the cuts.006: six wrong-observation controls plus intended in-memory counter mutant rejection; the initial survivor and false row-hiding draft are classified above.007: finite exhaustive descriptions, no random campaign requirement. 008: promise outcome/obligation state retained separately from publication; ordered expected results are stateless recomputation.009: the call ledger's application obligation includes the wrapping sync's durable receipt; an ordered final cut is its eventual fixed point, not the mutation waiter.010: release gates, attempt each cleanup, preserve original failure.011:no unresolved shared semantic-fault hypothesis requiring a second reference.012:this record at unchanged858b174a65f160d13d01f0324c7481cc8e4eba3a.013:prewrite rejection versus accepted postwrite rejection, and pending receipt versus settled receipt distinguish neighboring wrong rules.014:controlled provider/storage boundaries; no live/native provider claim.015:declared reach above.016:all regressions use the shared models; controls challenge the same checks.

Remaining bounds. Fixed two-row numeric ordered window, one handler at a time, no ordered persistence wrapper, no entire settlement callback trace, no late application rejection, and no real SQLite/provider receiving claim. The Query delay cut and ordered receiver are distinct paths; their combined arbitrary network scheduling is not established. Types remain next chunk. Production repairs remain deferred.

Chunk 9: generated public mutation-handler types#

Law and authority. The approved Query/Electric migration requires Promise handlers. Fulfilled void/undefined, rejected async work and a synchronously throwing never-returning handler are admitted. Fulfilled values and synchronous void are rejected. This law is independent of adapter types.

Grammar and receiving paths. The new DB owner mutation-handler-types-oracle.test.ts generates36 consumers: both adapters, three key domains, two scalar domains, schema absent/present and, for Query, rows/envelope select. Each consumer crosses Config annotation, explicit and inferred factories, CRUD and13 result descriptions:4,212 cells. All702 named adapter/schema/data/surface/CRUD/result states reach six histories. Positive neighbors prove each actual public source overload accepts the surrounding consumer. Invalid imports or dependency diagnostics cannot supply a rejection. Packed declarations and npm resolution remain O22.

Review repairs and calibration. Two independent oracle reviewers found missing schema/select receivers and an overly permissive diagnostic classifier. An in-memory schema-only widening survived the original1,404 cells. The expanded grammar supplies those paths. Diagnostics now owe a Promise incompatibility anchored on the CRUD property. Distinct auxiliary overload errors are allowed; exact duplicates and every diagnostic on an admitted candidate are rejected. The six permanent controls remove a rejection, duplicate one, substitute a setup code, append a positive-handler rejection, substitute unrelated same-code text, or move the actual incompatibility into the callback body.

The compiler reviewer independently passes42 tests and scans all36 descriptions: 2,592 primary diagnostics, all anchored to the intended CRUD identifiers. Its actual-compiler substitution probe replaces63 forbidden-result diagnostics per adapter with body-local Promise assignment errors while preserving the nine synchronous-void primary diagnostics. Every local error satisfies the old file/line/code/declaration/cause guards; the new handler-anchor membership check rejects them. Both the prior same-code substitution and global Promise widening are rejected. Broad Promise attempts were setup failures and are not kill evidence. Warm compiler A→B→A equals cold B, including restored handler rejections. No source production mutation was made; probes use overlays.

Results. Main42 passes in chunk9-handler-types-final.log; compiler reviewer42 passes in chunk9-handler-compiler-final-baseline.log. Additional logs: chunk9-handler-anchor-calibration.log, chunk9-all-diagnostic-anchors.log and chunk9-compiler-probes-substitution-r2.log. DB types and lint pass (r4 logs). The package oracle selector includes the owner. This chunk reports no new production defect. Product repairs remain deferred.

ORC accounting.001–003: authority, independent output/transport rule and literate visible responsibilities.004: schema/select/surface axes reconstruct public overloads; key/scalar domains keep input shapes legal; synchronous void and fulfilled value exclusions are explicit.005: actual source entry imports and retained compiler diagnostics.006: controls and executed mutants above. 007: bounded exhaustive grammar, random/replay campaigns inapplicable.008: stateless admission law.009: result descriptions are generated input facts. 010: no temporary files or acquired runtime resources; dependency diagnostics remain visible.011:no unresolved shared semantic-fault hypothesis requiring a second model.012:this versioned record at unchanged858b174a6.013:fulfilled undefined versus object, synchronous throw versus synchronous void, and schema versus absent-schema distinguish adjacent rules.014:actual TypeScript compiler; no packed-artifact handoff claim.015:702 states each6.016:every consumer and control uses the same model/check, with no isolated concrete type assertions.

Limits. Finite generated row/result descriptions and the installed compiler version. Schema transformations, arbitrary provider utility types, packed ESM/CJS declarations, npm peer resolution and application migration remain separate receiving evidence. Reviewer final receiver-specific mutant evidence is appended below when complete.

Final receiving review. handler_types_review independently passes42 tests; all702 states reach6. A Query schema+select overload-local widening passes the plain rows, plain envelope and schema rows consumers, then fails the schema envelope candidate-membership comparison. Electric's overload-local widening instead causes dependency TS2352: setup failure, no kill evidence. The global Electric widening and permanent controls retain their narrower evidence. An add-only diagnostic on an admitted handler fails independently with every negative diagnostic preserved. Logs:chunk9-handler-types-independent-review-final.log, handler-types-query-schema-select-local-mutant-r2.log, handler-types-electric-schema-local-mutant-r2.log and handler-types-final-positive-auxiliary.log. Final owner fingerprint: 59afc1991c1ffd2362922ca3e8a1ce7ee307ca3b7bc40cb05e9ffd3bad699ca3. Both reviewers find no remaining supported defect in the bounded source scope.

Chunk 10: external completion and Offline restoration#

Law and authority. Core's transaction admission permits external completion only while pending. A failed snapshot stays failed even when independently admitted Offline outbox work later succeeds. The README's per-ID settlement contract requires that outbox work to keep its own provider outcome and deletion obligation. Core rollback cancels directly overlapping pending snapshots; it does not cancel their durable provider work. Completion releases the snapshot's pending-write contribution before its settlement observer runs.

Core grammar and evidence. The outcomes owner now runs264 finite completion histories: four admission states, five absent/pending/persisting same/other-key peer kinds, four source shapes (none, target, unowned key, truncate), plus a peer-key source for distinct-key peers, each with1–3 completion attempts. The former12 histories remain prefixes. The primary model compares rows, metadata, publication cuts, immutable requests, outcomes and states after every action; tails settle independent peers and apply later source rows. Each history reaches both comparison-completed cuts once. Full owner287 passes.

Review found that external completion omitted the primary driver's waiter-time row comparison. A deferred-touch in-memory mutant survived all263 tests in the first draft. Adding the same waiter snapshot comparison used for normal settlement leaves unchanged production287 GREEN and rejects the mutant with39 intended assertion failures, including six new peer-key witnesses. Removing the pending-only admission guard fails242 tests. Failures retain the primary mismatch and distinct cleanup diagnostics through the established helper. Reviewer handler_compiler_review finds no remaining supported core defect. Logs:chunk10-core-final-independent-baseline.log, chunk10-core-final-deferred-touch.log, chunk10-completion-guard-removal.log. Fingerprints:primary model/driver e3df9fb84cbe0ca4212d8f314ddc34f9d7e9d20879db2651c056c56765028892; outcomes owner ee937b8c3191d3c827be4420e42a157d28a068a9fc2a6a6e82df940f9d33b523.

Real Offline receiver. The settlement owner expands the old four restores to60 histories:2/3 transactions, every success/failure mask, shared/disjoint width1/2 and partial-overlap chains of width2. Alternating authored field edits preserve the initial/value-edit/flag-edit snapshot law: a later flag-only snapshot carries the earlier authored value. A stateless prefix fold predicts provider-applied rows, surviving optimistic snapshots, pending keys, core restoration states, per-ID outcomes, complete calls and remaining outbox IDs. The actual executor receives serialized mutations from the real outbox encoder. Raw restore registration IDs are checked before building a lookup, preserving duplicate evidence. Every provider tail is held. Actual waiter callbacks eagerly copy ordinary rows and pending flags; later reads cannot move that cut.

Intentional provider failures may warn with their exact authored Error. Another exception cannot substitute for that allowed reason. The first draft captured console.error only and falsely passed while console.warn reported cleanup exceptions. The corrected recorder/check catches14 real failures: a successful replay calls completeWithoutCommit on a snapshot a sibling already rolled back. The per-ID waiter has resolved, and all preceding ordinary rows, pending flags, server rows, states, calls and outbox assertions agree; cleanup then throws TransactionNotPendingCommitError. Shared widths1/2 and chain width2 fail for FT, FTF,TFT,FTT; shared widths1/2 also fail for FFT. Chain FFT passes, distinguishing direct overlap cancellation from an unsupported transitive rule. All production repairs are deferred by the maintainer's instruction.

Results and reach. Final whole settlement owner:14 intended failures, 73 passes (87 total, including seven new checker controls). Scoped receiver: 14 failures,53passes,20 skipped. Of220 declared registration/settlement cuts, 214 reach once; six final cuts for shared/chain FTF/FTT are blocked by earlier RED comparisons. Those assertions stay present; no later-cut coverage is claimed. Core and Offline package types pass after correcting one test-only index-signature mismatch; lint passes with the existing dependency override mismatch warning. Logs:chunk10-offline-full.log,chunk10-restored-r4.log, chunk10-db-types-r2.log,chunk10-offline-types-r2.log,chunk10-lint-final.log.

Calibration and review. Seven controls reject extra errors/warnings, leaked pending flags, stale waiter flags, resurrected failed state, early peer success and a missing row. Reviewer handler_types_review independently reproduces the same14 RED failures and53 scoped passes. Removing only restoration touch fails pending metadata on otherwise unchanged rows, including an all-success shared history. Deferring that touch lets later reads recover but fails recorded waiter metadata, including an all-success three-transaction history. Each mutant campaign gives44failures/23passes; the all-success witnesses distinguish those mutant failures from the14 baseline product failures. An initial overlay config attempt failed setup and supplies no kill evidence. Logs: chunk10-restored-no-touch-mutant-r2.log, chunk10-restored-deferred-touch-mutant.log. Offline owner fingerprint: 83eb5551300ebb702e119174a2352c985ad6086cefa18042cc5c947c3c89e91a. No further supported oracle defect remains in this bounded receiving scope.

ORC accounting.001–003: transaction/README authority, independent prefix and primary row models, literate layers.004: old prefixes retained, repeated admission/peer/source/mask/width/overlap axes distinguish adjacent legal cases; duplicate outbox IDs, nested rollback cascades and completed source ownership are excluded by the stated grammar.005: real core calls and real Offline restore/provider/outbox paths, eager waiter/public metadata observations. 006: controls, intended comparison kills and earlier survivors classified above. 007: finite exhaustive new grammars; existing fixed/random settlement campaigns remain unchanged.008: failed core snapshot versus successful outbox work and pending versus persisting peers remain distinct.009: snapshot/provider/outbox terms stay separate.010: all gates/releases attempted, seed primary preserved, console spies restored before resource cleanup so secondary failures remain visible.011: chain histories challenge transitive cancellation; no remaining shared-fault hypothesis needs another model.012:this record on858b174a6. 013: failed versus pending admission, direct versus chain overlap and waiter versus later read distinguish wrong rules.014: actual executor receives the controlled storage/provider premises; native/provider durability remains open. 015:core264×two completed cuts; Offline214/220 as bounded above.016:all new histories and controls share models/checkers.

Limits. Core completion+touch path, one Collection,2/3 restored transactions, width1/2, unmarked whole-row insert/update records, controlled in-memory storage and provider, Node/jsdom observations. Deletes, retries, terminal phases, multicollection work, real native storage and multi-owner schedules remain separate owners. The14 reachable product counterexamples keep this class open.

Chunk 11: rejected renders and independent descriptor startup#

Source remains 858b174a65f160d13d01f0324c7481cc8e4eba3a; no production repair, generated-document edit, commit, dependency install or lockfile change. This chunk strengthens O19 and O15 at native React/Svelte boundaries.

Law and authority. A rejected preparation or uncommitted render cannot keep an independently read descriptor Collection from starting and serving its row. Releasing one descriptor's deferral cannot stop at a sibling's startup failure. Each source owns its eager/lazy start policy; the preparation rejection remains the caller's rejection. Healthy returned adapter resources clean up once. Authority is the existing source-ID/descriptor cleanup contract, the SSR guide's client-owned descriptor lifetimes, and the glossary's crash/cleanup laws.

Grammar and reach. The React source-ID owner now runs 344 release histories: applicable causes × derived/explicit-key ordinary/infinite/Suspense paths × initial mounts/rerenders × hook/preload/start/direct-subscription readers. Source-ID collision needs a prior claim, and explicit keys intentionally bypass source-ID/derived-IR rejection. Each history reaches prepared, reader-ready and source-update (344 each, 1,032 cuts). Preparation reach checks descriptor materialization, intended rejection class or exact authored error identity, and execution after the hook for authored throws/suspensions. Four checker controls reject missing/extra start, wrong value and duplicate rows.

The shared descriptor-start-release-oracle.ts judgment has 85 finite histories: zero through three acquired sources, every failed-start mask, and independently every eager-start mask, followed by a throwing factory and an unvisited tail. React's three hooks receive 255 histories; Svelte's native effect root receives 85. Each reaches rejection, independent demand and cleanup (255/85 of each, 1,020 cuts). Checks compare successful factory counts before any test demand, exact preparation failure identity, starts, complete ordinary rows/status and healthy-resource cleanup counts. References are retained across client cleanup; reacquiring a Collection would exercise restart instead of the cleanup cut.

Reconstruction includes the old two-throwing-starts-before-healthy witness. Deleting prefix length loses before/after acquisition cases. Deleting the failure mask loses the first-exception blocking distinction. Deleting independent policy masks loses mixed eager/lazy neighbors. Zero acquisition is the boundary control; a mask naming a source outside its acquired prefix is invalid. The bounded enumeration is direct replay through its parameterized test name, not a random campaign. A removed dependency-array SSR cause required usesDeps=true; every current hook supplied false. The removed API therefore contributed no executed history, and no current public behavior was retired.

Review repairs and calibration. Independent reviewers handler_compiler_review and handler_types_review found:

1. A direct-subscription reader used an empty callback and read Collection storage. A memory mutant dropping update deliveries reached 122 drops and passed all 86 subscription histories. Recording a callback-derived replica makes the same mutant fail all 86 at the updated-row comparison.
2. Boundary text alone accepted unrelated render errors. Cause-specific class or authored identity checks and after-hook execution markers now validate the intended path before reach. Replacing the preparation rejection with a later source error fails 255 React histories at the exact-error comparison; four controls pass.
3. Uniform source policies could not distinguish applying one source's policy to all siblings. Independent per-source eager masks expanded 30 to 85 histories.

A memory overlay that stops resuming after the first startup exception fails 12 React histories and 32 Svelte histories at rejection: later starts stay zero, status stays idle, and healthy rows are missing. Other cells can legitimately recover during React retries; those cells are not credited as kills. No mutant modified production files. Removing only the outer Suspense wrapper's catch survives and its injected marker is unreached: current failures occur in the shared ordinary-hook preparation first. This is an explicit limit, and the coverage map's stale blanket claim that every hook's own boundary was killed is corrected.

Results. Independent final runs pass 638 React tests (370 complete source-ID owner, 259 startup owner including four controls, nine ordinary tests) and 85 Svelte histories. Native partial-construction fault injection in the ordinary React file throws after acquiring a mount but before returning its handle. Root inventory cleanup releases its subscriber, a later cleanup still runs, and the primary/secondary Error identities survive in the AggregateError. React/Svelte typechecks, changed-file lint and diff whitespace checks pass. The existing node_modules/lockfile override mismatch is preserved.

Initial draft failures were setup mistakes, not production RED evidence: passing a callback instead of an array to cleanup; retaining a constant explicit key while changing the authored query; re-acquiring Collections after cleanup; and not catching an intentionally failing lazy start. Two scratch overlays resolved built output and never applied; they supply no kill evidence. A review run spanning the policy-field edit had transient calibration errors and is excluded. Final logs supersede these runs.

ORC outcome and limits. ORC-001–006, 008–010, 013, 015–016 have the law, independent source-fact judgment, grammar controls, public native paths, calibrations, reach and failure-preserving cleanup above. ORC-007 is inapplicable to the finite enumeration. No additional concrete shared-fault hypothesis requires a second formulation under ORC-011. ORC-014 is bounded to native React/Svelte with controlled synchronous adapters, not arbitrary provider behavior. This versioned entry supplies ORC-012. Sources throw Error values; arbitrary thrown values, provider cleanup before returning a resource handle, async startup failures, and arbitrary render schedules remain outside scope. Abandoned-render histories establish eventual release on the encountered schedules without separately measuring both reader-versus-reclamation orders. The outer Suspense catch remains unreached. No product repair/closure is claimed.

Evidence directory: /private/tmp/rc2171-oracle-challenge/. Final baseline: chunk11-final-react-independent-review.log, chunk11-final-svelte-independent-review.log, chunk11-release-r4.log. Mutants: chunk11-drop-subscription-updates-repaired.log, chunk11-stop-first-release-final-mutant.log, chunk11-stop-first-svelte-final-mutant.log, chunk11-replaced-rejection-final-mutant.log. Types/lint: chunk11-react-types-final.log, chunk11-svelte-types-final.log, chunk11-lint-final.log. Fingerprints (SHA256): source-ID owner af236fff80f7d21be7d458b0be70416ec48d08f8fb26c3f762f2f3e91a9d28a0; shared startup model c6c9bd6ab72ae057062da04f4d81be953b4387cb70950ee8add5b9c37da13add.

Chunk 12: first registration without a transported query result#

Reviewed unchanged production HEAD: 858b174a65f160d13d01f0324c7481cc8e4eba3a.

Law and paths. The approved local-declaration admission rule also applies when no query result has been preloaded or transported. First registration must retain the caller's getKey/schema claim before another same-identity caller can read or attach. Conflicts depend on supplied declarations, so a held source cannot defer their rejection until delivery. Compatible callers retain the original keys and ordinary values. The SSR guide's initial server capture stays initial until observer attachment and its microtask handoff; it is not a live server view. The shared reference judgment remains independent of cache/hash machinery.

Grammar and observations. Core now crosses 144 declaration histories with three first claimants (explicit preload, streaming observer preload and server read), five receiving paths and held/settled source delivery: 4,320 histories. Each of the 15 routes reaches 288 first registrations and 144 held deliveries. Public dehydration proves no prior query result and positive first registration. The server-first driver preloads only its source. Two admission attempts, compatible original reuse, callback-derived rows, exact keys, source updates and subscriber ownership remain checked. Removing claimant variation loses the observer registration path; removing held delivery loses conflict rejection before readiness. The finite domain includes absent/added/removed declarations and independent references; schema transformations remain excluded.

The new React cache-first-registration-oracle.test.tsx uses actual renderToPipeableStream for both ordinary and Suspense readers. Its 1,152 histories cross the same declarations with first reader, second preload/server caller and held/ready delivery. Streaming is enabled without Router transport or hydration seeds. Every raw render error is validated, including later errors after an expected conflict. Compatible reuse continues through a core observer and the next source update. The file supplies no client DOM receiving claim. Aborted renders retain the exact authored abort diagnostic and all render completion promises settle during cleanup.

Instrument repairs. Independent oracle-review agents handler_compiler_review and handler_types_review challenged the driver:

• Initial source writes shared the flat expected row objects. A mutant corrupted initial labels and left later updates distinct; both core and React retained their baseline outcomes, demonstrating a false green. All five cache drivers now write copies. The same mutant produces 4,320 core history failures (66 controls pass) and 1,152 new React failures. Previously passing compatible cells fail the authored ordinary-row comparison. Existing admission failures are not credited again as mutant kills.
• A wrongly accepted observer preload could remain pending while delivery was held, preventing cleanup. The shared checker now records promise outcome at one host-task cut before delivery. Pending and fulfilled outcomes fail there; the original rejection judgment still rejects unrelated errors. Four checker controls pass. An unconditional observer-options omission now finishes with assertion failures and releases the provider, rather than timing out.
• Focused checker selection previously ran zero histories but asserted all route reach. Execution is now recorded before each fixture starts; every executed route retains all declared-state requirements. Four selected controls and one selected complete route (288 histories) pass separately. The parent inspected this selector repair independently.

Unchanged-production results. Core: 640 intended admission failures and 3,750 passes (4,390 tests). New React first-registration receiver: 192 intended failures and 960 passes. Existing core lifecycle: 640 intended failures and 1,526 passes. Existing React cache receiver: 64 intended failures and 224 passes. Svelte cache receiver: 144 passes. These are product RED evidence, not repaired GREEN. Baseline controls and neighboring legal histories supply bounded GREEN. DB/React TypeScript and the changed-file lint implementation pass. The pnpm wrapper in one review attempted automatic install and stopped before installation; the exact lint script was then run directly. The existing override mismatch is preserved; no dependency or lockfile change was made.

Calibration. Omitting observer registration's row options adds 448 core assertion failures (1,088 fail / 3,302 pass), including 64 held observer-preload cells now rejected at the pre-delivery outcome cut. No timeout or suite error remains. React's unconditional omission adds 128 failures (320 fail / 832 pass), through held Suspense registration. A ready-only omission legitimately survives React because ready server capture establishes the claim first; it adds 192 core failures. Source mutation uses memory overlays only. Initial filtered probes with aggregate reach errors, a pnpm setup abort, unsupported mixed renderer warnings in an abandoned draft and a pre-repair hanging omission supply no intended-comparison evidence. Final runs supersede them.

Review scope. ORC-001–006, 009–010 and 013–016 are supported by the authority, independent declaration judgment, finite grammar, real paths, public cuts, calibrations, cleanup and per-route reach above. ORC-007 is inapplicable to this exhaustive finite enumeration. ORC-008 introduces no new stateful reference transition. No concrete shared semantic fault requires a second formulation under ORC-011. This append-only head-specific record supplies ORC-012. Both reviewers found no remaining supported blocker in the stated boundary. Schema transformations, arbitrary transport/concurrent schedules, Router delivery, hydrateRoot and first-registration receivers in other frameworks remain open limits. No production repair or product-class closure is claimed.

Evidence directory: /private/tmp/rc2171-oracle-challenge/. Baseline: chunk12-held-admission-route-final-review.log, chunk12-react-first-final-independent-review.log, chunk12-svelte-final.log. Controls: chunk12-held-controls-route-final-review.log, chunk12-selected-route-final-review.log. Mutants: chunk12-omit-observer-row-options-final.log, chunk12-core-initial-shared-row-mutant-before.log, chunk12-core-initial-shared-row-mutant-after.log, with equivalent React logs. Core test SHA256: 7ebf875a183111904b46d7905de3572287ccee5f28af9c7267f9969c9b7d60aa. Shared checker SHA256: 05b42da4457279807137f408d9184e8c3bd0e57fbdc636199e465895e512d7e1. React first-registration driver SHA256: 2247d32fc1e47c95136dafcf796f6c6a8dd8b93124d05b7981043156dafdd9e5.

Chunk 13: release histories, actual Changesets commands and finite replay#

Production remains unchanged at 858b174a65f160d13d01f0324c7481cc8e4eba3a. This chunk changes tests and their lint/replay instruments only.

Authority and independent judgment. CONTRIBUTING.md's Changesets/Releases policy defines first 1.0.0-rc.1, patch suffix increments, minor/major candidate increments, stable semver/latest and candidate rc tags. The stable Query minor is an explicit maintainer decision, not a rejected semver policy. The new scripts/release-history-oracle.js uses numeric tuples and an authored pending/ consumed/token ledger. It imports no Changesets planner or production version helper. A bounded workspace:* dependency model requires a patch when its exact published target changes; compatible peers retain their range. Arbitrary semver range planning is outside this model.

Version grammar and cuts. Seventy-two histories cross first/candidate-nine/ patch-nine boundaries, direct versus peer stable dependencies, minor/major precedence, insertion order and three exit forms (no pending work, stable-only, candidate-plus-stable). Each runs first seeding, standalone stable work, mixed work, no-op versioning, strongest pending bump, independent candidate work and exit. Every action compares manifests, version-attributed changelog token bags, consumed IDs, retained files, dependency protocols and private package state. No-op actions compare all fixture bytes. The real Changesets CLI supplies pre entry/exit. Fourteen first-seed failure histories cross seven failure points with both dependency profiles, then compare exact restoration and successful retry. The after-apply fault first observes generated changelog bytes, so it cannot pass by failing before those files exist.

Each version history enforces its own required cuts. The normal campaign also enforces aggregate reach: first candidate, standalone stable work, mixed work, precedence, no-op and post-exit no-op each occur 72 times; each numeric-nine boundary and exit form occurs 24 times; stable-dependent exit occurs 36 times; consumed-minor/pending-patch exit occurs 24 times. Each of the 14 failure/profile states occurs once. Removing standalone stable work loses a plan with no candidate release. Removing no-candidate exits hides synthetic exit planning. Unknown packages, reused IDs and unsupported bump values are outside the grammar.

Actual command receiver. publish-history-oracle.property.test.js invokes production publishDuringRc with its default command. A strict local pnpm shim forwards to the installed real Changesets CLI; registry info/publish shims supply only metadata and retain every raw attempt, selected tag, version, access and success. They select no tag. Forty histories cross four numeric versions, stable/only-RC/never/current histories and publish failure in either phase. Already-current versions cannot have a publish failure; those cells are excluded. Partial successful writes persist through retry. Each attempt must restore manifest/pre-state bytes. Every public fixture package must have an info request; success bags preserve duplicates and omissions while allowing independent order. All 40 histories reach registry reads/restoration; 24 reach controlled failure and retry. Twenty-eight pass the final judgment and 12 fail there as described below. Six permanent wrong-observation controls challenge multiplicity, omission, tag, version, registry and access.

Independent review repairs. handler_types_review found batched stable-only work and candidate work on every exit. The expanded grammar rejects an omitted synthetic exit plan that survived the former 36 tests. It also requested a real late write fault; removing changelog backups now fails after-apply restoration. facade_metadata_review challenged duplicate/foreign argument masking, inherited Git configuration, unknown-command lock cleanup and an overly strict command shape that disallowed a legitimate explicit tag. Strict shims now reject malformed arguments, isolate Git/npm configuration without repurposing HOME, and permit known explicit rc/latest forwarding. Six ordinary fixture controls cover this boundary. The receiver supplies command evidence, not npm HTTP or installation.

Finite replay. Registered properties scripts.release-version and scripts.release-seed-failure use the standard PROPERTY/SEED/PATH interface. PATH is one finite case index; SEED is required request identity, not a source of random cases. Direct replay runs that case and preserves its local cuts. The shared manifest points at the actual script runner. A completed finite comparison emits a truthful witness without fabricated fast-check RunDetails. Setup before comparison emits none. The wrapper preserves primary, witness and cleanup failures, including thrown undefined. Nineteen ordinary controls pass; 41 existing shared replay checks pass. Independent matching/mismatching-channel and real EISDIR probes, actual guarded replays and a wrong-family zero-execution control test the new API. These probes do not close the older standalone writer policy conflict P03, which remains recorded separately.

Lint instrument law. Canonical replay exposed a false positive: recorded numRuns: 1 was treated as a one-run random input budget. Before changing that test tool, the new scripts/eslint-plugin-oracle/replay-observation-oracle.test.js ran an independent authored-intent source model. It knows the program's role; it does not parse the generated source or reproduce the rule's AST classifier. The final grammar contains 3,848 programs and two checker controls: location, annotation, value flow, binding spelling, type-query and JSON binding axes, plus five custom-hook initializer forms at otherwise admissible recording states. All 1,924 declared states reach twice. The repaired allowance recognizes only the shared writer's typed plain-data record, exclusively serialized by standard unshadowed one-argument JSON.stringify. Actual budgets, aliases, exports, mutations, field reads, replacers and custom toJSON/prototype hooks stay reported. Type-only references and declarations do not invent runtime shadows; a hidden outer runtime shadow still matters.

Every newly exposed distinction ran RED before its tool repair: two original false positives, eight export/type-query mismatches, 32 JSON type/value mismatches and 200 custom-hook escapes. Final source owner plus ordinary pins passes 3,984 tests. A broad binding-flow bypass fails 520 comparisons; removing the plain-initializer guard fails 200. Both fail at the report comparison. The controlled premise trusts unmodified standard built-ins; this is not whole- program runtime dataflow analysis. Other serializers/destructuring/intermodule flows are outside the allowance. A calibration-only selector runs two checks; any entered source campaign still owes every declared source state. An ordinary subprocess control retains that selection behavior (bounded 16 MiB output).

Results and calibration. Version/seed: 86 pass. Publish: 34 pass (28 histories plus six controls), 12 intended tag assertion failures. In those 12 only-RC histories, real Changesets selects latest for both candidate packages; expected rc remains unchanged. This is P01, deliberately unrepaired. Fixture controls: 19 pass; shared replay: 41 pass; classifier: 3,984 pass. DB TypeScript and final changed-file oracle lint pass. Canonical hostile replays reject missing exit planning at direct-dependent path 12, missing changelog backup after application and missing local reach. Peer-only path 0 legitimately survives the exit mutant; it cannot observe a stable direct-dependent bump. Each failed canonical replay emits an exact failed:true witness. No package install, production repair, commit, push or generated-reference change occurred.

Initial attempts using an unavailable vi.getConfig, a nonexistent shared-replay config, a private selector rejected by lint, old zero-campaign reach behavior, and an undersized subprocess output buffer are setup/harness failures, not product RED or mutant kills. Earlier classifier runs with reach marked after the assertion are superseded. Runtime evidence is reused only where final source fingerprints did not change during later test-tool repairs.

ORC outcome. 001–006: explicit policy, independent ledger/source-intent model, literate layers, bounded legal grammar, actual CLI/parser paths, public file/ request/report observations and hostile calibrations above. 007 is inapplicable to exhaustive finite enumeration; canonical direct replay is nevertheless tested. 008–009: pending/consumed work and numeric counters retain distinguishable future actions; source intent is explicitly model-only. 010: exact rollback and failure-preserving cleanup/witness controls. 011: no unaddressed shared-semantic hypothesis in the declared boundary. 012: this head-specific versioned entry. 013: standalone stable work, no-pending exit, numeric 9/10 neighbors and independent registry shapes distinguish the weaker rules. 014: actual Changesets command/parser reception; npm HTTP, tarballs, installed consumers, credential services and Actions remain separate. 015: local and aggregate reach above. 016: histories and calibrations share their judgment; ordinary harness examples remain in ordinary test files. Independent reviewers found no remaining supported blocker in this bounded chunk. No product-class closure is claimed.

Evidence directory: /private/tmp/rc2171-oracle-challenge/. Runtime: chunk13-release-version-final-r7.log, chunk13-publish-final-r7.log, chunk13-fixture-final-r7.log, chunk13-shared-replay-r7.log. Classifier: chunk13-lint-observation-independent-final-r9.log. Mutants: chunk13-exit-plan-mutant-r9.log, chunk13-changelog-mutant-r8.log, chunk13-local-reach-mutant-r8.log; source-classifier RED/GREEN/mutant logs have the chunk13-lint-observation prefix. Final lint: chunk13-lint-final-r12.log; types: chunk13-db-types-final.log. SHA256 model: ad378df8f61783fbdba2d53609de5a62b1e5b0f8e0f15643753c55744c4baf8d; version runner: 79567b1d43b48d7c9d1d0125057b1056f7eb024bfe8a4456646d16f5d99b0eb3; publish runner: 512218cbed6cfdd007620a3fed1ae1ce34a303a72fa0cf5dc30ad66b960856b7; fixture: a4c3a87dd719160866d6fd2749d55996df2f4e1e40f8fadced4025c4391fcc29; classifier owner: f4e51294ebcfefc2bfdb9127dae91a5f557a75b7e1e2763635038e60fd308f4d; classifier rule: 3a8139f2c2fa1fd55291ce68ab3593dad754b14ad35e3bf9cbe367e676a9fa28.

Work remaining after chunk 13#

Production repair stays deferred. O13 now has version and actual Changesets command evidence; chunk 14 is the real loopback HTTP/npm receiving witness. Packed consumers and clean workspace/build reception remain O22. Test:release and CI wiring for the new script owners remains part of final O26 execution; the PR's existing test:lint-rules already discovers their property files.

The following boundaries still need implementation/review before the campaign can finish:

• Transforming schema retention through actual client mutations in the shared bound-options owner and React/Preact receivers (O05). Schemas do not transform synced query rows. Runtime absent/trim/uppercase probes establish the correct mutation observation. Typed live-query schema support remains an existing separately recorded limitation.
• Effect source metadata copied to ordinary selected fields, with exact batch and named delta value/previousValue ledgers (O06–O11 receiving limit). Effects have no output Collection ID. Implicit reserved Effect-root attribution is not authorized by the Collection decision.
• O12 subquery reserved-field sanitation still awaits the already-asked maintainer decision. Do not silently select a normative answer.
• O20 proxy diagnostics and actual ListsScreen/ListCard via controlled React DOM host primitives; native emulator/renderer tools are unavailable. The actual component scratch probe shows Saving absent/held/settled transitions. It supplies no native-host scheduling claim.
• O21 actual fenced mutation guidance through the shared confirmation judgment, active API consistency and diagnostic-specific snippet baselines. The actual error-handling POST retains its current intended stale-Collection RED. P02 identifies another stale current instruction.
• O22 clean frozen install/build graph, public package packing and supported/ rejected installed consumers. Inventory25 is correct. Offline lacks a local DB project edge in pnpm's closure; the lock still contains its DB link, so installation failure itself is unproven. The exact SQLite core source typecheck already fails on the Promise<{}> handler (G08).
• O23 retired exports/modes/wrappers; O24 compile-invariant work placement; O25 built diagnostics and ESM/CommonJS/public export receiving checks. Read- only inventory finds the originally cited code already removed/hoisted. Calibrated checks must preserve that evidence without inventing an all-adapter coded-message promise. Preact intentionally lacks CJS; Svelte has a distinct build layout. O26 must tie actual selected/build inputs and all remaining affected validation to exact fingerprints, and retain P03's older writer policy conflict rather than declaring the whole instrumentation class closed.

Chunk 14: actual npm/pnpm HTTP publication#

Library production remains unchanged at 858b174a65f160d13d01f0324c7481cc8e4eba3a. The release publisher is deliberately unrepaired. This chunk adds a receiving driver and fixture controls.

Law and receiving boundary. The accepted release policy and chunk 13's independent expectedPublishes ledger still require candidates on rc, stable packages on latest, and each unpublished version once. The new scripts/publish-http-oracle.property.test.js invokes the default production publisher through actual Changesets 2.29.8, npm 11.17.0 and pnpm 11.1.0. A child registry binds a loopback ephemeral port because the production command blocks its parent event loop. It supplies authored package metadata and controlled failure responses; it never chooses the client's tag. Raw GET/PUT records retain origin, attempted identity, access, tag, failure and duplicate multiplicity. The server reads each actual uploaded tarball's manifest without extracting paths and checks its name, version, byte length and digest before recording it. Requests are persisted before the HTTP response, so response receipt establishes that the recorder has the request.

Grammar and observations. Fourteen histories select candidate 1.0.0-rc.1.10 from the shared grammar. Stable, prior-RC, never-published and already-current histories cross every possible failure phase. Prior-RC and current metadata separately use an rc tag alone or an additional latest alias. This distinction matters to actual npm's default metadata lookup. Each failure history receives one controlled HTTP 400 and retries over retained successful publications. Already-current versions have no injected publication failure. Both attempts compare exact manifest/pre-state bytes before judging raw failed attempts, fulfillment, packed identities, final publication bags and registry state. Independent package order is permitted; duplicate or omitted successes are not. A failed retry is recorded before comparison, so it cannot escape as an unexamined command error.

Final measured reach: registry-read and restored each occur in all 14 histories; controlled-failure, partial-publication and retry each occur in eight. Later packed-upload occurs ten times, already-current once and compared eight times. The six intended RED histories stop at earlier violated comparisons; they do not receive credit for unreached later states. Each passing history enforces its own declared reach. Optional statistics report zeros on RED histories too, while preserving the primary error if reporting fails.

RED and neighboring results. The focused HTTP command is:

TANSTACK_DB_ORACLE_STATISTICS=1 node node_modules/vitest/vitest.mjs run \
  --config scripts/oracle-scripts.vitest.config.mjs \
  scripts/publish-http-oracle.property.test.js

It has 11 passes (eight histories and three origin controls) and six assertion failures. Three prior-RC histories with a latest alias fail the shared tag comparison: candidates use latest (P01). Three RC-only/no-latest histories fail the no-republication comparison: an already-current release, plus retries after candidate failure from prior-RC and never-published starting states, attempt to upload an existing RC and receive HTTP 409 (P05). Exact local byte restoration is checked before those failures. No library repair GREEN is claimed. The real receiving path expands the earlier shim's evidence; it does not make the shim's RC-only metadata forms equivalent to actual npm lookup.

Fixture repairs and calibration. The receiver discovers installed tools, isolates npm/Git configuration, uses fixture credentials and preserves HOME. Its disposable workspace disables pnpm's automatic dependency installation and supplies local links only for packing. An early pnpm probe attempted automatic installation against the fixture registry and failed before Changesets; it is a setup failure, not product evidence or a successful install. Initial loopback and ps EPERM results are also setup failures; final local-only runs use the necessary socket/owned-child access.

Owned process groups bound the command and include its descendants. Eight ordinary controls check successful/timeout descendant termination, executable startup failure, bounded output, primary and secondary termination errors, callback Error/undefined preservation and unsupported routes. The output control first failed because an exact 16 MiB boundary discarded later chunks and reported timeout. An independent trace then exposed repeated group signals after the first successful kill. Counting incoming bytes before truncation and making termination one-shot repair these test-tool defects. Final eight controls pass; three repeated formerly failing overflow probes also pass. The secondary-error control first ran GREEN after a concurrent helper change; no original RED is claimed for that subcase. The earlier misleading scratch filename chunk14-secondary-control-red.log contains that GREEN result.

The shared publish checker adds only an optional expected registry argument; its original fixed-origin default remains. All six existing checker controls and three new default/variable/foreign-origin controls pass. The version model is unchanged, so the 86 version/seed histories are not rerun for this parameter. Raw observed origins are never normalized to the expected origin.

Independent review and ORC outcome. facade_metadata_review independently executed the HTTP histories and fixture controls, challenged tool portability, process ownership, response/record ordering, failure fidelity and raw duplicate observation, then accepted the bounded instrument. ORC-001–006 have the policy, shared independent ledger, finite grammar, actual client/server path, full raw attempts and wrong-tag/duplicate/origin witnesses above. ORC-007 is inapplicable to this finite enumeration. ORC-008–009 retain registry versions, tags and partial success because retry distinguishes them. ORC-010 has the cleanup and diagnostic controls. No further concrete shared-model fault invokes ORC-011. This head-specific entry supplies ORC-012. ORC-013 has the RC-only/latest-alias neighbor; ORC-014 receives metadata through actual clients; ORC-015 has local measured reach. Under ORC-016, ordinary fixture controls remain separate.

Limits: four fixture packages, one candidate version, the installed tool versions, POSIX process groups and controlled HTTP responses. Tarball dependency closure, exports, installed consumer APIs, clean workspace installation, production authentication and GitHub Actions remain separate O22/O25/O26 work. No commit, push, installation workaround or generated-reference edit occurred.

Evidence directory: /private/tmp/rc2171-oracle-challenge/. Final baseline/reach: chunk14-http-baseline-final-r3.log. Independent HTTP: chunk14-http-independent-final.log. Controls: chunk14-http-fixture-controls-final-r2.log, chunk14-http-fixture-independent-r3.log, chunk14-output-bound-independent-r3.log, chunk14-checker-calibrations-r1.log. Instrument REDs: chunk14-fixture-process-controls-r1.log, chunk14-output-bound-kill-trace.log. Final lint: chunk14-lint-final-r4.log. SHA256 model: 973e20a17d2faaafb2b459eab904008b85304a7722bdf92f1fb4dd86f8292759; HTTP owner: bc919160a72f3a6ce87c24f4a929ea113febec42fac78ae349df46e6e39cf10e; fixture: 2390c87bacc10b4f948d58ec3724d01297bfb3f7d2587173f09eaa7f8c0d0dc7; registry: 5847b68adc499871b4c6958fa204fd8dc124f6d554bc02ae388d2f739f010d95; runner: e804c8674a25f8ef18a937d79208e6e592ea0f3d78dc1f4fc908b7146c969618; ordinary controls: ac3062fa2b910c769bc3553bf7e9c72b779355c9f6f582f4a6b01c2fedd8cafe.

Work remaining after chunk 14#

The HTTP release receiver above is now reviewed. Chunk 15 begins the transforming schema/client-mutation receiving extension described after chunk 13. Effect metadata, the pending O12 authority decision, actual UI/doc guidance, clean workspace and packed consumers, calibrated source/artifact checks and final exact-input validation/CI wiring remain. All library repairs stay deferred.

Chunk 15: bound schemas govern client mutations (reviewed)#

Frozen production head: 858b174a65f160d13d01f0324c7481cc8e4eba3a. Independent reviewer: handler_types_review; author: facade_lifecycle_review. No library production file changed. The schema guide's client-input contract and the maintainer's identity-retention decision authorize this receiving law: sync rows stay raw; same-identity renders retain schema/key behavior; query or queryKey replacement applies the proposed behavior to the next mutation.

The shared live-query-bound-options-oracle.ts now models all nine ordered absent/trim/uppercase schema pairs, two identity boundaries, independently same/different key proposals and two padded lowercase inputs. Its word/ASCII computation is independent of the fixture's String transformations. React live, ready-source React Suspense and Preact live each execute 72 native histories. Held updates compare immediate Collection reads, committed hook data/state and handler original/modified/changes, followed by raw synced updates, identity replacement and a further mutation. Ordinary own enumerable fields remain observable; only four virtual metadata fields are removed from this judgment.

Independent GREEN: 216 native histories and 72 shared calibration tests pass. The 72 calibrations reject 3,816 wrong observations and accept 648 permitted unordered comparisons; those are checker evidence, not native histories. All 2,592 path × history × cut reach cells execute exactly once. The twelve cuts distinguish raw initial/source/followup input, held mutations, settlement and replacement. DB, React and Preact typechecks and changed-file lint pass.

Review exposed two instrument defects. Loose equality admitted extra own undefined fields; five independent rejection probes reproduced this before strict equality repaired it. Omitting the final next-use mutation originally left the whole run green because repeated reaches collapsed into earlier cuts. Distinct followup-held/settled declarations now reject that omission, after individual assertions pass. Read-only hostile overlays that preserve configured schema references but bypass validation fail 192 immediate native value comparisons, while 24 absent-schema controls pass. Corrupting initial or later production sync inputs fails every native history at the raw-row comparison. These are intended assertion/reach failures, not setup errors or timeouts.

ORC-001–005: authority, finite bounds, literate independent model, all native receiving paths and value checkpoints are explicit. ORC-006: checker controls, validator bypass, input corruption and omission attacks reject as above. ORC-007 does not apply to this exhaustive finite grammar. ORC-008–009: binding phase is model-only and identity replacement distinguishes retained options; twelve observation cuts do not introduce a second production state machine. ORC-010: cleanup preserves failures while releasing handler gates, transactions, hosts and Collections; hostile runs exit without timeout. ORC-011: review found no remaining concrete shared-semantic-fault hypothesis in this bounded model. ORC-012: this frozen record supplies review evidence. ORC-013: all ordered schema pairs, both identity boundaries and independent key proposals distinguish wrong retention policies. ORC-014: the three real hook paths receive the same model, without broader provider claims. ORC-015: all 2,592 cells have min=max=1; live-only, Suspense-only and calibration-only selections each pass 72 tests, while a partial entered-host selection fails mandatory lane reach. ORC-016: native histories and generated calibration observations share the model and refinement checks; no fixed expectations were added to oracle files.

Limits: valid synchronous schemas, flat scalar ordinary rows, explicit string keys and mutations settled before identity replacement. Ready-source Suspense does not establish initial suspended retry. There is no SSR, concurrent-render, provider or typed-schema claim: the public schema option remains typed never. Default-getKey absence, invalid/async schemas and mutations spanning replacement remain outside this receiver. Passing bounded histories do not prove universal production correctness or finish the campaign.

Evidence directory: /private/tmp/rc2171-oracle-challenge/. Independent GREEN: chunk15-react-independent-final-r1.log, chunk15-preact-independent-final-r1.log. Author GREEN: chunk15-react-final-r1.log, chunk15-preact-final-r1.log. Controls: chunk15-react-schema-bypass-mutant-r1.log, chunk15-preact-schema-bypass-mutant-r1.log, chunk15-{react,preact}-{initial,later}-input-mutant-r1.log, chunk15-omit-followup-mutant-before-r1.log, chunk15-omit-followup-mutant-final-r2.log. Types: chunk15-{db,react-db,preact-db}-types-final-r1.log. Lint: chunk15-lint-changed-final-r1.log. Strict-undefined instrument RED/GREEN: chunk15-extra-undefined-calibration-r1.log (five failed rejection checks), chunk15-extra-undefined-calibration-r2.log (five pass). Selectors: chunk15-live-only-selection-final-r2.log, chunk15-suspense-only-selection-final-r2.log, chunk15-controls-only-selection-final-r2.log, chunk15-partial-live-selection-final-r2.log. SHA256 shared model: c6b6da5fe6bbeb0d3d6dd8e389d2825468acc7aa94ecb1ece11fb741bf85952a; support: ed4bd6bb340d8d16d64914d500e14c597f28ef124ce0439cae6d606770b81e75; React: 8d4707534b5962b8f249885b10104045869a86d9e86faf8c8e0ac289866b41c6; Preact: 97c32b831caf5e7d4c6349197e356594fffee0c0b4cfc113a479717fe3a76f0c.

Work remaining after chunk 15#

Effect metadata is the next edit chunk. Pending O12 authority, actual UI/doc guidance, clean workspace and packed consumers, calibrated source/artifact checks and exact-input validation/CI wiring remain. Library repairs stay deferred until all oracle chunks are through independent review.

Subsequent authority for O12#

The maintainer answered the pending callback-input question on 2026-10-28: strip reserved metadata fields from new projected subquery objects before downstream .fn.select(); direct source rows keep metadata and inline include values keep authored shape. The earlier pending references describe the state at their recorded review. O12 can now proceed as the next chunk after Effect metadata review. This decision changes no production file.

Pre-edit O12 inspection identified one narrower authority edge: structured whole-row spreads have an existing source-owned attribution law, although they construct an object. The maintainer has been asked whether that rule also preserves metadata at callback entry. New-shape projections, direct source returns and inline values have the decision above; spread-dependent assertions remain pending that answer.

The maintainer subsequently chose preservation for structured whole-row source spreads at callback entry. O12's authority is now complete: direct source rows and structured whole-row spreads retain genuine source metadata; own-shape projections lose reserved fields; inline values retain authored shape.

Remaining receiving plans (read-only preparation)#

These plans do not claim implemented coverage. Chunk 16 Effect metadata is currently under construction and independent review. Its first LEFT-join run exposed P09's phantom initial update; raw startup observations remain retained. The revised driver will collect cut-labelled mismatches and continue through the authored history, distinguishing exercised cuts from passing comparisons. O12 callback-input work starts only after this chunk's review finishes.

During chunk 16 review, omitting the right-source remote-followup action from both authored model and driver preserved every aggregate reach and the same 64 startup REDs. The independent read-only attack demonstrates a reach gap, not another production bug. Side-specific followup/pending/acceptance/settlement declarations and actual held-handler premises are being added before final review. Evidence: chunk16-before-side-reach-{baseline,omission}.log under the scratch directory. This is an in-progress note, not a reviewed-chunk verdict.

O21 is divided into actual mutation-fence receiving, diagnostic-specific snippet baseline checks, and active/historical guidance checks. Its read-only baseline is 802 snippets in 300 files, 252 known failures including 59 parse failures, zero new failures. The successful unconfirmed POST reproduction still lives only in scratch; the durable mutation owner currently supplies checker controls, so a real fenced receiving driver remains necessary. Shared mutation judgment must accept complete authored row shapes rather than force todo snippets into the existing numeric id/name/stable fixture. Required confirmation derives from the guidance obligation, never from whether a snippet calls refetch. P02/P04/ P06/P07 and candidate P08 remain under these checks. Authored guidance is not repaired yet.

O20 mounts actual ListsScreen and its private ListCard through a controlled ReactDOM/RN-primitive host. No native tooling is available. The old unsaved screen probe establishes feasibility only and needs retained rerun evidence. Reuse the source metadata and mutation judgment, deduplicate React runtimes, and judge Saving after delivered delay callbacks without inventing an exact 200 ms product threshold. Include fulfilled/rejected, confirmed/unconfirmed, early/delayed settlement, independent peers and next-use histories.

O22 stages a clean snapshot without node_modules/dist, attempts frozen offline installation, then actual build graph and source typechecks. Missing cache is a setup failure. Preserve the confirmed persisted-handler TS2769 and missing Offline build-graph edge separately from unproven frozen-install failure; the committed lock already links DB. Run the actual version CLI in staging only. The proposed four release cuts (RC1, RC1.1, RC2, stable) receive all 25 public tarball manifests/exports, 32 minimal installed Query/Offline runtime histories, eight declaration consumers and strict positive/negative peer installations. Installed consumers must resolve only disposable packed entries, with no source alias or DB/adapter override standing in for peer admission. Existing workspace installation and user lock/override state remain untouched.

O23–25 use calibrated, narrow source-maintenance/work checks and actual supported artifact formats. Core's coded-error law does not imply zero plain errors in all adapters. The census omits errors.ts, TSX and Svelte files, so an adapter inventory needs explicit public classes and package-aware source enumeration. Preact and Solid are ESM-only; Svelte has its distinct svelte-package output. The current minified tool's db-ivm source alias cannot prove packed-artifact reception. Fresh builds, fingerprints and bundle-input checks are required.

O26 joins all affected selections, per-path reach, exact source/build inputs and CI entry points without duplicate script-owner execution. P03's standalone recorder currently throws EISDIR before owner analysis in three of twelve real RunDetails boundary cases. Planned test-infrastructure repair separates a nonthrowing recording outcome from a caller wrapper that preserves owner failure as primary and writer failure as secondary, failing on writer-only failure. This is authorized routine harness design under ORC-010. An artificial two-body it.fails experiment does not establish a legal-owner counterexample and is not another confirmed defect. Guarded child-process witnesses remain necessary. No library repair, commit, push or dependency workaround is part of these read-only preparations.

Additional O26 instrumentation audit: chunk 16's finite owner initially inherited createOracleReach's seed/path exemption despite having no replay mode. With an unrelated seed, a partial single-source selection passed while omitting required join/union lanes. Effect now declares its finite replay policy explicitly; independent final verification is pending. The remaining campaign finite owners are being inventoried read-only for the same class, distinguishing actual direct replay from irrelevant seed inputs and wholly unentered campaigns. Evidence before repair: chunk16-independent-replay-env-selector-before.log. No library defect or repair is inferred from this test-infrastructure failure.

Chunk 16: explicit source metadata reaches Effect deltas (reviewed)#

Production head remains 858b174a65f160d13d01f0324c7481cc8e4eba3a. Author: metadata_timeline_review; independent reviewer: effect_metadata_review. No library implementation changed.

VirtualRowProps/VirtualOrigin, public DeltaEvent/EffectConfig and the Effect guide authorize the law: source metadata explicitly selected into ordinary fields reaches both actual onBatch and named callbacks, with exact values, previous values and multiplicity. No output Collection exists for an Effect; this owner assigns no implicit root metadata or Collection ID. Event keys are opaque: distinct active occurrences have distinct keys, updates retain the active key, exit retires it, and reentry may choose a fresh key. Typed source keys are independently compared through the ordinary observedKey field.

The independent model authors base rows, overlays, queued confirmations and applied origins, recomputes projected rows and differences before/after arrays. The small source judgment is shared with the existing root metadata owner; output attribution remains separate. The finite grammar executes 200 native histories: structured/functional selection, single source, LEFT join with both matched and unmatched rows, and populated unions in both branch orders. Confirmation masks, outcomes and two-source settlement orders vary independently. Held writes, accepted-but-held confirmation, each settlement, remote followups, peer exit/reentry, survivor next-use and final drain are compared. Both ledgers preserve every event and copy scalar fields before later source changes.

Independent baseline at the final freeze: 64 initial LEFT-join assertion REDs and 152 passes (136 native histories plus 16 controls). All 5,512 per-history × channel × applicable-cut reach cells execute exactly once. Of 2,756 combined checkpoint comparisons, 2,692 pass; every mismatch is at initial delivery. Each history collects cut-labelled errors and continues authored actions, so the initial defect neither disappears nor prevents later evidence. P09 is the actual startup update for a never-entered unmatched occurrence, after its load settled. No class closure or product GREEN is claimed.

Review repaired four instrument gaps with prior executed evidence. Omitting a right-source followup from both model and driver escaped aggregate reach; per-lane side cuts now fail exactly the two missing channel cells. Checker-only selection previously failed all native reach; wholly unentered native campaigns now stand aside while partial entered selections still owe every lane. A new nonempty-batch assertion rejected lawful empty partitions; it had no public authority in this owner's unconstrained partition judgment, so it was removed and replaced with permitted empty-partition controls. Finally, an unrelated replay seed disabled finite reach: eight selected histories passed before the explicit finite policy. They now fail for 5,376 missing cells, while seeded checker-only selection passes all 16 controls. Invalid seed/path invocations without required property selection were setup failures, not rejection evidence.

Five deliberately wrong production overlays change named dispatch, substitute current for previous value, duplicate delayed events, collide active keys, or add an own undefined field. Each adds intended comparison failures in all 200 native histories; all 16 controls pass. The joined baseline RED is distinguished from the added mutant violations. Lawful opaque-key renaming, fresh reentry keys and empty partitions preserve exactly the baseline result. No production file was changed for these overlays. Existing root metadata coverage remains 1,604/1,604 GREEN after extraction; six ordinary regression/cleanup controls pass. DB TypeScript and scoped ESLint exit zero; ESLint retains two existing require-await warnings in the root owner.

ORC-001–006: sourced bounded law, independent recomputation, literate layers, exhaustive legal grammar, actual callback receiving paths and calibrated wrong observations/overlays. ORC-007 is inapplicable to finite enumeration. ORC-008: settlement distinguishes base/overlay/confirmation/origin; no production queue is reconstructed. ORC-009: source/public delta vocabulary and opaque active intervals are explicit. ORC-010: cut and later driver errors remain aggregated; copied ledgers and shared failure-preserving cleanup retain the first mismatch. ORC-011: no further concrete shared-semantic-fault hypothesis remained in scope. ORC-012: this frozen independent review record. ORC-013: confirmation/outcome neighbors, typed 1/"1", both settlement orders and exit/reentry distinguish the law. ORC-014: controlled eager core sources only, no real-provider claim. ORC-015: all 5,512 cells reach once, source/partial/seeded selector attacks and unentered controls above. ORC-016: generated histories and calibration observations use the same independent judgment, without fixed product expected answers.

Limits: flat scalar projections, eager controlled sources, one persisting mutation per source, and the named single/LEFT-join/populated-union paths. No arbitrary provider scheduling, frameworks, ordered repair, same-source overlap, callback-input sanitization or exact internal graph-run callback-count claim follows. P09 stays open for the later production-repair phase.

Final evidence under /private/tmp/rc2171-oracle-challenge/: chunk16-independent-baseline-final-r3.log, chunk16-independent-reach-final-r3.json, chunk16-independent-replay-env-selector-before.log, chunk16-independent-replay-env-selector-after-r3.log, chunk16-independent-replay-env-checker-r3.log. The chunk16-independent-*-final-r2.log overlays remain applicable: the only later source difference is the explicit finite reach option/comment; model, driver, recorder and comparisons are unchanged. Earlier gap evidence: chunk16-before-side-reach-{baseline,omission}.log, chunk16-independent-checker-selector-before.log, chunk16-independent-empty-partition-before.log, chunk16-one-lane-omission-after.log. Author checks: chunk16-{effect,eslint,typecheck}-final.log, chunk16-root-extraction-r2.log, chunk16-ordinary-controls.log. SHA256 Effect owner: 4b738962e30f2b0f55b1894bab1f76334da8d66e6001773bbe24599408bb6130; source judgment: d60c483456f6d222060976ebd10dd68ddbb9481c685f785f7a36e0c82ec1f80f; root owner: c925791e375f2f2a0941e0ab35b965cabe89570fb13a981b14826b874eaca98f.

Work remaining after chunk 16#

O12's callback-input metadata law now has full maintainer authority and is the next edit chunk. Actual guidance and example UI, clean installed/packed consumers, source/work/artifact checks, final exact-input validation/CI wiring and the broader finite-reach/P03 instrumentation work remain. The read-only finite audit has already reconstructed the seed bypass in Preact; its wider inventory belongs to O26, without erasing prior normal-run evidence. All library production repairs remain deferred until every oracle chunk is through.

The read-only finite inventory is preserved in 2026-10-28-pr-2171-finite-reach-inventory.md with 19 source fingerprints: 28 default-policy sites need examination/repair; five other files have explicit policies, including genuine release replay, and must not be sweep-changed. Only Preact's irrelevant-seed bypass has an executed receiving witness so far; the other rows are source inspection, not independently executed failures. Exact-final-hash chunk 16 type/lint logs are chunk16-typecheck-final-r2.log and chunk16-eslint-final-r2.log.

Read-only O21a refinement: parameterize the existing mutation judgment with complete before/optimistic/confirmed/peer rows, retaining numeric defaults and existing callers. Actual handlers use string todo IDs and text/completed or product fields; no field-dropping projection into name/stable is acceptable. The proposed receiving inventory is 18 fences, 30 current handler ASTs (21 Query, nine Electric), plus three explicitly negative Before/WRONG examples. Three collaborator outcomes and peer absence/presence give 186 histories (130 Query, 56 Electric); negative examples use only successful collaborators. This is exact-handler reception through real adapters, not full schema/query/component execution. It must retain the successful unconfirmed POST RED and rerun all unchanged default adapter/ordered/post-handler evidence after generalization.

Independent pre-edit O21a review identified a necessary distinction: the old reject-after-write histories reject after confirmation acceptance, while an API collaborator can commit and reject before returning to its handler. The latter never reaches the handler's later refetch/acknowledgement, so its settled Collection may correctly retain the old base even though server data changed. Confirmation intent and independently authored confirmation acceptance must be separate. Preserve old default histories and the unconfirmed-success RED; do not infer either promise from observed utility calls.

Chunk 17: metadata is correct before functional callbacks (reviewed)#

Production executable baseline: 858b174a65f160d13d01f0324c7481cc8e4eba3a. Author: metadata_types_review; independent reviewer: handler_types_review. Only narrow architecture contract prose changed under src; no executable library repair, generated documentation, installation, commit or push occurred.

The two maintainer decisions authorize this law: direct source rows and structured whole-row source spreads expose genuine metadata before downstream fn.select, including when a source spread selects conflicting reserved names. Own-shape projections, including functional new objects/spreads, expose none of the four reserved fields. Nested inline values keep authored selected shape; compiled Collection-valued inputs reject before callback invocation. The architecture now states this boundary explicitly. Metadata's readable presence and value matter; genuine source metadata's own-property layout is not promised. Ordinary selected fields, including nested authored reserved names, retain strict own shape and own undefined.

The small input model uses authored source facts and the shared source metadata judgment, not compiler provenance. Thirty-three legal shape/collision descriptions cross seven consumers and two actual compiler receivers: root and correlated inline child, 462 histories. Two direct-source controls, 66 nested array/materialized preservation histories and 33 Collection-input rejections complete 563 native histories. Seventeen controls calibrate the same judgments. Typed numeric/string peers, each-name/all/no collisions and both authored pending booleans distinguish sanitizer shortcuts. QueryRefs reach depth two, with one LEFT join and both populated union positions.

Actual callback inputs are copied before returning an ordinary observed value. Every captured input must match one coherent authored before/after source row; this permits legitimate retractions without accepting old/new field mixtures. Startup joins may lack a side, but established public output is the strict after-state. Initial readiness, held successful mutation, settlement and later remote use all execute. Errors accumulate through those four cuts and are thrown inside failure-preserving cleanup. Final publication cannot erase a bad input already copied into an ordinary nested output.

Independent final result: 580 tests, 377 pass and 203 intended MetadataCallbackOracleFailure REDs, all from correlated-child receivers. Root's 231 histories, nested inline preservation, direct-source controls and Collection rejection pass. P10's leaks/spoofing remain unfixed. All 1,856 callback and 297 inline/rejection states reach their minimum once (2,153 total), including later cuts after an earlier mismatch. Valid unrelated seed/path/property inputs still run the full matrix. Seventeen checker controls pass with native campaigns unentered; the two inherited-field controls pass independently. Selecting only two native direct-source histories fails mandatory missing-matrix reach, with or without unrelated seed configuration. An invalid unknown-property selection was a setup error and is not counted as rejection evidence.

Review corrected a representation overconstraint before acceptance. Genuine metadata need not be own; the checker now compares readable presence/value. Nested authored inline fields are ordinary children data and remain strictly compared. Two durable controls reject replacing an authored nested field or an own undefined with inheritance. Independent scratch probes also reject mixed before-label/current-pending facts and verify that an initial correlated-child RED retains callback observations/reach at all four cuts. Illegal initial correlation and mixed-key ordering fixtures were repaired as setup premises, not claimed as product RED. Raw structured literal undefined remains a separate P11 investigation, not an approved normalization or a law of this model.

Existing owners remain unchanged in behavior: root metadata 1,604 GREEN, functional projection 125 GREEN, functional boundary 18 GREEN; Effect retains 152 passes/64 known P09 REDs. Whole DB test TypeScript, targeted ESLint and changed-file lint pass; two pre-existing require-await warnings remain.

ORC-001–006: explicit decisions/architecture, independent authored facts, literate layers, finite legal syntax/path grammar, real root/child callbacks, ordinary derived outputs and 17 calibrated controls plus actual P10 REDs. ORC-007 is inapplicable to bounded enumeration, with replaying:false explicit. ORC-008: complete before/after facts distinguish retractions, without a second queue model. ORC-009: callback input differs from published row; top-level metadata descriptor freedom differs from nested authored shape. ORC-010: all-cut reports and failure-preserving cleanup retain primary violations. ORC-011: no further concrete shared-semantic-fault hypothesis remained. ORC-012: this exact frozen record. ORC-013: individual/all/no collisions, booleans, source/new/inline boundaries, typed peers and four cuts distinguish the law. ORC-014: controlled core boundary only. ORC-015: all 2,153 states reach, including valid seeded/unentered/partial selection controls. ORC-016: every history/control uses the shared independent judgments, without fixed product answers. This is instrument acceptance, not closure of P10's production class.

Limits: bounded syntax/key grammar, one held successful mutation, flat inline children, QueryRef depth at most two and one LEFT join. Schemas, complex descriptors/prototypes, greater depth, other joins, same-key overlapping transactions, truncate and real provider/framework paths are outside it.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk17-independent-final-full.{json,log}, chunk17-independent-final-seed.log, chunk17-independent-final-controls.log, chunk17-independent-final-unentered.log, chunk17-independent-final-partial-seed.log, chunk17-independent-controls.{test.ts,log}. Pre-delta no-seed selector: chunk17-independent-partial-selection.log. Author current checks: chunk17-final-delta-{full,lint,types,lint-changed}.log. SHA256 model: 8ed276ebe90b678ad94ccfa83fbd76b3c0d0cbcb6e3397ffce7bd4ff6de76d1c; driver: 330d7e0084af2848aed36829f5194c000e224be72141b71a35d0971cf847d84d; runner: 817e7d63c4d560b511727f92434f2a176ba32342fd40d78adecf84a5d410d7a7; shared grammar: 301154bdaa1fe42fbd9b0f668947bac3a54f7cdb33a83cd4df7579a9f12c16c1; source judgment: d60c483456f6d222060976ebd10dd68ddbb9481c685f785f7a36e0c82ec1f80f; architecture contract: fdfa5e2adef393dfd0818d2847ce1af22d231ff513fdaa07a0c34802e3a84ecb.

Work remaining after chunk 17#

Actual mutation guidance reception (O21a) is next. P11 literal semantics has read-only evidence and needs owner/law scope and its own oracle work. Actual example UI, diagnostic/guidance consistency, clean installed/packed consumers, source/work/artifact checks and final finite-reach/P03/input-manifest/CI work remain. P09, P10 and every earlier production RED stay deferred for the later repair phase.

Chunk 18: actual authored mutation handlers (reviewed)#

Executable production baseline remains 858b174a65f160d13d01f0324c7481cc8e4eba3a. Author: handler_compiler_review; independent reviewer: mutation_electric_review. No library, guidance, generated-documentation, dependency or lockfile repair, commit or push occurred. The first pnpm exec attempted automatic dependency verification and aborted with ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY. Subsequent commands use installed Node entry points directly. Initial combined runtime/typecheck rootDir errors are setup evidence, not product failures.

Law: recommended successful handlers explicitly confirm their server changes before settlement. Legacy returned values coordinate nothing. Authority is the maintainer's explicit-confirmation decision, the optimistic acceptance/settlement owner and the current After/CORRECT guidance. An API can commit and reject before its handler reaches confirmation; that transaction may correctly settle on old Collection base. Later explicit confirmation exposes committed server data without changing the captured settlement-waiter rows. Resolved HTTP failure differs from transport rejection. Its independently specified Error kind/message is checked before comparing actual handler and transaction rejection identity.

The shared mutation model now accepts complete authored rows while preserving all original defaults. confirmationEntry: unreachable distinguishes API rejection before acknowledgement from the old rejection-after-acceptance lane. The new documentation owner supplies a separate actual-handler Promise judgment. Expected values never come from observed utility calls or Collection output. Strict ordinary rows preserve Dates and own undefined; metadata remains with its own owner. API request operands are checked and used to construct the controlled server ledger, rather than installing expected rows irrespective of the request.

Eighteen actual fences supply 30 current handlers (21 Query, nine Electric) and three explicit Before/WRONG examples. Current handlers cross success, rejection before write and rejection after server write, with absent/present peer. Four additional fetch histories resolve HTTP 503 before/after server commit with both peer states. This is 190 bounded histories: 134 Query and 56 Electric. Only exact initializer ASTs execute. Real QueryClient/Query and Electric adapters receive controlled backend/SDK collaborators. Source delivery and actual utility acceptance are separately held and observed; no missing confirmation is supplied.

Independent frozen baseline: Query 132 PASS and two intended G01 settled-row REDs; Electric 56 PASS; 43 shared/checker/ordinary support controls PASS. Query reaches 134 handler entries/API requests/settlement waiters, 90 server writes, 40 of 42 required acceptances, 32 of 34 required source holds and 48 later confirmations. G01's missing acknowledgement stages/comparisons remain zero and separately fail reach; declared intent earns no execution credit. Electric reaches 56 entries/API requests/waiters, 38 writes, 18 acceptances/holds and 20 later confirmations. The frozen waiter is checked again after later source confirmation. Default receivers still pass: Query 78 mutation plus six post-handler histories and three controls (87), Electric 42, ordered refetch 24 histories plus three controls (27).

Independent review found and repaired an instrumentation false green. An exit gate kept the transaction pending after the actual handler returned. In-memory transpile overlays removed exactly one actual refetch or awaitTxId await; both wrong handlers passed at the initial freeze with all selected reach satisfied. R3 removes that return gate and observes the actual extracted handler Promise. A Node event-loop turn drains runnable continuations while real source delivery remains held. Only the accepted asynchronous utility return is held for its accepted-before-handler-return cut. Identical omitted-await overlays now fail at confirmation-requested: actual documented handler Promise, without timeout. Removing the HTTP status guard fails its independent handler-outcome comparison. Removing await from already accepted synchronous writeUpsert and writeBatch neighbors remains permitted and passes. Await spelling is not itself a law.

Review also demonstrated an overbroad seed rejection: a valid shared seed failed before any native handler ran. R3 follows the shared configuration contract: seed 42 preserves full outcomes/reach, an own finite case plus seed 1 passes, and unrelated actual path replay skips all 134/56 cases. A partial native mutations-after selection runs six passing cases and skips 128, then fails missing declared reach equally with seed unset or 42. Exact finite selection uses TANSTACK_DB_DOCUMENTED_MUTATION_CASE; G01 replay preserves its settled mismatch. Own selector reduction and unrelated shared seeds are separate policies.

Direct bounded TypeScript, targeted ESLint and changed-file lint pass. Runtime commands use the installed Vitest entry from each package, with coverage and typecheck disabled; typechecking is a separate command. This does not claim whole-workspace type correctness. The independent reviewer checked all seven frozen SHA256 values before and after its native, selector, original-owner and overlay executions, and found no further supported instrument defect.

ORC-001–006: explicit authority, independent shared outcome/handler judgments, literate layers, bounded exact-handler grammar, real adapter cuts, full rows and executed hostile controls. ORC-007: randomized campaigns are inapplicable to this finite enumeration; own direct replay is verified. ORC-008–009: API commit, confirmation entry/acceptance, handler settlement and transaction settlement are independently distinguishable. ORC-010: exact errors, frozen waiter rows and failure-preserving all-resource cleanup. ORC-011: no further concrete shared semantic hypothesis requiring a second formulation remains after the direct handler observation repair; no universal independence claim follows. ORC-012: this versioned frozen entry. ORC-013: genuine holds reject detached confirmation, while synchronous accepted-write neighbors remain lawful. ORC-014: no real provider/host handoff is claimed beyond the controlled boundary. ORC-015: actual per-case stages and comparison counts above, including G01's unreached stages. ORC-016: fixed histories use the shared judgment; extraction/request/selector examples remain in ordinary support tests. This is instrument acceptance, not a full GREEN, readiness or production bug-class closure claim.

Limits: selected initializer ASTs, one edited key and optional peer. Full factories, schemas, query/component execution, awaitMatch/timeout guidance, concurrent handlers, persistence wrappers, durable direct-write receipt holding, live Electric/backend providers and framework scheduler cuts remain outside it. G01 stays open for the later repair phase.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk18-author-evidence-r3.md, chunk18-freeze-r3-sha256.json, chunk18-{query,electric,controls}-independent-r3.log, chunk18-original-{query-owners,electric-owner}-r3.log, chunk18-ordered-owner-r3.log, chunk18-unawaited-{query,electric}-before-r2.log, chunk18-unawaited-{query,electric}-r3.log, chunk18-http-status-guard-r3.log, chunk18-write-{upsert,batch}-neighbor-r3.log, chunk18-seed-before-query.log, chunk18-partial-query-{no-seed,seed}-r3.log, chunk18-{query,electric}-seed-r3.log, chunk18-{query,electric}-unrelated-path-r3.log, chunk18-{typecheck,eslint,lint-changed}-r3.log. Frozen file hashes:

• Shared mutation model: a521be9b638934556542837670261c1cb0eee0eae44c9912968c1add40a14e8d.
• Documentation owner: 478405dd2af4964da9c3981caa5ddaba6e792e2151c2c1c9faf6e03e53c6f0d2.
• Support driver: d35aad2629ef81d9f8ccec7226e33e85be08df00119bf838714a2d3a0bc826d7.
• Documentation controls: 450e51629ce8a885211dd35c4c1941d5e3585864053b405bf3bdc2d08254bf65.
• Ordinary support tests: 8a7778c86642d10e0fa74382b859e42ad2dd7191c52ea34624937ef95c00a85e.
• Query receiver: 86092d4b33c4640a78fe5e385ad9afcffb4fb9af9d5cc8fc66957ab2c78fbdc3.
• Electric receiver: 72ced5986b32722b9bdb2a891bd634d0e7bb8d064e72474c37aa275ba5039dbe.

Work remaining after chunk 18#

P11 now has separately supported runtime literal-preservation and public type inference findings. Its next three review gates are shared root/QueryRef runtime, same-model correlated inline array/singleton/facade receivers, and exact public type receivers. Current rejection of a broader mixed-expression array is an unresolved admission question, not authority that the input is invalid. Types judge required keys; runtime judges own properties. The corrected pre-edit inventory and evidence manifest are retained in scratch. Actual example UI, diagnostic/guidance consistency, clean installed/packed consumers, source/work/ artifact checks and O26 finite-reach/P03/input-manifest/CI work remain. Every library and guidance repair remains deferred until all oracle chunks finish.

Chunk 19: selected literal values at root and QueryRef boundaries#

Accepted after independent oracle review at unchanged production HEAD 858b174a65f160d13d01f0324c7481cc8e4eba3a. The final R2 freeze changes three files: the shared literal model, its production driver, and the existing subquery-user-value-oracle.test.ts registration owner. The independent reviewer found one conformance defect: the companion module lacked its own declaration. R2 adds only that declaration and its import. Removing those additions reconstructs the exact R1 hash; both evidence sets remain available.

Law and authority: selected null and undefined pass through, and recursive authored records preserve their selected members, including empty records. The public builder descriptions at builder/types.ts:402–437, plus the architecture's user-value and publication laws, supply this authority. Ordinary JavaScript interprets test-only data/reference descriptions. The model imports no production IR or semantic classifier. Virtual-field attribution and public type accuracy remain separate judgments.

Before edits, 48 exact emitted public query forms compiled without diagnostics. Nested omission then exposed empty-record loss. Five adjacent forms were predicted from the same recursive-record law before their addition; their 20 exact translations also compiled without diagnostics. The expanded grammar has 17 forms, two property positions and two receivers: 68 histories, each observed at initial readiness and two synchronous full-row source commits.

RED on unchanged production: 103 tests, 85 pass and 18 fail. The new histories contribute 50 passes and 18 intended assertion failures: eight P11 undefined-to-null cases and ten P12 empty-container-loss cases. The other passing tests are six existing relational histories, 24 hostile controls, four lawful controls and one grammar calibration. An independent one-row P12 witness selects only id/version references and value: {}; no raw nullish member is needed to expose the missing selected property.

Reach: all 204 receiving states and 102 QueryRef callback states execute exactly once. Root independently verified frozen hashes, reran the native owner and recomputed these counts. Eager tagged captures retain own undefined, absence, null, dense array indices/length, complete ordinary rows, event type/key/current/previous values, event-time public reads and callback inputs. All lawful later cuts are recorded before judgment, so initial REDs do not erase subsequent evidence. Cleanup diagnostics remain distinct.

The shared comparison rejects 24 wrong observations, including container loss, wrong or duplicate changes, stale previous values, mixed callback inputs and missing current callback inputs. Four positive controls preserve legal event partition, change ordering, repeated callbacks and empty startup callbacks. Independent scratch controls additionally verify immutable nested capture, root-only metadata exclusion and continuation through all cuts of an actual failing QueryRef history. Partial native selection still fails missing reach with a valid unrelated shared seed/path; calibration-only selection passes.

Strict compilation of the actual three-file authored program has zero diagnostics. It proves driver admission, not public inferred-type correctness. Targeted ESLint, formatting and scoped diff checks pass. R1 and R2 changed-file lint both pass. The final R2 hashes were verified again after lint.

ORC-001–006: authority, independent judgment, literate responsibilities, finite legal grammar, actual public receivers and executed negative/positive controls are evidenced above. ORC-007 does not apply to exhaustive finite enumeration; selection/reach behavior is checked. ORC-008–009: stateless before/after recomputation and explicitly mapped expression descriptions avoid duplicated lifecycle machinery. ORC-010: eager capture, continued lawful cuts and separate cleanup diagnostics; cleanup-fault injection remains unclaimed. ORC-011: no concrete remaining shared-semantic hypothesis requires another formulation. ORC-012: this exact R2 versioned entry and the independent audit. ORC-013: undefined/null/omission, raw/explicit/reference, pure/mixed and empty/nonempty neighbors distinguish the wrong rules. ORC-014: the claim ends at controlled core sync sources. ORC-015: all 306 declared states execute and partial campaigns fail. ORC-016: every history and calibration uses the same model/check; there are no standalone concrete type assertions.

Limits: dense finite arrays, bounded records and two source updates. Correlated arrays/singletons/facades and generated public-type receivers remain separate sequential gates. Sparse authored arrays, symbols, descriptor flags, arbitrary recursion, cleanup/restart, provider/framework scheduling and broad mixed raw-nullish/IR.Value admission are unproved. The latter admission question is not an invalid-input exclusion. All product REDs remain open; this accepts an instrument, not a production repair, GREEN result or PR readiness claim.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk19-freeze-manifest.json, chunk19-r2-freeze-manifest.json, chunk19-freeze-evidence.md, chunk19-reproduction-commands.md, chunk19-typecheck.mjs, chunk19-root-native.log, chunk19-independent-r2-{native,types,controls,partial-seed}.log, chunk19-emitted-types-preedit.log, chunk19-empty-container-types-preedit.log, chunk19-minimal-empty-record-red.log, chunk19-r1-r2-model.diff. Final frozen file hashes:

• Model: 898ef5e00aec151cbb9367dc1f8b0fe5f488b02e75f57f504dc8224b9dbdc5b6.
• Driver: 4afcf5213153c285ba9e917fffd6e44c816bf0953bdd872aced065a087e865d9.
• Registration owner: 3cb39cfb878b7bbd8682838cc1958c70dc36536c2ea0de200f2952ba18f44ebf.

Work remaining after chunk 19#

Next are same-model correlated inline array/singleton/facade receivers, followed by exact public-type receivers. The actual example UI, guidance/diagnostic consistency, clean installed/packed consumers, source/work/artifact checks and O26 finite-reach/P03/input-manifest/CI work remain. Source-inspected P13/P14 guidance conflicts join that inventory. Library and guidance repairs remain deferred until all oracle chunks finish.

Chunk 20: correlated literal receiving paths#

Accepted after independent oracle review at unchanged production HEAD 858b174a65f160d13d01f0324c7481cc8e4eba3a. Freeze manifest SHA256: df44856c6d4772f3af501cfb4a0abc82e40cc1e8605a721852a3fe2787de097b. Four new test modules supply the materialization judgment, concrete factories, production driver and campaign. The fifth frozen input is DB's package manifest, which registers the new campaign once and preserves earlier registrations. Accepted chunk 19 files remain unchanged.

The same ordinary-JavaScript literal model now receives 17 forms × two selected positions × direct/QueryRef child composition × four public materializers: toArray, array materialize, singleton materialize, and Collection-valued include. Architecture's nested-materialization/publication laws add ordered children, canonical empty values and coherent Collection-facade observations. Two parents share a populated bucket, a third has an empty bucket, and two atomic full-row child updates reuse the literal source states. The existing facade interval judgment checks handle identity; it is not reimplemented here.

Exact public queries compiled before receiver edits. The first native run rejected 136 QueryRef constructions before comparison: their outer child had no correlation WHERE. Public live-query guidance at lines 1307–1323 requires the child query's own WHERE to contain the parent/child equality. This is missing premise evidence, not a literal-law RED. The revised legal query explicitly selects routeGroup, correlates it in the outer WHERE, captures that complete authored callback input and removes only that field in the actual returned JavaScript object. No recorder normalization hides it. Every revised exact form, including a later lexical rename to satisfy lint, compiled before factory edits.

Native result: 305 tests, 233 pass and 72 intended assertion REDs. The 272 main histories supply 200 passes and 72 failures exposing the same P11/P12 literal defects through all four materializers and both child compositions. All 3,264 declared path × cut states execute exactly once, including public rows, root events, legal functional inputs and facade events/identity/empty readiness. No driver-execution failures remain. Independent native and unrelated seed-123 runs match. Root separately verifies all five hashes and reproduces the 72/233 result and 272 distinct main titles.

Every observation retains complete ordinary rows, ordered inline values and facade layouts, event type/key/current/previous values, callback-time root and facade snapshots, authored callback inputs and retained inline values. Facade handles in old parent payloads remain live; inline snapshots remain immutable. All lawful later cuts run before judgment, preserving the first mismatch and distinct execution/cleanup diagnostics. No compiled Collection-valued include enters a parent functional callback.

Review repaired three instrumentation boundaries. Facade rows and event-time layouts now use ordered comparison, so bag equality cannot hide reversal. Startup callback inputs may have the canonical empty child value before the initial snapshot arrives; each complete current parent must still be consumed by readiness. This prospective correction follows the architecture, with old and new predictions recorded before editing; the native run already passed that facet. After readiness, atomic before/after comparisons remain strict. One initial startup calibration mutated an aliased public array. Those runs are preserved but excluded from RED evidence; the corrected isolated callback control rejects three inputs under the copied old checker and passes under the corrected law. Wrong partial/mixed startup inputs still fail.

Vitest's formatted table labels also truncated distinct cells into duplicate names: the first JSON has 272 main histories but 221 unique names. Literal titles now preserve all 272 IDs. Exact failing and benign selectors each enter one intended cell; even a passing selected cell fails mandatory missing-matrix reach. Calibration-only selections enter no campaign, and unrelated seeds do not waive reach. O26 separately inventories similar title-identification gaps in older accepted campaigns without retracting their normal reach evidence.

All 29 hostile wrong-observation controls and four lawful controls pass. These are checker calibrations, not production mutants. Six independent scratch controls isolate facade layout, previous event values, startup callback freedom, complete ready inputs, mixed/routing-field corruption and continuation of an actual failing singleton. They verify intended violation names and unchanged unrelated public facets. The reviewer source-audited all shipped attacks for calibration alias leakage. Strict authored-program TypeScript compilation has zero diagnostics; targeted lint, formatting and scoped diff checks pass. The existing installed-dependency mismatch remains unchanged.

ORC-001–006: public authority, independent literal/materialization judgment, literate responsibilities, exact legal grammar, actual receiving paths and isolated negative/positive controls. ORC-007 is inapplicable to exhaustive finite syntax; exact selection/reach is verified. ORC-008: stateless recomputation plus the existing facade interval model. ORC-009: explicit data-description and routing-field mappings. ORC-010: eager captures, all-cut continuation and distinct cleanup diagnostics; cleanup-fault injection remains unclaimed. ORC-011: no concrete remaining shared-semantic hypothesis requires a second formulation. ORC-012: this exact frozen record and independent audit. ORC-013: empty/full, ordered/reversed, literal/carrier and startup/ready neighbors distinguish the wrong rules. ORC-014: controlled eager sources only. ORC-015: all 3,264 states execute once and partial selections fail. ORC-016: all histories and calibrations use shared judgments, without standalone expected product rows.

Limits: finite dense values, fixed routes, eager controlled sources and two atomic child updates. Providers, framework schedules, arbitrary recursion, descriptors, metadata attribution, optimistic histories and route churn remain outside this slice. Public inferred-type accuracy is the next gate. All 72 production REDs remain open; instrument acceptance is not a GREEN repair or PR readiness claim.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk20-freeze.json, chunk20-preedit{,-v2,-v3}-inventory.json, chunk20-native-first.{log,json}, chunk20-native-final.{log,json}, chunk20-root-native.{log,json}, chunk20-independent-*, chunk20-exact-selection.{log,json}, chunk20-unrelated-seed.log, chunk20-startup-prediction-before.json, chunk20-startup-control-{before,after}.log, retained chunk20-startup-control-aliased-{before,after}.log, chunk20-root-title-collision-before.json, chunk20-root-order-control-after.log, chunk20-runner-registration.diff, and chunk20-types-final.log. Frozen artifact hashes:

• Model: 87b11a0f33f7d6da215470c0a1e2d331484463735a8e974698e5d95ca9bf954d.
• Factories: c0dc046789b30179a43d3e7bb9405b232709a47611e7c214826e14ac4d60ca70.
• Driver: 36dacf502763f264a57e9e3e7c4d9a241c450437e2d13088b8c135a9d8cc0b86.
• Campaign: 17c701f2c31bfa74888777e817e5357d87b16413228c8ebc30adc3fac3153f7c.
• Package input: 8838fe02c99c58b51535823e3f3e565fa61e2a2433d89d239dde7636ae8ffb57.

Work remaining after chunk 20#

Next is the generated public-type slice for the exact accepted standalone and correlated syntax. Actual example UI, diagnostics/guidance consistency, P14's swallowed source-health call outcome, clean installed/packed consumers, source/work/artifact checks, and O26 finite-reach/replay/input-manifest/CI work remain. The O21 plan preserves historical diagnostic-baseline reconstruction: today's errors cannot be automatically adopted through old file/hash waivers. Library and guidance repairs remain deferred until all oracle chunks finish.

Chunk 21: exact source-public literal type receivers#

Authored and frozen for independent review at unchanged executable-library HEAD 858b174a65f160d13d01f0324c7481cc8e4eba3a. This entry does not claim independent acceptance. Three new test files supply an independent recursive type law, compiler/source driver and finite campaign. Accepted chunk 19/20 runtime inputs and DB's package manifest remain unchanged.

Law and authority. The public ResultTypeFromSelect documentation at builder/types.ts:402–437 promises exact null/undefined, extracted reference values and recursive selected records. The live-query guide's select and virtual properties sections distinguish selected ordinary values from the separate public-output virtual layer. Architecture's nested-materialization and callback input laws supply array, absent singleton, Collection and strict own-shape callback boundaries. The model imports authored history descriptions, with no production conditional-type, IR-classifier or projection helper. Primitive literal widening remains permitted within its kind; {} means an empty declared static surface, not an exact empty runtime inhabitant set.

Paths and reach. The campaign extracts the accepted runtime AST expressions into 68 standalone and 272 correlated concrete modules. Query syntax is guarded against semantic drift. Actual callback inputs are marked before the real consume call and routing-field destructuring. Each module receives actual QueryResult and inferred Collection-row types; correlated paths add child, inline/singleton or public facade/get/toArray/downstream markers. There are 1,870 marker judgments and 2,550 declared syntax/admission/marker states. TypeScript 5.9.3 compiles every source without diagnostics against this checkout's public src/index.ts; strict null checks are enabled. All 2,550 states execute exactly once. All 387 test names and 340 native IDs are unique. The exact 340 sources and their fingerprints are retained in scratch evidence.

RED. The corrected native run and unrelated seed-1 run agree: 387 tests, 107 passes and 280 intended assertion failures. Of 340 native histories, 60 pass and 280 fail. Forty histories infer raw null/undefined as unknown; 272 expose forbidden contextual-input metadata or its propagation into nested inline values, with 32 overlapping. No other native mismatch category remains. Every marker comparison executes before the history reports its mismatches. These are pre-repair observations; no production change is included.

Formulation correction. The initial admission-clean run judged public QueryResult roots too strictly. Before editing that model, a retained authority note recorded old/new predictions and followed the guide's public-output promise to its source. Root and the independent reviewer approved the bounded correction before editing: exclude exactly four virtual fields at named public query-output and actual published/source Collection row roots from this ordinary-value judgment. Callback inputs and nested inline shapes remain strict. Ordinary routeGroup is required on the actual routed input and omitted only by the authored rest destructuring. Raw-nullish unknown remains RED. No metadata correctness follows from the separate-layer exclusion. Full static callback metadata coverage belongs to existing virtual-row-fields-types-oracle.test.ts; this slice adds receiving evidence for that accepted law, rather than changing product policy.

Controls and selection. All 47 controls pass: 34 compiler-recorded wrong static observations, eight AST/actual-marker-binding attacks, two lawful formatting freedoms and three native marker-isolation controls. Wrong answers include any/unknown/never, lost nullish alternatives, optional selected members, wrong containers/array mutability, facade/get loss, routing-field corruption and reserved-name leakage at strict inputs/inline children. These are checker calibrations, not production mutants. Checker-only selection passes 47 tests and leaves native reach unentered. Selecting the positive standalone zero cell passes its actual comparison but fails the mandatory missing-matrix reach, even with an unrelated shared seed; 386 tests are skipped. Exhaustive finite syntax has no seed replay waiver.

Setup failures kept separate. The first exported synthetic receiver hit TS4058 declaration portability before any intended law comparison. The current source-public inference module has an unexported synthetic wrapper; native query inference is unchanged. This repairs the test path but does not establish that exported inferred factories are unsupported. The exact repro and a handoff preserve exported factory, exported Collection, explicit declaration settings, and source versus built/installed controls for O22. An early AST printer also treated trailing commas as drift; semantic canonicalization now permits formatting while preserving ordered node kinds, names and children. Neither setup failure is counted as intended product RED.

ORC review. ORC-001–006: independent authority-derived recursive judgment, literate responsibilities, exact legal inputs, actual compiler receivers, per-marker observations and executed wrong-result controls are recorded above. ORC-004 reconstruction/ablation/range: 17 accepted forms cross root/nested positions, direct/QueryRef and all four correlated materializers. Removing each axis loses its matching callback/container obligation. AST controls reject nearby cast, carrier, routing and marker substitutions. ORC-007 is inapplicable to finite exhaustive syntax; selection/reach remains enforced. ORC-008–009: stateless static surfaces, explicit separate virtual-layer and authored routing-field abstractions, with no lifecycle state model. ORC-010: compiler diagnostics retain file/span/code and remain separate from all type judgments; no runtime cleanup or shrink path is involved. ORC-011: direct public compiler facts avoid DB helper-alias self-agreement; no remaining concrete shared-semantic hypothesis requires another model in this slice. ORC-012: this frozen entry and the pending independent audit. ORC-013: exact nullish/omission, required/optional, raw/explicit/reference, mutable/readonly/tuple and facade/inline neighbors reject wrong boundaries. ORC-014: actual installed TypeScript source-public compiler, with packed/npm receiving work explicitly deferred. ORC-015: every declared state reaches once; a partial native selection fails. ORC-016: all native and calibration judgments reuse the recursive type law, with no standalone concrete type assertions.

Limits. This checks selected declared value surfaces, property optionality, nullish alternatives and array mutability, not ordinary-record readonly modifiers or metadata correctness at excluded output roots. Empty-array element precision is unclaimed beyond no any. Broader mixed raw-nullish/IR.Value array admission remains unresolved; no rejected form is silently blessed. Runtime publication, provider/framework scheduling, arbitrary recursion and packed exports are separate owners. The 280 product REDs remain open. Production repair, GREEN result, production-mutant kill and PR readiness are unclaimed.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk21-native-r3.{json,log}, chunk21-native-seed.{json,log}, chunk21-corrected-marker-failures.json, chunk21-{compiler,reach}.json, chunk21-controls-only.{json,log}, chunk21-partial.{json,log}, chunk21-consumer-inventory.json and chunk21-consumers/, chunk21-output-vs-input-authority.md, chunk21-exported-receiver-{repro.mts,o22-handoff.md}, chunk21-metadata-type-owner-next-plan.md, chunk21-types-r3.log and chunk21-eslint-r2.log. The final freeze manifest records source and evidence hashes after formatting and changed-file lint.

Chunk 21 R2: declared record capabilities#

Independent frozen review reproduced the original native/seed/reach evidence and found a recorder defect. A callable or constructable record with no named members was recorded as an empty record. The model therefore accepted an inferred value: () => void or value: new () => {} for authored value: {}. This concerns declared static capabilities, not the empty-record inhabitant limit: the wrong type permits invocation that the selected object does not.

The original manifest, logs and exact three source files are preserved in chunk21-freeze.json and chunk21-r1-source/. Before changing the recorder or comparison, eight calibration histories add call/construct signatures to the existing empty/nonempty selected record forms at existing root/nested positions. All eight fail because the old shared judgment returns zero violations; lawful companions admit. R2 records call/construct presence with public TypeScript APIs and rejects invented signatures in the existing recursive record rule.

The R2 native campaign has 395 tests, 115 passes and the same 280 intended native REDs; its failed native test-name set exactly matches R1. All 340 consumers still admit without diagnostics, all 2,550 states execute once and all 395 titles are unique. All 55 controls pass, including 42 compiler recorder controls. Package TypeScript compilation and targeted ESLint pass. This repairs an instrument only. It changes no product behavior or expected native law, and supplies no production GREEN or closure claim. The R1 partial-selection and unrelated-seed evidence remains unchanged.

R2 evidence uses the same scratch directory: chunk21-r2-signatures-red.*, chunk21-r2-native.*, chunk21-r2-{compiler,reach}.json, chunk21-r2-{types,eslint}.log, and chunk21-r2-freeze.json. Independent R2 acceptance remains pending. All prior limits and deferred owners still apply.

Independent R2 review accepted the bounded instrument at the exact frozen sources. Owned files, accepted inputs and preserved R1 snapshots match their hashes. The independent native run reproduces 395 tests: 115 pass and the same 280 native assertion REDs, with all 2,550 states once and 395 unique titles. Twenty independent compiler/AST controls pass, including both original erased signature witnesses. Strict three-file authored-program typechecking has zero diagnostics. The eight retained pre-repair controls demonstrate the old checker failed at its intended comparison. Independent evidence: chunk21-independent-r2-native.{log,json}, chunk21-independent-r2-controls.log and chunk21-independent-r2-typecheck.log. R1 full-seed, checker-only and partial selection evidence remains preserved. No supported finding remains within this bounded slice; native product REDs and all stated limits remain open. Final R2 freeze manifest SHA256: da237233542b78a0de9eb836ecbeed12b6b14c2e80f91837eb577c8813bcf0a7.

Chunk 22: publication eligibility without dist-tags#

Accepted at merged HEAD 5fa6eca05530bb9e1f4748b7c00ae60976da2808 with the publisher unchanged. The independent release ledger still defines eligibility by exact registry-version membership. Candidate uploads use rc and stable uploads use latest; partial successful uploads survive retry. Missing tags do not permit another upload. Repairing historical wrong tags is unclaimed.

The existing HTTP receiver retains all 14 histories and adds 15. New histories cross absent/stale tags with present/missing exact versions, reversed heterogeneous candidate versions and mixed current/missing packages. Later candidate failure occurs only after observing an actual successful candidate upload, independent of package order. Independent review added the exact P01 aftermath (older rc / current latest) and stable current versions without a latest tag. Invalid tags pointing at nonexistent versions remain excluded.

The real default publisher runs through npm 11.17.0, pnpm 11.1.0 and Changesets 2.29.8. The isolated HTTP registry checks first-GET facts, raw attempts, actual packed identity/digest and final registry state. Exact local restoration covers pre.json and four public fixture manifests before subsequent judgments. An early stable duplicate is compared before requiring candidate metadata; that history records candidate reach zero.

Native result: 35 tests, 21 passes / 14 intended assertion REDs. Seven reject wrong tags (P01); seven reject real duplicate attempts (P05). The old histories retain eight native passes / six REDs. Stable/candidate metadata reach is 29/28, restoration 29, completed comparison 15, packed upload 19, and controlled failure/partial success/retry 11 each. Heterogeneous versions reach eight, mixed presence four, and actual candidate-success-before-failure two. The retained raw per-history records include all unreached zeros. Sibling version, seed and command campaigns give 120 passes / 12 original tag REDs; ordinary fixture/publisher controls give 29 passes. Scoped and branch oracle lint pass.

Fresh-tool scratch hosts use an explicit node_modules link to Gate A's installed Vitest 4.1.12 tools; source/config hashes match the worktree. This is test-tool reuse, not another clean install or installed-package consumer. Gate A's 3,400 frozen source hashes remain unchanged. The initial socket EPERM is a setup failure and supplies no product evidence.

Independent reviewer facade_metadata_review accepted v2 after independently running seven new neighbors across v1/v2. They observed the stable-path pair of 409 responses before any candidate GET and the exact wrong-tag aftermath's zero-upload pass. Root verified all final source/evidence hashes and parsed 35 unique titles with the authored 21/14 split; root did not rerun the full HTTP campaign. Exact-title replay selected one stable-path RED with 34 tests unselected. Production remains unrepaired.

ORC-001–006: authority, independent ledger, literate layers, reconstruction, real HTTP comparisons and calibrated raw multiplicity are retained. ORC-007 random campaigns do not apply to this finite enumeration; actual title replay is verified. ORC-008–009: no reference state-machine change; versions, tags and uploads retain distinct meanings. ORC-010: raw primary failures and existing cleanup controls are preserved. ORC-011: no additional shared-semantic fault requiring a second model was identified. ORC-012: exact record and frozen independent audit are retained. ORC-013: target presence, absent/stale tags, stable/candidate paths, reversed versions and retained-success neighbors distinguish wrong rules. ORC-014: actual tools receive controlled HTTP facts; public npm infrastructure/authentication is unclaimed. ORC-015: mandatory per-history/path reach, including zero later reach, is measured. ORC-016: histories and calibrations reuse the shared judgment; ordinary controls remain separate.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk22-author-evidence-v2.md, chunk22-http-v2-{traces,evidence}.json, chunk22-command-neighbors-v2.json, chunk22-controls-v2.log, chunk22-independent-review-v2.md, and chunk22-root-validation.json. Final freeze SHA256: 62d27c1e152e5ce77d09ba4d863b0685370df15342fac69f2fc132db49a09a66. Independent review SHA256: e4d4a9cabdc4e8961a4785d67b948694a3384ad2e90d707d827efdc83cba8fc8. Limits remain four fixture packages, bounded versions/histories, POSIX process cleanup and controlled registry. Arbitrary topologies, public credentials, Actions, installed APIs/declarations and production GREEN/mutant closure remain unclaimed.

Chunk 23: constructive deferred-row order reach#

Accepted at merged HEAD 5fa6eca05530bb9e1f4748b7c00ae60976da2808. The SortedMap law and independent Map/full-sort model are unchanged: a row changed while still deferred sorts by its current value at the restoring read. The CI failure was reach four against minimum five, without a row mismatch.

The generated prefix places a peer, defers a distinct target, moves the target across the peer and compares the restoring read. A clear then restores the original empty starting condition before executing the entire original random suffix. Both comparator directions distinguish stale placement. All four fixed examples, random domains, seed 20260912, both 100-run budgets and the minimum five remain. Reach is credited only at a successful promised-order comparison; equal ranks, replacements, deletions, clear and unpromised order receive no credit.

Native and independent runs pass 48/48 tests: 26 oracle/calibration tests and 22 supplemental ordinary examples. Each comparator campaign reaches the changed-deferred comparison 96 times. Positive read/prune controls reach 16; negative controls reach zero. An omitted-observation challenge fails the unchanged reach obligation, separately from the product-mutant result. Exact native and in-memory eager-placement-mutant replays each execute one actual history. Native passes; the mutant fails the shared ordering comparison with current row values in stale order. Full DB test-project typechecking and direct lint pass. A pnpm freshness-triggered install attempt aborted and supplies no lint evidence.

Independent reviewer metadata_timeline_review accepted the frozen oracle SHA256 0c56bb680efba1fa1c66ec5d0da02716324f12d9383159a2321adced2a375754. Root verified the saved source, evidence and scratch-config hashes and the 48-pass native report; root did not rerun the campaign. Production is unchanged. The 3,400 Gate A source files remain intact. Evidence under /private/tmp/rc2171-oracle-challenge/: chunk23-author-evidence.md, chunk23-independent-review.md, chunk23-freeze.json and chunk23-root-validation.json. Freeze SHA256: 9f9df6df1cd9da3e592d3aa6e44c2bc9674f2f4138fa4366a1ef8c1e3c670406. Independent review SHA256: fe53302e71ef0d1f6e9d902295eb3f56c1aceccf2e3faf2ada66b38dbd7a5bd5.

ORC-001–006 retain the accepted authority, independent model, literate layers, unchanged suffix grammar, actual read and mutant comparison. ORC-007 retains fixed/random parity and verified direct replay. ORC-008–010 concern reach-only bookkeeping and preserve primary failure identity. ORC-011 has no new named shared semantic fault requiring another formulation. This exact record supplies ORC-012. ORC-013–016 have the crossing-rank distinction, unchanged internal receiving scope, measured reach and separate ordinary examples. No replay of the original CI random history is claimed because its seed/path was not saved. Other reach states remain sampled. Existing key, comparator and mutation-during- iteration limits remain; no public Collection or provider expansion follows.

Chunk 24 — declared ordinary metadata type receivers#

Author freeze on merged head 5fa6eca05530bb9e1f4748b7c00ae60976da2808. Independent review is pending. Production is unchanged.

The existing public metadata type owner now imports the receiver-types oracle and native compiler support. Its original 24 source-description campaigns remain. The separate chunk-21 owner and its 374 strict callback/parent markers remain byte-identical. This extension enumerates 34 context families over those same 24 source descriptions: 14 recursive callbacks, 16 direct/QueryRef child materializers and four source-row positive neighbors, for 816 receiving pairs.

The declared ordinary shape has required id, scalar, selected payload and routeGroup members. An optional source profile yields a required selected value that permits undefined. The nested ordinary record deliberately uses all four reserved field names with ordinary source-derived types. The child callback observes its real input before removing routeGroup with rest destructuring. Inline parents observe the resulting child values before publication. Compiled Collection-valued includes stay outside parent functional callbacks. Their published facade row, get, downstream callback, QueryResult and Collection receivers supply separate positive observations.

• Law: ARCHITECTURE.md's reserved-public-field callback law requires own-shape selected inputs to remain ordinary before user JavaScript. Its nested materialization law preserves inline shape and publishes Collection metadata at facade boundaries. The existing public type law supplies readonly virtual fields, union members, ordinary property modifiers and nullable get results.
• Reach: all 816 consumers admit with zero diagnostics. The independent signature law judges 4,608 actual type markers. All 6,240 declared syntax/admission/marker states execute exactly once. The finite policy is explicit: an entered subset owes the entire receiving matrix; unrelated seed settings waive none; controls-only selection enters no native matrix.
• RED: unchanged production has 684 failing new histories: 672 expose the ordinary callback/parent/inline metadata leak, and 12 expose loss of discriminant-specific ordinary fields through structured source spreads. The other 132 histories pass. The original 24 native campaigns remain RED. A full run has 882 distinct titles: 174 pass and 708 intended native REDs.
• GREEN: all 42 compiler/checker/AST controls pass, as does strict checking of the three authored files and targeted oracle lint. Targeted ESLint has zero errors and one existing require-await warning in the legacy construction helper. No repaired-production GREEN is claimed.
• Mutant: wrong observations pass source admission but fail the same independent judgment for fabricated input metadata, lost source metadata, nested ordinary reserved fields, routing fields, readonly/optional modifiers, wrong singleton/array/facade containers and missing absence. AST controls reject model-rebound or late markers, wrong rest bindings and forced callback, query or result inference. These are checker/syntax controls, not a production mutation campaign.
• Limits: the new functions are compiled rather than invoked. Runtime callback ownership remains with the existing metadata input owner. This does not establish built declarations, npm resolution, provider/framework timing, arbitrary recursion or exact allocation provenance for opaque equal-typed callbacks. No production repair or bug-class closure is claimed.

The static allocation limitation was executed separately before this edit. A cast-free annotated callback returning its source row and one returning Object.assign({}, row) have equal callback signatures, returned public query and output types, downstream input types and downstream query types under TypeScript 5.9.3, with zero diagnostics. That evidence prevents opposite static expectations based only on syntax known to the generator. It grants no exception for the 374 existing knowable ordinary-shape markers, and changes no runtime law. Top-level reserved-name collisions also retain their explicitly recorded static provenance limit.

Author tools are borrowed from the fresh Gate-A installation through symlinks, without installs or dependency/version changes. Initial author runs inherited Vite's package-local .vite/vitest cache, and configuration bundling could use .vite-temp through those symlinks. That prevents a no-cache-write claim. All 3,400 frozen Gate-A source files and critical module, lock and executable digests remain unchanged. The final author configuration uses a separate scratch cacheDir and the runner config loader. Shared caches were not cleaned up.

The reproducible host is /private/tmp/rc2171-oracle-challenge/chunk24-host. From its packages/db directory, the full native command is:

TANSTACK_DB_ORACLE_STATISTICS=1 node ../../node_modules/vitest/vitest.mjs run --config ../../chunk24.config.mts --configLoader runner tests/query/virtual-row-fields-types-oracle.test.ts

The source/host/input/result hashes and exact reporter commands are preserved in /private/tmp/rc2171-oracle-challenge/chunk24-freeze.json. The actual 24 generated modules and 816 marker descriptions are retained alongside that manifest. The prior rejected optional-source-root fixture and its TS2769 diagnostics remain in the R2 artifacts. A legal LEFT-joined callback receives undefined at absence; it now returns an ordinary record containing that optional selected value, rather than attempting to publish undefined as a root row. Those admission errors are separate from the intended native type-law REDs above.

ORC-001–006: authority, independent declared type signatures, literate layers, bounded grammar and admission, actual unannotated markers and sensitive controls are present. Each source/API/receiver dimension supplies a named distinction; removing union sources loses the 12 spread counterexamples, and removing nested reserved fields loses the recursive ordinary-name boundary. ORC-007 and ORC-008 are inapplicable to this exhaustive stateless grammar. ORC-009 uses Collection, QueryRef, facade, input and publication as defined in the glossary; context-family is only a source-grammar grouping. ORC-010 preserves admission diagnostics before law comparisons and does not allocate runtime resources; the original runtime construction cleanup remains intact. ORC-011 adds no speculative second semantic model; the equal-type experiment records the concrete inference limitation. ORC-012 uses this versioned record and exact frozen artifacts. ORC-013 pairs ordinary pre-publication input with genuine source and published-facade metadata, and checks nested ordinary names and rest removal. ORC-014 makes no provider or runtime handoff claim. ORC-015 measures every finite receiving state, including partial/unrelated-seed rejection. ORC-016 keeps all native inputs and hostile observations on the shared generated signature judgment; supplemental concrete helper tests remain in their ordinary files.

Chunk 24 R2 — retain the actual functional callback boundary#

Independent review found a recorder gap in the R1 syntax guard. Moving the whole callbackInput marker stanza into an unannotated map helper could reconstruct a clean ordinary record from the real input. The real fn.select input still had unwanted metadata, but the displaced source admitted without diagnostics and all four type judgments passed. The syntax guard also accepted it. The retained reviewer script and result are chunk24-independent-bindings.mjs and chunk24-independent-bindings-result.json in the scratch evidence directory.

The new shared-grammar calibration first failed against the unchanged R1 guard: chunk24-r2-helper-red.json records its single intended assertion RED. Source admission and all type judgments succeeded first; this is an observation-boundary failure rather than a type-law or setup failure. The guard now requires the containing arrow to be the actual fn.select argument. A rest declaration must also be direct in that same block. The calibration then passes, retaining its zero-diagnostic, all-type-judgments-pass premise.

The 816 native pairs, 4,608 marker laws and 6,240 finite reach states are unchanged. R1 sources were reconstructed and verified byte-for-byte against chunk24-freeze.json; chunk24-r1-source/ preserves them. The RED calibration sources are separately retained in chunk24-r2-prerepair-source/. R1 review and author evidence remain unchanged. R2 adds one checker calibration, for 43 total controls; it changes no production code or source-type expectation. The native 672 metadata-leak and 12 union-spread failures remain open. R2 hashes and final comparison results are in chunk24-r2-freeze.json; independent re-review is pending.

R2 author result: 883 unique tests, 175 pass and the same 708 intended native REDs. All 882 prior title/status pairs remain unchanged. The 43 checker/AST controls pass, all 6,240 receiving states still count one, and strict authored TypeScript plus targeted lint pass. A passing positive-only selection with an unrelated seed still fails the missing finite reach obligation. The R2 freeze SHA256 is 3ccfabf4cd7a94f7e39a2438740d9c0c01fcbde1aebceeb945d85e4b97c285bf.

Chunk 24 R2 independent acceptance#

Reviewer /root/handler_types_review independently accepted the bounded R2 scope. Its full native result has the same 883 unique titles and statuses: 175 pass, 708 intended native REDs. All 6,240 reach states count one. A controls-only run passes 43 controls with 840 native tests skipped and no unentered-matrix reach failure. A valid unrelated-seed positive-only selection passes one native history, skips 882 tests and fails the 6,234 missing-state reach obligation. An earlier malformed replay setup remains recorded without evidence credit. Strict checking of the three authored files passes.

The reviewer's exact helper relocation retains zero diagnostics and four true type judgments, but the repaired observation guard rejects its map callback. Ten additional independent compiler controls reject one wrong facet each, covering required selected and nested fields, nested null, call/construct capabilities, union fields, readonly modifiers, array any and Date extras. There is no remaining supported oracle gap within this bounded static slice. Production defects remain RED; this acceptance authorizes no runtime ownership, opaque-allocation provenance, built declaration, npm or provider/framework claim.

The final reviewer report is /private/tmp/rc2171-oracle-challenge/chunk24-independent-review.md, SHA256 8b79a8ab77f9cc5c5722b0958909cb166fcdc91288524e073310ad5b008d1ab5. The report's artifact index is chunk24-independent-review-manifest.json in that directory. It indexes independent native, controls, valid partial, reach, strict-type, helper-boundary and facet-control results. R1's accepted helper false green and R2's rejection remain separately reproducible.

The original-worktree pnpm lint:changed closeout attempt invoked pnpm's freshness install and aborted before module removal with ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY. No install completed. The exact underlying node scripts/agent-lint-feedback.mjs ran directly instead; scoped and whole-branch direct oracle lint pass. No pnpm command ran in the borrowed-tool hosts. No dependency/version workaround or generated API documentation changed.

Chunk 25: native Solid publication recording and CI import census#

Independently accepted at production HEAD 5fa6eca05530bb9e1f4748b7c00ae60976da2808, freeze SHA256 96059399e2365b02b83e2cac2e73fb792f2215c4b31df9c10f412243ee66620f. The four owned paths change only test machinery: Solid's conformance driver, the shared suite and its small publication checker, and the ordinary operator import census. No library, release-tool, dependency or generated-doc edit ran.

Law and authority. Solid's public result is a callable Accessor. The shared conformance contract and publication-log cut require settled selected rows to match the independent source/history model. Empty loading turns remain legal; earlier turns may not contain the previous source/group's IDs. The old recorder read removed .data fields, while the old subset check silently accepted the resulting undefined. This repairs the observation, without changing scheduling or query-identity policy.

RED and GREEN. Before fixing either recorder site, the stronger shared comparison gives 60 passes and two intended Solid assertion failures. Full Solid source typechecking also rejects .data and broad fixture indexing. The ordinary import census gives one obsolete-import failure and 18 passes. After invoking both Accessors, retaining literal fixture keys and removing the obsolete census entry, native Solid has 62 passes with typechecking enabled; whole-package tsc has zero diagnostics. Census/operator cases give 19 passes. The affected actual React, Preact, Vue, Svelte and Angular selections give 10, 5, 5, 5 and 3 passes respectively. Unselected scenarios receive no credit.

Reach and hostile checks. Every one of seven receiving registrations keeps all 32 source-ID histories; React registers twice. Reactive drivers each reach 32 initial and nine swapped nonempty comparisons. Pooled counters deduplicate within their one history, so independent per-target observations additionally verify both unconditional cuts in every registration: b has exact final data/state IDs [2], and a has [1,3]. Eight checker controls preserve allowed empty/loading prefixes and empty modeled results, while rejecting omitted, undefined, dropped and stale final publications and stale prefixes.

Independent in-memory effect-reader and first-turn-reader mutants fail at the shared selected-row comparison. The effect mutant fails both stories; the first-turn mutant fails source-ID swapping while pooled publication is repaired within the permitted turn. That pooled survival is not counted as a kill. Returned mounts dispose exactly once under both failures: 3/3 and 8/8. The original assertion remains primary through ScenarioLifetime. An early typed scratch observer failed transformation before tests and receives no kill credit.

Root verified all 233 source, 15 config and 50 evidence hashes before this append. The independent reviewer verified the same frozen inputs and all 3,400 Gate A source hashes plus critical tool hashes/mtimes. Exact pre-fix Solid bytes are retained; one formatting-only blank-line difference in a later reconstruction was reconciled against that original hash. Neither that reconstruction nor root's hash check substitutes for independent execution.

ORC-001–006 retain public/shared authority, independent source rows, literate layers, unchanged grammar, real receiving paths and calibrated comparisons. ORC-007–008 are inapplicable to this finite grammar with unchanged model state. ORC-009 preserves canonical binding and publication vocabulary. ORC-010 has measured primary-error and disposal fidelity. ORC-011 has no new named shared semantic fault requiring another model. This record supplies ORC-012. ORC-013 distinguishes missing/stale output from legal loading/model-empty neighbors. ORC-014 has actual framework receiving hosts with controlled source sync, without a backend/device claim. ORC-015 measures each registration and both pooled targets without lowering budgets. ORC-016 keeps the declared checker separate from ordinary driver controls.

Evidence under /private/tmp/rc2171-oracle-challenge/: chunk25-author-evidence.md, chunk25-independent-review.md, chunk25-independent-evidence.json, chunk25-independent-final-integrity.json and chunk25-root-validation.json. Independent report SHA256: 1400b016e492c5e65aa84f1622292df76a98bade26386d52e07b98dc03a5dd20. The claim remains bounded to the existing list-query cuts: no arbitrary scheduler interleavings, within-turn transients, findOne, complete status or keyed-state traces, backend/provider behavior or native-device scheduling.

Chunk 26: generated error catalog observation and command ownership#

Reviewed merged HEAD: 5fa6eca05530bb9e1f4748b7c00ae60976da2808 plus the four frozen test/support paths in chunk26-r3-freeze.json. Reviewer: /root/facade_metadata_review. This is an independent review under .agents/skills/oracle-review/SKILL.md; the rubric, glossary, coverage-map Production error messages owner, source oracle, fixture, CLI controls, command controls, actual old generator, and erasure boundary were read. No production/tooling repairs, generated-page edits, installations, commits, or pushes were performed by this reviewer.

Verdict#

ACCEPT the R3 oracle/control chunk as a bounded pre-repair gate. The named class-link comparison gap is repaired. No further finding remains inside that named gap. The old CLI and root commands still produce twelve intended assertion failures; this verdict does not claim product GREEN or authorize broader closure. Root controls repair authorization and the versioned coverage/review record.

Independent execution and provenance#

The reviewer checked670 recorded source/host/config/protected/artifact hashes against the R3 freeze: zero mismatches. The four active and host test/support paths match. All154 DB/IVM source paths match their captured bytes, both old root command bodies remain unchanged, and the protected generator, erasure implementation, full catalogs, sample arguments, census, formatter, and tracked generated errors page remain unchanged. An additional fresh check of the immutable GateA source manifest found3400 matching records and zero mismatches. GateA supplies installed test tools only; no clean-install, packed-consumer, or fresh-build credit is claimed.

From /private/tmp/rc2171-oracle-challenge/chunk26-host/packages/db, the reviewer independently ran:

TANSTACK_DB_ORACLE_STATISTICS=1 node ../../node_modules/vitest/vitest.mjs run --config ../../chunk26-db.config.mts --configLoader runner --coverage.enabled=false tests/production-error-messages-oracle.test.ts tests/generate-error-docs.test.ts tests/error-docs-commands.test.ts --reporter=default --reporter=json --outputFile=/private/tmp/rc2171-oracle-challenge/chunk26-r3-independent-native.json

Result:39tests,27PASS,12intended assertionRED. Every status matches the author's R3 run by full test name; all prior38statuses are unchanged. The17 existing runtime/class/source-census checks pass. Four shared-checker calibrations pass. CLI ordinary controls retain6PASS/9RED; controlled root invocation controls retain2RED. The actual copied old CLI exits0 and emits empty stdout, which reaches the catalog comparison and fails the missing DuplicateDbInstanceError heading. Declared reach is cli-stdout-received1/catalog-compared0; completed-comparison0 follows from the intended assertion mismatch, rather than a fixture setup failure. The test process exits1 for these assertions. Vite also prints missing Expo tsconfig warnings for unrelated example directories; all selected39tests execute, so those warnings are not credited as RED evidence.

Concrete comparison challenge and correction#

The class-link law requires an HTML ID matching each coded production-message URL. The R2 checker parsed raw Markdown as HTML. In a separate disposable copy, the reviewer moved only the first required class anchor, error-2, into the actual generator's canonical fenced text-message form. The unchanged shared checker accepted that wrong observation: the negative calibration failed with expected [Function] to throw an error. No frozen source was changed. The installed marked17 renderer independently renders that fenced anchor as escaped code with zero HTML IDs, whereas raw DOM parsing reports error-2. This is an enforcement/model-observation defect under the accepted link law, rather than a proposal for a new renderer contract.

The author retained the failing old-checker calibration before repairing the oracle. R3 excludes canonical generator text fences before class-ID extraction, retains HTML parsing for element/quote/attribute-spacing freedom, and states the bounded extraction limit beside the checker. The reviewer executed the repaired negative calibration through the same checker: PASS. The existing class-anchor calibration also executes the alternate span/single-quoted/spaced-ID positive observation and then rejects the deleted ID: PASS. Neither calibration derives expected catalog facts from renderer output.

The original missing-class-anchor acceptance is separately preserved in the author's earlier old-checker negative calibration. Both oracle repairs change only comparison/calibration logic, with original runtime/source/census laws and old tooling unchanged.

Rubric outcomes#

Limits and next evidence#

This acceptance is limited to the actual frozen catalogs, current generator source and canonical fenced-message class-ID distinction. It does not establish arbitrary Markdown layouts, full rendered-heading validation, duplicate-heading multiplicity, every prose/template byte, all possible CLI argument lists, asynchronous fixture bodies, pnpm lifecycle execution, installed-package consumers, browser host behavior, or CI/Actions execution. Existing runtime/source/census checks remain supplemental to their declared frozen-input scope. The erasure script itself remains unchanged and must later run against freshly admitted ESM/CommonJS dist while generated docs are stale. The real docs-generation/Typedoc path must later run in an isolated generation workspace, followed by generator --check. Later tooling repair still needs native GREEN and restored-old-source hostile-mutant evidence before product closure. The user prohibition on committing generated docs remains in force.

Evidence hashes#

• chunk26-r3-freeze.json: 2baf81b3904bf1f8005dee31aef2b0c7b2d46bb2b758825ee59ecffaa3fbce7f
• chunk26-r3-independent-native.json: e53c6525a97ffb73f00f7881fb9abff5ea56160a35ebd970ee616ba6168924c0
• chunk26-r3-independent-native.log: 8033eae6254b1bb62f9f333de2bee63cbf6b842d55a0f4978f59728b6304d805
• chunk26-independent-fenced-id.json: e19d6c3b0f5117f6a6740d5e1ad17930dd64670a41649a0693beb541743e0774
• chunk26-independent-fenced-id.log: 8a86ccb9dd59201e722036ee701b9fe69d072588db4eeb158504fed6d64d48fa
• chunk26-independent-fenced-renderer.json: f85c7153269d4c2bfd08641d56ea40c7150143f84ad07c6fe7df386ca3c7ffcf

Root verified 658 frozen scope/host/config/artifact hashes and 12 protected files before repair. No mismatches. The 26-chunk oracle phase is independently accepted; accepted REDs remain release repair gates or explicitly recorded follow-up scope. No executable production repair preceded this checkpoint.