# Content temporarily unavailable # PR #2171: review-to-check coverage matrix Audit head: `858b174a65f160d13d01f0324c7481cc8e4eba3a`. This is a self-review of the proposed checks, with temporary executable probes. No production repair or permanent oracle extension was made in this audit. The answer to “would the original 15 catch everything?” is **no**. The [expanded plan](2026-10-28-pr-2171-oracle-challenge.md) has 26 checks. This matrix accounts for 53 findings and four evidence caveats. Accounting is not proof that all checks intercept their targets. Known current failures keep those laws open, even though their existing narrower oracles pass. ## Laws, experiments, and remaining enforcement No law change needs a new maintainer decision. Independent cached callers reject conflicting local row options. Mounted hooks retain inline options until identity changes. Metadata follows authoring shape, with the last present structured spread winning. New functional objects receive output metadata; direct source returns retain source metadata. Inline values keep authored shape. Query and Electric ignore legacy runtime returns, and their types reject them. Query does no automatic refetch. The maintainer explicitly selected a stable Query minor and coordinated RC DB peers for the accidentally stable Query/Offline packages. | Law and authority | Existing evidence and missing boundary | Experiment on current unchanged head | Inference and enforcement destination | | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Independent same-identity callers reject conflicting getKey/schema; explicit maintainer decision | Existing admission model/drivers check preload, observer preload, subscription, and client render. Cached SSR before subscription is missing. | Core server read: three conflict assertion failures, three same-option controls pass. Actual React server render: the same three failures/three controls. | G09 is confirmed-open. O16 must extend the shared model's receiving paths before production repair. A subscription-only check is insufficient. | | A reusable local option claim survives transport replacement; same decision, hydration transports no function references | Source claims have hydration histories, but local row-option claims do not receive that lifecycle. | Newer hydration replaces a one-row preloaded result; three conflicting declarations are accepted, three compatible controls pass. | G10 is confirmed-open. O04 needs claim lifecycle histories and post-replacement admission, with local claims preserved independently of transport. | | The guide's successful write example confirms its row before optimistic settlement; explicit-confirmation migration contract | Query's generic handler owner checks confirmation, but does not execute this fenced example. Typechecking cannot detect its omitted confirmation. | Extracted successful POST handler writes one remote row; Collection has zero rows after `when('settled')`. | G01 is confirmed-open. O21 must execute the actual guidance through O17's law. No production adapter failure is alleged: its reversion follows the approved behavior. | | Rejected cache admission cannot corrupt the first claim; same cache contract | Current grammar changes both options together and ends at first admission. | Previous pass: two wrong guards survive all 144 cases; independent-option and repeated-admission comparisons reject them with 12 and 24 failures. | O01/O02 remain unimplemented test gaps. Current correct behavior passes these distinguishing probes; that does not supply SSR/hydration coverage. | The probe inputs, checkpoint construction, commands, setup failure, and logs are described in the expanded plan's follow-up experiment section. These are RED witnesses, with compatible controls. They are not repair GREEN results. ## Source inventory and evidence notation - **A01–A15:** first pasted review, preserved in the task attachment `Pasted text.txt`. Its reviewer read the worktree diff and Changesets 6.0.9, queried published manifests, and ran no tests. Original line references are retained below; that review supplied no commit SHA. - **B01–B10:** next supplied review, evaluated from `7c53f271a` in the [first versioned evaluation](2026-10-28-pr-2171-review.md). B10 has two subclaims, both retained here. - **C01–C15:** latest supplied review, targeting `0a60ad85b`; evaluated from `66454803b` with repairs in `68228aaf3`. The [second versioned evaluation](2026-10-28-pr-2171-second-review.md) records original claims, repros, mutants, and limits. C01 includes core and React paths. - **G01–G11:** seven inline comments, three outside-diff findings, and one additional prose suggestion in GitHub's two reviews. First review covers through `66454803b`; second through the audit head. Stable links identify inline comments. Outside-diff findings are in the corresponding review body. - **W01–W02:** the two warnings in the bot's [mutable walkthrough](https://github.com/TanStack/db/pull/2171#issuecomment-6196397964), inspected at the audit head. Its merge-risk summary repeats G05/G08/G09/G10; it is not another independent finding. `O01`–`O26` refer to the numbered checks in the expanded plan. Their owner, independent judgment, legal histories, cut, and distinguishing experiment are specified there. They are proposals except where the evidence explicitly says an existing owner already executes them. **Historical** means the linked evaluation records the experiment at its own head; this audit did not replay every original fault. **Source** means direct source inspection, not an executed behavior/build failure. **Current RED** means an intended assertion failed at this audit head. **Proposed** means the broader check has not run. `already-fixed` and `stale` describe the reported trace; they do not close the broader unimplemented improvements. ## A: first supplied review The source calls A01–A04 high severity. A05–A08 are release follow-ons, A09–A11 correctness findings, and A12–A15 design/cleanup/docs findings. | ID | Original claim and proposed correction | Technical disposition/evidence | Concrete check and distinguishing cut | Remaining work/durable destination | | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | A01 | `compiler/index.ts:2062`: joined source spread uses FROM metadata; right-join missing-left rows fall back to output metadata. Honor selected source. | `already-fixed` for the reported trace; historical metadata attribution repairs. | O06/O08/O10/O11: right-side source with pending write, matched/unmatched join, full four-field comparison at publication. | Complete multi-row/join-transition/facade receiving grammar; metadata owner. | | A02 | `useLiveQuery.ts:674`: getKey/schema in derived identity causes documented config to throw without queryKey; restore supported initial render and useful diagnostics. | `already-fixed`; historical real React derived-identity and retention witnesses. | O05/O19/O25/O26: initial config render without queryKey succeeds, actual identity replacement applies options, preparation errors remain coded. | Other applicable framework receivers and exact-head execution. O16 is distinct SSR admission, not evidence for this initial browser path. | | A03 | `version-packages.mjs:58`: first RC ignores stable adapters, leaving exact old DB pins and duplicate DB copies. Republish compatible adapters. | `stale` exact-pin mechanism; stable adapters now declare RC peers. Original reviewer supplied source evidence only. | O13/O22: actual first-RC inventory, pack both adapters, resolve one DB in consumer and exercise required APIs. | Real package/consumer receiving fixture; source-only manifest strings are insufficient. | | A04 | `version-packages.mjs:145`: each RC patch bumps stable adapters on latest and pins an exact RC DB; fixture omits those dependencies. | `stale` exact dependency pins; stable 1.x RC peers are now deliberate. | O13/O22: repeated patch/minor releases, packed manifests/dist-tags, no invented adapter bump, supported consumer install. | Generated release histories and actual registry-command fixture. Preserve stable-tag policy separately. | | A05 | `version-packages.mjs:208`: RC exit drops planned dependent bumps, leaving stable adapter pinned to RC. Preserve dependency updates at exit. | `stale` old exact pins; historical release-script repairs/fixed fixtures. | O13: exit after candidate/patch work; compare every packed dependency and required bump with independent plan. | Generated dependency graph, including stable dependents; release owner. | | A06 | `version-packages.mjs:194`: exit reconsumes released changesets; consumed minor plus pending patch yields wrong version and duplicate changelog. | `already-fixed` reported release path; current baseline release fixtures pass. Original-fault replay not run here. | O13: minor consumed in RC, pending patch, exit, repeated no-op; version and changelog entries exactly once. | Generated consumption ledger and changelog comparison. | | A07 | `version-packages.mjs:110`: pending mixed changeset aborts; stable-only changeset marked consumed without release. | `already-fixed` reported path; existing release fixtures. Broader sequence unrun. | O13: enter RC with mixed and stable-only work; compare releases and consumption independently. | Generalize fixed workspaces into generated release histories. | | A08 | `version-packages.mjs:87`: failure leaves rc.0 rewrites/pre.json; rerun skips setup and bumps wrong packages. Restore files on failure. | `already-fixed` reported path; release failure/retry fixture. | O13: inject failure at each mutation boundary, compare workspace restoration, retry and publish once. | Extend failure-stage grammar and registry-command receiving path. | | A09 | `useLiveQuery.ts:248`, infinite hook: failed hash after descriptor deferral strands later direct reader. Resume all deferred starts. | `already-fixed`; existing source-ID owner has rejection/release and multiple throwing-start witnesses. | O19: rejected live/Suspense/infinite preparation, then direct shared descriptor preload reaches ready/row. | Inventory partial-construction stages; preserve real-host failure/retry receiving evidence. | | A10 | `electric.ts:1210`: ignoring legacy `{ txid }` stops waiting and can flicker; reviewer favors loud rejection or old waiting. | `accepted-design` for ignored runtime returns, explicitly chosen later. Explicit acknowledgement remains required. | O17/O21: handler awaits actual acknowledgement, pending row persists until confirmation; no-ack control follows settlement law. | Adapter histories plus actual migration snippets. Never restore post-write rejection to satisfy this obsolete recommendation. | | A11 | `query.ts:4368`: retained 1.x auto-refetch contract warns removal in v1. Correct obsolete warning. | `stale`; contract intentionally changed and automatic-refetch path removed. | O21: changed API/warning/migration consistency check, successful-write behavior. | Authoritative explicit-refetch guide and removed-symbol check. | | A12 | `compiler/index.ts:409`: metadata protection only at root flag; Effects/include Collections allow reserved-name override. Enforce promised boundaries consistently. | `stale` as a blanket rule: Collection-row traces were repaired; inline values keep authored shape. The current Effect output contract needs separate inspection before imposing Collection metadata. | O10/O11/O12: source/projection collision through root, Effect, facade, callback and inline control at public boundary. | Receiving grammar must preserve the distinct inline/Effect/Collection contracts; no blanket sanitizer. | | A13 | `useLiveSuspenseQuery.ts:288`: always-string hash makes SSR throw, truthy checks and optional type dead. Remove unreachable code. | `stale`; source cleanup recorded. | O23: narrowed hash type plus actual caller/branch inventory. | Static check; runtime green cannot prove absence of dead code. | | A14 | `compiler/index.ts:2068`: attachVirtualPropsToSelected creates per-row copy closure even without copy. Hoist/remove allocation. | `stale` reported implementation; source allocation concern retained, no timing claim. | O24: compile once/process N rows; count closure creation versus needed copies. | Deterministic work/AST placement probe, semantics owner unchanged. | | A15 | `live-queries.md:37` misstates projection collectionId; migration names unexported enrichRowWithVirtualProps. Correct attribution and exported guidance. | `already-fixed` reported docs; historical evaluation/source. | O21/O25: compile actual snippet via public export; compare documented source/output cases. | Docs exports and behavior receivers. Keep internal helper out of public migration instructions. | ## B: next supplied review Original paths/lines refer to its reviewed tree. B01/B03–B08 are behavioral or compatibility findings; B09/B10 include cleanup and production-error concerns. | ID | Original claim and proposed correction | Technical disposition/evidence | Concrete check and distinguishing cut | Remaining work/durable destination | | --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | B01 | `OfflineExecutor.ts:551`: stable adapter calls RC-only completeWithoutCommit while accepting DB ^0.15; restored work can remain held. Narrow peer or avoid absent API. | `already-fixed`; historical real DB 0.15.2 capability evidence and manifest change. | O13/O18/O22: packed consumer restore under each supported peer, exact outbox/caller settlement. | Workspace dependency and packed consumer checks are separate; G05 remains open. | | B02 | `first-rc.md:17`: removing Query automatic refetch/return type in a stable minor/latest breaks ^1.4 users; use major. | `accepted-design`; maintainer explicitly changed major request to minor. | O13/O17/O21: verify requested minor/tag and explicit migration cost; prove new handler behavior. | Preserve deliberate compatibility warning; a test must not override this release decision. | | B03 | `live-query-options.ts:184`: inline key/schema reference rebuilds each render, possibly loops. Retain options by query identity. | `already-fixed`; historical wrong identity mutant fails six React derived cases. | O05/O19: repeated native hook render, source publication, actual identity change, render budget. | Other identity-comparing host witnesses, without imposing React semantics on reactive bindings. | | B04 | `electric.ts:1291`: rejectReturnedHandlerValue throws uncoded Error after server commit, falsely fails caller and invites duplicate retry. | `already-fixed`; historical original wrapper fails three handler-outcome histories. | O17/O25: server success plus legacy return must fulfill with confirmed row; genuine handler rejection retains exact error. | Keep 12-history owner and error-artifact checks in required validation. | | B05 | `compiler/index.ts:2119`: functional spread/collision guesses mainSource instead of selected joined source. | `already-fixed` under approved authorship rule; historical metadata grammar rejects source guessing. | O06/O08/O09/O12: direct source versus fresh functional object from either joined source, complete rows/four fields. | New-object ownership is output; do not infer provenance from value equality. | | B06 | `compiler/index.ts:2129`: authored `$collectionId` changes ordinary projection ownership contrary to docs. | `already-fixed`; historical collision grammar. | O06/O10/O11/O12: toggle one reserved field without changing ordinary fields; same output attribution at every boundary. | Callback/downstream/facade receiving and full-result comparisons. | | B07 | `first-rc.md:6`: Convex/Preact absent on branch, version command throws; merged packages still need API migration. Merge main and include them. | `already-fixed` missing-package trace after merge; historical actual-inventory fixture. | O13/O14/O22/O26: actual non-private inventory, run version/build/types and receiving contracts for merged packages. | Exact-head clean workspace checks; an older package list is insufficient. | | B08 | `query.ts:4491`: Query ignores legacy return while Electric throws; stale UI versus caller failure. Align adapters. | `already-fixed`; approved ignore-at-runtime/reject-in-types policy. | O14/O17: same CRUD/outcome/result histories through both adapters and public type input compiler. | Keep explicit confirmation controls and generated type admission. | | B09 | `query.ts:4491`: three identical pass-through wrappers and four repeated QueryCollectionUtils types. Consolidate wrapper/type alias. | `already-fixed` reported duplication; historical source cleanup. | O23/O24 with O17 semantics: source inventory and shipped bytes, unchanged mutation outcomes. | Static/size evidence, not an invented behavioral oracle. | | B10 | `useLiveInfiniteQuery.ts:282`: React always false leaves shared equality branch dead; `useLiveQuery.ts:249` uncoded Error ships full text. | `stale` older React shared-policy concern; other framework callers prohibit blanket deletion. `already-fixed` coded identity-error subclaim. | O23 checks all framework callers; O25 executes diagnostic census and production artifact erasure. | Preserve both subclaims. C14 later identified a genuinely unused mode; same claim cannot be inferred from React alone. | ## C: latest supplied review The reviewer reported executed repros for C01–C05 and source-only packaging claims C06–C08. The second evaluation distinguishes observed results from specific TypeError/ERESOLVE predictions. | ID | Original claim and proposed correction | Technical disposition/evidence | Concrete check and distinguishing cut | Remaining work/durable destination | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | C01 | `live-query-options.ts:270`, core test 411 and React 3569: own tests fail after retention change. Fix assertions without restoring render churn. | `already-fixed`; historical two core-file failures and real React failure, then GREEN. Core option tests pass again in this audit. | O05/O26: execute both changed files on exact head, preserve real identity replacement controls. | Test selection and build fingerprints; no new runtime model was needed to detect red tests. | | C02 | `index-suggestion.test.ts:225`: JS `!row.$hasPendingWrites` is false, so expected warning never occurs. Use query expression directly. | `already-fixed`; historical failing diagnostic, current index tests pass. | O20/O26: true/false pending source variation and virtual-field diagnostic at actual query construction. | Actual UI receiver and proxy-expression check. | | C03 | `compiler/index.ts:1227`: flat union alias loses pending/origin metadata. | `already-fixed`; historical final metadata grammar against old compiler has 220 failures/189 controls. | O06/O07/O09/O10: both union branches nonempty, full rows/four fields at pending/settled/publication cuts. | Existing fixtures cover one populated branch only; simultaneous contributions remain a gap. | | C04 | `compiler/index.ts:2117`: only outer root blocks selected reserved names; subquery spoofs metadata. | `already-fixed` recursive publication trace; same historical grammar. | O06/O10/O11/O12: colliding QueryRef projection, downstream callback reads ordinary scalar before publication. | Detect input-time spoofing, not just final reserved-field sanitization. | | C05 | `compiler/index.ts:2079`: later unmatched spread deletes earlier source metadata. | `already-fixed`; historical first-present mutant fails four matched controls. | O08/O09/O10: unmatched→matched→unmatched, both spread orders, callback observations. | Current match grammar is static; transition/rollback coverage remains proposed. | | C06 | Query peer ^0.15 accepts DB lacking fail/reportError/reportHealthy. Narrow peer to APIs actually used. | `already-fixed`; historical old DB boundary has undefined methods and stuck preload, not an executed uncaught TypeError. | O13/O22: execute health failure/recovery in installed supported consumer; reject unsupported combinations. | Manifest string tests alone do not establish capabilities. | | C07 | Query breaking minor/latest should be major. | `duplicate` of B02; original compatibility concern preserved, approved minor choice remains. | O13/O17/O21: requested version/tag, confirmation and migration behavior. | No major bump without a new maintainer decision. | | C08 | Offline stable 1.2/latest with RC-only peer causes old DB peer-resolution failures. | `accepted-design`; coordinated upgrade deliberately required. Specific ERESOLVE wording not run. | O13/O21/O22: actual consumer resolution and documented upgrade/retain-old-adapter alternatives. | Stable tag does not imply 0.15 support. Keep resolver limits honest. | | C09 | Same hash plus changed key/schema borrows other caller's Collection. Reject independent conflicting callers. | `already-fixed` preload/client-render traces; historical guard-removal RED core 36/React 6. Current G09/G10 expose additional paths. | O01/O02/O03/O04/O05/O16: every admission path, independent declarations, replacement and post-rejection reuse. | Cache owner remains open for the demonstrated SSR/hydration counterexamples. | | C10 | RN ListsScreen 118 uses removed `$synced`, JS negation and reserved name; Saving never shows. Select ordinary pending field and consume it. | `already-fixed` source wiring plus historical core pending-field observation; native component execution unproven. | O06/O10/O20/O21: actual example projection/component across held/settled write. | Real RN receiving witness; do not credit a copied core query as a device run. | | C11 | `completeWithoutCommit` can complete failed work; internal API is cross-package and publicly documented. Guard state, remove public instructions for helper. | `already-fixed`; historical missing-guard mutant fails four state histories. Current outcomes suite passes. | O18/O21: repeated attempts from all four states, public rows/outcome unchanged on refusal; guide checks. | Packaged Offline restore still needs its capability receiver. | | C12 | `local-storage-collection.md:118` retains removed isPersisted. Replace with when('settled'). | `already-fixed` targeted guide; G07 finds other active coverage references. | O21: whole authored-doc migration inventory with historical/before examples explicitly marked. | No generated-doc edits; do not constrain search to one changed guide. | | C13 | `db/src/index.ts:54`: warnOnce/resetWarnings unused. Remove implementation, exports and obsolete tests/resets. | `already-fixed`; historical caller inventory and cleanup. | O23: production export/caller census, fixtures distinguished from actual API uses. | Static absence and size evidence. | | C14 | `live-query-window-binding.ts:75`: dependencies recompile mode has no callers. Remove only unused mode. | `already-fixed`; historical source check, framework runtime neighbors pass. | O23/O26: all adapters' supplied modes and normal test graph. | Preserve active structural-equality policy and reactive callers. | | C15 | `compiler/index.ts:1063`: alias array allocated for every functional row; hoist to compilation. | `already-fixed` source placement; no measured speedup claimed. | O24: alias discovery once per compile for varying rows; output owner unchanged. | Deterministic work probe and shipped-byte measurement. | ## G: GitHub review comments Inline comments link to their stable source. G08 is outside the first review's diff; G09/G10 are outside the second review's diff. G11 is the second review's separate “additional/unverified” wording suggestion. The reviewers' current line references below are checked against the audit head, not assumed from old inline positions. | ID | Original claim and proposed correction | Technical disposition/evidence | Concrete check and distinguishing cut | Remaining work/durable destination | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | G01 | [Error-handling guide 705](https://github.com/TanStack/db/pull/2171#discussion_r4404724417): successful POST lacks refetch/write confirmation. | `confirmed-open`, current RED: server has row, Collection empty at settlement. | O17/O21: extract actual snippet and run successful/failing write histories with explicit-confirmation judgment. | Correct authored guide and retain a behavior receiver; compilation alone is insufficient. | | G02 | [RN pending badge](https://github.com/TanStack/db/pull/2171#discussion_r4404724429): select source pending field under ordinary name. | `duplicate` of C10; source correction present. | O20/O21: actual component receives pending/settled source states. | Native execution still unproven; preserve this detail despite duplicate status. | | G03 | [Index warning 225](https://github.com/TanStack/db/pull/2171#discussion_r4404724438): remove JS negation. | `duplicate` of C02; historical RED/GREEN. | O20/O26: run diagnostic and verify source-state-sensitive expression. | Retain proxy-expression regression. | | G04 | [Core identity 408](https://github.com/TanStack/db/pull/2171#discussion_r4404724523): identity/hash assertions contradict retention. | `duplicate` of C01 core subclaim; current file passes. | O05/O26: affected test execution and actual identity-change control. | No reference-sensitive render identity restoration. | | G05 | [Offline package 64](https://github.com/TanStack/db/pull/2171#discussion_r4404724536): RC peer cannot resolve local 0.15.2 in clean workspace, reported TS2307; add workspace devDependency. | `confirmed-open` source/config finding: RC peer, no DB workspace devDependency. Reported fresh-install build failure not replayed here. | O22: disposable frozen install/build before versioning; verify resolved local package and declaration imports. | Workspace dependency repair/build witness remains open. Existing local symlink is not counterevidence. | | G06 | [React identity 3542](https://github.com/TanStack/db/pull/2171#discussion_r4404724550): expect retained Collection/first key. | `duplicate` of C01 React subclaim; historical real-host RED/GREEN. | O05/O26: real rerender plus identity replacement; execute changed test. | Preserve both assertions, not merely isReady. | | G07 | [Coverage text 720](https://github.com/TanStack/db/pull/2171#discussion_r4405108728): two remaining active isPersisted references, actual source lines 547/1560 at head; replace with when('settled'). | `confirmed-open` source documentation residue; added audit prose shifts the second line. Original comment's displayed lines were stale. | O21: authored API-reference search with explicit historical exemptions. | Update active coverage prose; distinct from G11 wording. No production behavior repro needed. | | G08 | `persisted-source-receipts.test.ts:957–960`: async onInsert returns `{}`, violating Promise; remove returned object. | `confirmed-open` source/type mismatch; existing return is present. Whole SQLite typecheck not executed here. | O14/O22: generated result admission plus actual package/test declaration build. | Migrate test handler and run its package typecheck; runtime-only runs cannot prove this. | | G09 | `live-query-observer-client.ts:137`: cached seed early return skips admission; SSR never subscribes. Validate before returning snapshot. | `confirmed-open`, current RED core 3/React 3 with six compatible controls total. | O16: existing cache model through getServerSnapshot and actual renderToString. | Extend primary core/React receiving drivers before repair; post-rejection non-interference remains O02. | | G10 | `client.ts:1095`: hydrateLiveQuery copies source claims but drops local rowOptions when replacing record. Carry local claim forward. | `confirmed-open`, current RED 3/compatible 3 after asserted newer replacement. | O04: preload claim, newer hydrate, conflicting/compatible preload, then claim retirement controls. | Extend claim lifecycle grammar before repair; do not serialize function references. | | G11 | Additional prose comment, coverage 711: clarify “requires joined and single pending-source observations”; bot labels it unverified. | `confirmed-open` editorial suggestion, source only. This is not evidence of a broken reach counter. | O21: readable prose plus O26's per-path reach report; no fabricated runtime RED. | Preserve intent as “observations from joined and single pending sources”; keep separate from G07. | ## W: bot walkthrough warnings | ID | Original claim and proposed correction | Technical disposition/evidence | Concrete check and distinguishing cut | Remaining work/durable destination | | --- | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | W01 | Scope warning: metadata/cache laws and RC release automation exceed issue #1319; split work or link coding requirements. | `refuted` as unauthorized scope: user explicitly requested RC automation and approved metadata/cache rules in this task. Issue text alone omits that authority. | O21/O26: requirement→change inventory and PR-body review, including maintainer decisions. | Keep scope rationale visible; no product oracle should reject authorized scope. | | W02 | Docstring score 17.14% versus 80%, 35 functions/69 files/8 unsupported; generate missing docstrings. | `refuted` as a repository requirement: no such threshold in AGENTS/config/workflows. Metric not independently recomputed; it names no missing contract. | O21/O23: public contract/literate oracle prose review proportional to law, source/config authority check. | Preserve useful documentation review; do not manufacture comments merely to satisfy an unconfigured vendor ratio. | ## Four evidence caveats | ID | Original caveat | Required check and disposition | | --- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | N01 | A reviewer ran no tests; traced installed Changesets 6.0.9 and published exact pins. | O13/O22/O26: preserve source evidence as such. A source finding does not become an executed release failure. | | N02 | C reviewer lacked Changesets dependencies, so release tests did not run. | O26: dependency/setup gate. Prior repair record and initial audit both ran11 fixtures successfully; broader registry/packed receiving work remains proposed. | | N03 | C Query run loaded a stale second DB; no valid runtime finding resulted. | O22/O26: rebuild/fingerprint local DB and verify runtime resolution. Prior evaluation ran 978 Query runtime tests after repair; that result has its own head/scope. | | N04 | C review branch moved 0a60ad85b→66454803b; about 40 later files, 44 by recorded diff, unreviewed; reviewer detached its clean old worktree. | O26: exact-head inventory and affected revalidation. Neither a clean reviewer tree nor unchanged cited files proves those 44 files reviewed. Leave other worktrees alone. | ## Loss accounting, reviewer quality, and closeout The initial scratch ledger was created before probes. Final raw-source reconciliation corrected G07's conflation with the distinct G11 suggestion and added the two walkthrough warnings. No review finding was removed to make the count fit. Multiple subclaims remain within B10/C01 and are explicitly mapped. The four caveats are additional to the 53 finding IDs. Numbered-row accounting is **53 = 29 already-fixed + seven stale + three accepted-design + five duplicate + seven confirmed-open + two refuted**. B10 is counted once as stale for its older shared-policy claim; its distinct coded-error subclaim is already fixed. C01 counts once but retains both core and React paths. No row is deferred. No new product policy is adopted here; A12 requires contract inspection before extending assertions to Effects. These totals classify reported traces, not the completion of all proposed checks. In particular, the seven confirmed-open rows are G01, G05, G07–G11; G07/G11 are editorial, G05/G08 have source evidence, and G01/G09/G10 have executed behavioral failures. The first reviewer had useful source-based boundary analysis but no runtime confirmation. Later reviewers supplied strong executable counterexamples and honest setup/scope disclosures. The GitHub review identified two real cache paths missed by the current driver. Policy recommendations still need the maintainer decisions: a major Query bump, post-write rejection, and scope splitting do not follow from those defects. These reviewers are useful for defect discovery; their proposed fixes and coverage claims still need checking. Recommendation: **hire for defect discovery, with policy and evidence calibration**. Their reproducible boundary failures are the strongest evidence. An unconfigured metric or a scope judgment that omits maintainer instructions does not establish a required repair. The expanded plan accounts for every identified finding in these sources. It does **not** establish that its proposed checks have caught every original implementation. Each behavioral row still needs its original failure or a plausible mutant to fail at the named comparison before that claim is earned. Static findings need source/build/declaration evidence instead. O16 and the hydration part of O04 have current RED evidence; G01 has an executed docs receiver. Those three confirmed failures remain unfixed in this audit. G05/G08 need their clean build/typecheck witnesses. Broader proposals remain open in [the coverage map](../oracle-coverage.md). The PR is **not ready on this evidence**: G09/G10 violate the accepted cache law, and G01 teaches an unconfirmed successful mutation. This audit identifies repairs and checks; it does not postpone them by agreement, retire those laws, or claim completed implementation. No guarantee of zero future findings is justified by a complete matrix or a passing random campaign. Final inventory assertions pass: 53 unique finding IDs, four caveats, 26 check definitions, and a mapped check for every row. The final read-only GitHub query returned the same head, two review bodies, and five general comment bodies, all unchanged from the first snapshot. Changed-file lint, report formatting, and `git diff --check` pass. pnpm reports the existing lockfile/installed override mismatch; no dependency installation or override change was made. ## Additional findings during oracle construction These append to the original inventory; they do not replace or renumber its 53 findings. Production remains at `858b174a65f160d13d01f0324c7481cc8e4eba3a`. | ID | Finding and evidence | Owner and next witness | | --- | --- | --- | | P01 | The actual installed Changesets CLI selects `latest` for candidate packages whose registry history contains only prior RC versions. The chunk 13 command receiver has 12 intended tag-comparison failures and 28 passing neighbors. Independent reviewers observed the raw publish commands; strict shims select no tag. | O13 release/publish history owner. Preserve this RED, add real local-registry HTTP reception separately, and defer production repair until the oracle campaign finishes. Command evidence does not establish npm HTTP or installed-consumer behavior. | | P02 | `packages/db/skills/db-core/custom-adapter/SKILL.md:222` still recommends returning `{ txid }`. Source inspection contradicts the approved explicit-await mutation contract; this is authored guidance, not generated API documentation. | O21 active-guidance consistency and actual snippet receiving checks. Preserve before/historical examples explicitly; repair current guidance after the oracle work. | | P04 | `docs/guides/mutations.md:521` says Query Collection currently refetches automatically after persisting changes. The adjacent example explicitly awaits refetch. The current prose contradicts the approved removal of automatic refetch; this is source-inspected evidence, not a behavior-test failure. | O21 authored-guidance consistency and actual fenced mutation receivers. Check current prose separately from historical/before examples, then repair the guide after the oracle campaign. | | P05 | The real npm/pnpm HTTP receiver attempts to upload an already-published RC when its packument has an `rc` tag and no `latest` tag. Three histories fail the raw no-republication comparison: retry after candidate-phase failure from prior-RC and never-published starting states, plus an already-current no-op. Duplicate PUTs receive HTTP 409; exact local manifest/pre-state restoration is checked first. | O13 actual HTTP receiving owner, `scripts/publish-http-oracle.property.test.js`. Preserve the assertion RED at unchanged production, including raw attempts and registry state, and defer publisher repair until the oracle campaign finishes. Installed consumers remain O22. | | P06 | `packages/db/skills/db-core/custom-adapter/SKILL.md:209` says core will not call `unloadSubset` when `loadSubset` throws synchronously. This current guidance contradicts `query/live/ARCHITECTURE.md:771`: a synchronous throw is a failed load whose owner retains an unload opportunity on release. This is a source-inspected guidance conflict, not a newly executed runtime failure. | O21 active-guidance consistency, receiving the existing subscription lifecycle contract. Check the surrounding ownership guidance as well as deprecated handler return values; do not invent a second acquisition model or repair the skill before the oracle campaign finishes. | | P07 | The same custom-adapter skill at lines 213–216 says the previous acquisition releases when its replacement returns. Architecture lines 783–786 require detaching and releasing the old lease before reacquisition, and reacquiring only while its demand and replay remain current. Source inspection establishes a guidance-order contradiction, not a new runtime defect. | O21 current-guidance consistency and the existing subscription lifecycle owner's replacement/reentrant-release histories. Preserve the separate ordering claim instead of treating P06's synchronous-throw witness as evidence for it. | | P08 | The custom-adapter `loadSubset` fence at lines 170–198 ignores the establishing `commit()` receipt before its async callback returns. This is a candidate applied-settlement defect in executable guidance. No held-receipt receiving witness has run; it is not yet classified as a confirmed behavior failure. | O21 actual fenced callback receiver. Hold an establishing commit behind an optimistic transaction, invoke the actual documented callback externally, and compare load settlement with visibility under the existing applied-settlement law. Avoid awaiting this load from its own mutation handler. | | P09 | Actual LEFT-join Effect startup emits an update for an unmatched occurrence that never entered its callback-visible result. The independent trace has one callback containing that update (identical previous/current values), an unrelated peer enter and the actual matched enter; its literal-true lazy load finished first. This is an executed callback-delta failure, not merely a disputed count of startup batches. | O11 Effect receiving expansion, chunk 16. Preserve the initial RED and full ledger. Public Effect delta semantics and the architecture's absent-to-absent classification prohibit the phantom update; do not accept it as a legal startup prefix or erase initial callbacks. Evidence: `chunk16-startup-independent-trace-r1.log` in the scratch evidence directory. Production repair remains deferred. | | P10 | Author-run correlated-child callback reception exposes reserved fields before downstream fn.select, while all 231 root receiving histories pass. Minimal new-shape witness selects only a fake $key: the callback sees present/own true and `spoof-$key` where the approved law requires absence; an ordinary nested observed output retains that wrong fact. Initial 575-test run has 203 callback-law REDs and 372 passes, including inline-preservation and Collection-input rejection controls. Independent review and final instrument calibration are pending. | O12 callback-input owner, chunk 17. Compare present inputs and derived ordinary outputs under the same model through actual correlated-child compilation; root GREEN supplies no child-boundary credit. Preserve source-spread spoofing and functional-new-spread leakage as adjacent witnesses, distinct from earlier illegal-correlation/order setup failures. Evidence: `chunk17-fourth.json` and `.log` in the scratch directory. Production remains unchanged. | | P11 | Early metadata-fixture debugging observed a raw structured `optional: undefined` projection arrive as null. The author withdrew its initial normalization explanation: existing source-ref tests and public literal descriptions do not establish that raw-literal policy. This is an unresolved boundary observation, not a confirmed product defect or approved normalization. | Read-only literal-law/owner investigation distinguishes raw undefined select specification, explicit val(undefined), source-ref undefined, nested/array forms and null controls, checking callback and final own-property facts. The new O12 grammar retains strict source/spread/functional undefined coverage without claiming a structured-literal law. Preserve this question separately before any production repair. | P01 evidence: `chunk13-publish-independent-final.log` under `/private/tmp/rc2171-oracle-challenge/`. P02 was independently identified during read-only O20/O21 preparation. The existing typed live-query schema limitation is already recorded in the coverage map; it is not relabeled as a newly confirmed regression here. A scratch schema-role experiment establishes that client mutation inputs, rather than synced rows, are the appropriate receiving boundary for a future transforming-schema retention check. P03 (existing replay instrumentation): `recordOracleReplay` is documented as never throwing, but a real `fc.check` RunDetails value and an unwritable witness channel (a directory) produce `EISDIR` from its synchronous writer. The finite comparison wrapper added in chunk 13 preserves both primary and writer errors; that evidence does not establish the older standalone recorder's intended policy. The guarded replay/standalone recorder owner must resolve this existing comment/behavior conflict before claiming a broader writer-failure guarantee. Independent probe: `chunk13-old-record-writer-probe.log` in the scratch evidence directory. No library production repair was made. G08 clarification and current receiver: the unchanged bad handler at `packages/db-sqlite-persistence-core/tests/persisted-source-receipts.test.ts:957` is a plain persisted Collection handler, not Query-specific. Core Collection insert/update/delete handlers all require `Promise`. Running that package's actual `tsc --noEmit --project tsconfig.json` (which maps DB to current source) produces the intended TS2769 handler diagnostic plus its cascading call-site diagnostic. Evidence: `o22-persisted-core-source-types-baseline.log`. Offline's missing workspace DB build edge is separately demonstrated by pnpm's filtered project closure; its committed lock already contains a DB link, so this finding does not by itself prove frozen installation fails. P10 final independent receiving evidence: chunk 17 now has 580 tests, 377 passes/203 intended correlated-child callback-law REDs, with all 2,153 declared states reached. All 203 failures are the expected law exception, not setup/runtime failures. Controls and valid replay-environment/partial selection checks pass their intended judgments; production remains unfixed. The earlier 575-test author run above is retained historical evidence. P11 runtime authority and receiving evidence are now resolved by independently accepted chunk 19. The public builder explicitly promises literal null/undefined pass-through and recursive record selection. Eight of its 68 exact typed root/QueryRef histories fail because raw selected undefined becomes null, including mixed arrays. All three ready cuts, public events and callback inputs are retained. Public type accuracy and correlated receiving paths remain next gates; a broader mixed-expression type-admission diagnostic remains unresolved. | ID | Finding and evidence | Owner and next witness | | --- | --- | --- | | P12 | Structured selection drops an authored empty-record property, including nested empty records and the empty box from a nested omitted field. Ten of chunk 19's 68 histories expose this through real root/QueryRef receivers. A minimal source with only id/version and select `{ id: row.id, version: row.version, value: {} }` loses value at public rows/events, with no nullish member involved. This is an executed recursive-container-law failure, independently reviewed. | Same literal model/registration owner as P11. Preserve the ten REDs and add same-model correlated array/singleton/facade receivers before repair. All 204 receiving and 102 callback states run once; exact typed factories compile. Evidence: `chunk19-r2-freeze-manifest.json` and `chunk19-minimal-empty-record-red.log`. | | P13 | Public `LoadSubsetFn` prose at `packages/db/src/types.ts:384–389` describes resource ownership transferring only after returning true/Promise and cleanup of partial resources on synchronous throw. The newer architecture/lifecycle contract retains failed-load demand and an unload opportunity on release. This wording requires reconciliation; it does not literally make P06's stronger promise that core never unloads a synchronous throw. Source inspection only; no new runtime failure is claimed. | O21 authored-guidance consistency, under the accepted architecture/subscription lifecycle law. Keep this public source comment distinct from the stale skill text and generated API docs. Repair source guidance after all oracle work; leave generated docs to CI. | | P14 | Architecture cleanup/restart prose at line 878 and custom-adapter skill lines 350–354 say markReady after an initial fail throws. Current public API prose, glossary and source-health oracle promise a same-run no-op. Source-health's lazy receiver also catches child-ready exceptions while discarding its model's predicted successful call outcome, so status-only checks can hide the wrong throw. This is source-inspected guidance conflict and an oracle observation gap, not an executed production defect. | O21 guidance plus the existing source-health primary oracle. Add legal generated fail→actual child-ready and fresh-run neighbors, compare call outcome with the existing shared model, declare actual callback reach, and reject a throwing in-memory overlay before guidance/production repair. An absent optional callback call must receive no reach credit. | Chunk 19's unchanged production run has 103 tests: 85 pass and 18 intended assertion REDs (eight P11 plus ten P12), with all 306 states reached once. Independent review repaired only a missing oracle declaration, verified the semantic-neutral delta, strict driver admission and immutable capture controls. This is accepted instrument coverage; it does not close these product defects or change the original 53-finding accounting. P13/P14 read-only preparation and exact-source evidence are retained in the O21 scratch plan. P11/P12 correlated receiving evidence: independently accepted chunk 20 runs 272 exact legal histories through both array spellings, singleton and facade materialization. All 3,264 declared states execute once; 200 histories pass and 72 preserve the same literal-law REDs, with no driver-execution failures. The 33 checker controls and six independent facet-isolation controls pass. Public inferred types remain the next gate. Original QueryRef fixtures missing their own correlation WHERE are retained as documented missing-premise evidence, not value-law failures. No production or guidance repair has occurred.