PR #2171: second review evaluation, 2026-10-28

This record evaluates the 15-item review supplied by the maintainer. The reviewer targeted 0a60ad85b; this evaluation started at 66454803bcd200bf56fcf569179c3007a51e859e. Repairs and executable coverage are in 68228aaf3a878075af3dc04636133aef95480a09. This report is a subsequent documentation commit. The earlier review record remains historical evidence for its own commits.

Laws, experiments, and inference

No product decision remains pending. The maintainer explicitly chose these rules:

Mounted hooks retain inline getKey and schema until query identity changes. Independent DbClient callers must reject conflicting option references under one cached identity. Distinct queryKeys permit different behavior.
Structured whole-row selections and spreads retain source metadata. The last present spread supplies it. Direct functional source returns retain it. New functional objects receive output Collection metadata. Selected reserved names cannot choose attribution. Inline include values keep their authored shape.
Query and Offline Transactions remain stable 1.x packages because both accidentally reached 1.0. Query's automatic-refetch removal ships as a minor, as explicitly requested. Both new stable minors require the RC DB APIs.

The scratch ledger inventoried the whole review before any production repair. The pre-edit gate ran the expanded metadata, cache, React receiving, and transaction comparisons against unchanged production. It also checked existing React retention histories, Offline restoration callers, release fixtures, and DB 0.15 capabilities. Later metadata composition additions were calibrated separately against the original compiler; that later experiment is not evidence of their presence in the initial gate.

Law and authority	Earlier coverage and missing distinction	Decisive experiment	Repair and enforced boundary
Published Collection metadata follows authoring shape, through query composition. Authority: VirtualRowProps, the architecture's facade boundary, issue #1319's reserved-name concern, and the approved functional-selection rule.	The primary virtual-row-fields owner compared source/output attribution directly, without QueryRef/union composition or a null later spread. The model did not require a new rule for reserved names; its driver failed to reach recursive publication.	Initial 209-case grammar: 92 assertion failures, 117 controls pass. Final 409-case grammar against the original compiler: 220 failures, 189 pass. A first-present-spread mutant fails four comparisons, although it fixes the reported null-last example. Repaired grammar: all 409 pass.	Propagate the Collection-row boundary through recursive query compilation, preserve flat union branch metadata, and choose the last non-null source spread. Compare all four public fields after preload, during a held source update, and after settlement. New ordinary hasPendingWrites projections also match the source at those cuts.
A reusable DbClient result cannot substitute incompatible local row behavior. Authority: the maintainer's same-identity conflict decision. Mounted retention remains a separate approved law.	Source-object identity and mounted option retention already had tests. Neither generated independent callers differing only in row options. Portable hashes correctly omit runtime function references.	Core gate: 36 failures/108 controls across 144 cases. Real React gate: 6 failures/18 controls across 24 cases. Removing only the new option guard reproduces those exact failure counts through both drivers. Repaired core and React matrices pass. Existing React retention/source-ID owner: 92 pass before and after.	Keep local option-reference claims with the reusable client record, outside the transport hash. Check preload, observer preload, subscription, and real React initial-render admission. Hooks compare the retained Collection's options, preserving inline render behavior.
External completion admits only pending transactions and cannot revise another transaction verdict. Authority: commit admission and terminal settlement outcomes.	The optimistic-history model already distinguishes pending/persisting/completed/failed but had no external-completion action. No state observation caught verdict resurrection.	The extended primary model fails on the unguarded helper. Removing the repair again fails all four state histories, including the second completion of initially pending work. The repaired outcomes suite passes 27 tests. Offline baseline restoration/interruption callers pass 16; full repaired Offline suite passes 302.	Admit pending work only, using the existing coded admission error. Compare transaction state, request outcome, and public rows after each model action. The finite addition crosses four states with 1–3 completion attempts.
A declared DB peer provides the APIs the adapter calls. Authority: Query's actual sync boundary and honest package compatibility.	The release fixture still expected the broad Query peer. The old DB capability path was absent from the reviewer's experiments.	DB 0.15.2 tag source, instantiated through its real Collection sync boundary, supplies undefined for fail, reportError, and reportHealthy. A provider failure leaves preload unresolved until cleanup. The strengthened release fixture rejects the old range; all 11 repaired release fixtures pass.	Query now peers only on ^1.0.0-rc.0, as Offline already does. The guide requires coordinated upgrades and tells DB 0.15 applications to keep earlier adapter versions. The probe does not establish an observed TypeError or a particular package manager's ERESOLVE wording.

Grammar, reach, and public observations

The metadata model judges source ownership from authoring shape rather than field values. Its 50 shape/source/collision inputs cross eight compositions: direct; QueryRef depths one/two; joined and functional QueryRef consumers; union first/last branch; and union through QueryRef. Eight further histories cross matched/unmatched later sources, spread order, and the source with an optimistic update. One existing classification history protects nested values, Dates, arrays, whole-row children, and inline projection shapes. Projection keys use a clean sibling as a trusted comparison for compiler-generated key spelling; this is an anti-spoofing judgment, not an independent key-generation model.

Normal-run declared reach was: single pending source 200; joined pending source 200; reserved collision 320; functional direct return 16; QueryRef pending 250; union pending 150; null later spread 2. The same field comparison runs at preload, held-update visibility, and fulfilled settlement. Removing composition loses the subquery/union counterexamples. Removing match/spread-order controls permits a first-spread shortcut. Removing collision controls permits authored reserved names to choose attribution.

The cache model is the independent relation different options && same identity => reject. Its 24 histories cross getKey/schema/both, same/different references, same/distinct queryKey, and derived/keyed identity. Each crosses pending/settled reuse and three core admission paths, for 144 cases. Each path has 48 histories, each reaching its declared admission once. React supplies 24 real mounted initial-render histories, each reaching render admission once, using the same model and comparison. Same-reference and distinct-key controls reject an always-throwing policy. The existing 92-case receiving owner separately checks retained options and real query-identity replacement.

The transaction addition reaches three histories per starting state (four states, 1–3 attempts). It uses the primary optimistic-history driver and row/outcome/state comparison rather than a replacement expected result. Pending and persisting cannot merge in the model: completion is legal only in the former. Completed and failed cannot merge because their settled outcomes differ. The normal broader optimistic history campaigns retain their original budgets.

These are finite boundaries. They do not prove arbitrary nesting depth, all join kinds and retractions, every framework, actual remote-provider timing, or arbitrary SSR hydration orders. Cache option coverage judges local result reuse; it does not claim semantic equality of distinct functions. Source-identity hydration histories remain separate evidence, not a claim that every option/hydration combination ran. Metadata's held update fulfills; the existing optimistic owners separately cover rollback/queued publication. No known reachable counterexample remains within these declared repair boundaries.

Lossless finding ledger

Line references below are from the supplied review. They are not current line numbers.

ID	Original claim	Technical verdict and evidence	PR action	Durable value/destination
R1a	live-query-options.ts:270; core identity test at 411 fails after removing getKey/schema from identity.	Confirmed test failure at starting head. Its replacement expectation contradicted the approved retention rule.	fixed-now: assert identity equality, without restoring reference-sensitive render identity.	Core identity test, cache conflict oracle, and receiving retention owner distinguish local claims from query identity.
R1b	useLiveQuery.test.tsx:3569 retains the old Collection and fails the PR's test.	Confirmed on the real React path. Retention is approved behavior, so the stale expectation was the defect.	fixed-now: expect the original Collection/key after an option-only rerender.	The existing 92-case React oracle preserves replacement on actual identity changes.
R2	index-suggestion.test.ts:225 negates a query proxy, yielding constant false and no expected virtual-field warning.	Confirmed failing warning test. JavaScript negation does not construct a query expression.	fixed-now: order directly by $hasPendingWrites; index diagnostics and the corrected test pass.	Keep proxy-expression construction distinct from JavaScript evaluation. No production warning waiver was added.
R3	compiler/index.ts:1227; unionAll uses the empty alias as source and loses pending/origin metadata.	Confirmed by the composed metadata comparison, including both branch positions and union through QueryRef.	fixed-now: use the flat branch row as union metadata source.	Primary metadata owner now generates union compositions and checks all four fields at three cuts.
R4	compiler/index.ts:2117; a subquery can spoof reserved metadata because protection runs only at the outer root.	Confirmed. The gap also affected new functional objects behind recursive queries.	fixed-now: propagate the Collection publication boundary through FROM, JOIN, and union branches.	QueryRef depth, joined/functional consumers, and collision axes stay in the primary owner. Inline values retain authored shapes.
R5	compiler/index.ts:2079; a later null outer-join spread deletes earlier metadata and hides pending state.	Confirmed. A simplistic first-spread repair would break matched two-source histories.	fixed-now: choose the last present whole-row spread.	Eight primary-owner histories and the four-failure first-spread mutant distinguish the wider law.
R6	Query accepts DB ^0.15 but calls absent fail/reportError/reportHealthy; users can hit TypeError.	API incompatibility confirmed. The actual old-boundary probe observed missing functions and stuck preload, not an uncaught TypeError.	fixed-now: require RC DB; update importer and release fixture.	Capability probe, release fixture, and coordinated migration instructions prevent false peer claims.
R7	.changeset/first-rc.md:17 publishes removal of implicit refetch/Promise handlers as stable minor/latest.	Factual semver concern. The maintainer explicitly selected a minor after retracting the major request.	accepted-design: retain the requested minor and explicit breaking-change guide.	Preserve the deliberate compatibility cost and major-version alternative here; do not silently override the release decision.
R8	Offline stable 1.2/latest requires prerelease DB and older DB applications can fail peer resolution.	Incompatible-peer fact is correct. Resolver-specific ERESOLVE behavior was not executed. The narrow peer prevents the previously identified missing-method runtime path.	accepted-design: stable 1.x release policy with mandatory coordinated DB upgrade.	Guide and changeset now explain both adapters' RC requirement and the option to retain earlier adapters.
R9	Same hash plus different getKey/schema can return another caller's cached Collection rather than reject.	Confirmed through all three core paths and real React initial render.	fixed-now: store/check local option references on the reusable result.	Shared cache model and core/React drivers preserve the newly approved conflict rule.
R10	RN ListsScreen.tsx:118 uses removed $synced, proxy negation, and a selected reserved field, breaking Saving.	Confirmed source defect. The metadata owner now compares an ordinary selected pending field with actual source updates.	fixed-now: select hasPendingWrites: list.$hasPendingWrites and read that ordinary property in the card.	Query-runtime pending-field witness plus static component wiring. No native device run is claimed.
R11	completeWithoutCommit() can complete failed work, yet is @internal, cross-package used, and documented publicly.	Confirmed state-admission failure in the primary transaction model. Cross-package use is intentional; public migration instructions should not name the internal helper.	fixed-now: pending-only guard; guide describes restoration capability without advertising the method.	External completion action, repeated-attempt grammar, state/outcome assertions, and Offline caller tests.
R12	local-storage-collection.md:118 still uses removed isPersisted.	Confirmed authored-doc residue.	fixed-now: use when('settled').	Source check and migration guide; generated references remain CI-owned.
R13	db/src/index.ts:54 exports unused warnOnce/resetWarnings.	Confirmed no remaining production callers. Some Query tests still reset the obsolete helper.	fixed-now: remove implementation, Set, exports, direct tests, and obsolete Query resets.	Generic error-census fixtures remain: they test census behavior, not this removed API.
R14	live-query-window-binding.ts:75 retains unused dependencies recompile mode.	Confirmed no active caller. The structural-equality policy still serves real identity/reactive paths.	fixed-now: remove only the unused mode and comment.	Full React runtime and source-ID owners preserve window/identity behavior.
R15	compiler/index.ts:1063 allocates functional source aliases for every row.	Confirmed source placement. No timing or throughput improvement is claimed.	fixed-now: compute once per compiled select.	Existing functional and metadata comparisons enforce unchanged semantics; size measurement records shipped cost.
U1	Reviewer could not run release fixtures because dependencies were absent.	Local installed fixture path works.	fixed-now (evidence gap): 11 release fixtures pass.	Commands and outputs below; no publishing command ran.
U2	Reviewer Query run loaded an old second DB, so supplied no valid runtime evidence.	Setup failure did not establish product RED.	fixed-now (evidence gap): rebuild local DB, then all 29 Query runtime files/978 tests pass.	Preserve the single-runtime requirement and build-before-adapter-test workflow.
C1	Branch moved from reviewed 0a60ad85b to 66454803b; roughly 40 later files unreviewed; detached review worktree preserves clean old tree.	Scope caveat confirmed: 44 files changed. Designated implementation worktree remained the only edited checkout.	fixed-now (scope accounting): reevaluated all findings at 66454803b, inspected changed production replay/ordered code, and ran its five receiving suites, 534 tests. This is not a claim to have independently reviewed every changed dependency/example.	Record exact heads, the integration evidence, and the separate readiness limit. The detached review checkout remains untouched.

The 15 numbered items account for 13 fixed-now and two accepted-design. Splitting R1 into its two receiving paths produces 16 numbered subclaims: 14 fixed-now and two accepted-design. Including U1, U2, and C1 gives 19 ledger rows = 17 fixed-now + two accepted-design. No confirmed-open, deferred, refuted, stale, duplicate, or unanswered design-decision item remains in this review's authorized repair scope.

A follow-up census check exposed a stale frozen development message for error 234 after the approved cache-conflict expansion. It failed exactly on that text. The fixture now records the same code with its expanded getKey/schema diagnostic; the oracle prose states the authority. No generated API reference or error documentation was edited. This was a contract-fixture update, not a relaxed classifier.

Verification and calibration

Commands use the implementation worktree. Package runtime commands run from the named package; ../../node_modules/.bin/vitest is the installed root binary. --coverage.enabled=false --typecheck.enabled=false separates runtime checks from the independent TypeScript checks below.

DB final law run: metadata 409, cache 144, external outcomes 27, core identity and index warning tests: 611 pass. Metadata reach counts are above.
DB wider neighbors: 1293 tests/12 files, plus 210/5, passed. These include source identity, union, inline values, functional/context materialization, transaction and publication owners. Results overlap; these counts are not a unique-test total.
Main integration: vitest run tests/query/load-subset-replay-refinement-oracle.test.ts tests/query/ordered-source-loader-state-oracle.test.ts tests/query/ordered-work-oracle.property.test.ts tests/query/live-query-collection.test.ts tests/collection-subscription-replay.test.ts: 534 pass/5 files, fixed and random campaigns intact.
Query: rebuild DB, then vitest run --config vite.config.ts --coverage.enabled=false --typecheck.enabled=false: 978 pass/29 files, including both ordered-refetch campaigns.
React: vitest run --coverage.enabled=false --typecheck.enabled=false: 765 pass/28 runtime files. The final selected cache/source-ID/useLiveQuery run passes 172/3 after restoring the mutant and rebuilding DB.
Offline: vitest run --coverage.enabled=false: 302 pass/24 files. The pre-edit restoration/interruption witness was 16 pass.
Release: node --test scripts/version-packages.test.mjs scripts/publish-packages.test.mjs: 11 pass.
TypeScript: tsc --noEmit -p packages/db/tsconfig.test.json; tsc --noEmit --rootDir . -p packages/react-db/tsconfig.json; the same rootDir command for Query: all pass. The workspace rootDir includes the shared source/test owners legitimately imported across packages.
DB build, frozen offline lockfile-only verification, changed-file oracle lint, ordinary ESLint, and Prettier pass. ESLint retains existing Query async/no-shadow warnings in unchanged lines.
Consumer bundles: minified public API passes (113 error names, index metadata, rows, live updates). Production error erasure keeps development text and erases 263 literals, including 22 shared literals, in ESM and CommonJS.
Production error census: 19 pass/2 files after the approved error-234 fixture update. Its initial single text mismatch is preserved as an intermediate failure, not product compatibility evidence.

Calibration reinstates one wrong implementation at a time, runs the same comparison, and restores source in a finally block. Cross-package calibration rebuilds DB before the React witness, then restores and rebuilds the repaired DB:

Wrong implementation	Comparison result	Classification
Original compiler at 66454803b, final 409-case grammar	220 failures /189 pass	Metadata assertion failures; expanded compositions calibrated after the initial gate.
First-present rather than last-present structured spread	Four failures /405 pass	Field comparison rejects matched two-source cases; distinguishes an incomplete R5 repair.
Remove only local option-conflict guard, core	36 failures /108 pass	Admission throw/rejection comparisons.
Same missing guard, rebuilt DB and real React mount	Six failures /18 pass	Initial-render admission comparisons.
Remove pending-state external-completion guard	Four failing state tests /23 pass	Primary state/outcome law; persisting cleanup diagnostics preserve the original admission failure as cause.

Initial failed package-local binary paths and an attempted nonexistent old DB dist import were setup failures. They supplied no product evidence. The first broad Query/React commands also enabled Vitest's typecheck under a package-only rootDir: they emitted 211/212 cross-package source diagnostics. These are not passing commands. Runtime-only commands and explicit workspace-root TypeScript commands above resolve that test setup ambiguity without changing production or suppressing an assertion.

The initial stale-test reproduction ran vitest run --coverage.enabled=false tests/live-query-options.test.ts tests/index-suggestion.test.ts from DB (29 pass/two fail), and vitest run --coverage.enabled=false tests/useLiveQuery.test.tsx -t 'accepts getKey without queryKey' from React (one fail). The oracle comparisons use these replay entry points from DB:

shell

../../node_modules/.bin/vitest run --coverage.enabled=false --typecheck.enabled=false \
  tests/query/virtual-row-fields-oracle.test.ts \
  tests/live-query-cache-options-oracle.test.ts \
  tests/optimistic-history-outcomes-oracle.test.ts

The React receiving calibration runs vitest run --coverage.enabled=false --typecheck.enabled=false tests/cache-options-oracle.test.tsx from React after rebuilding DB. No run-count reduction, failed-history waiver, or assertion relaxation supplies a GREEN result.

Oracle audit

This is a self-review, not an independent second reviewer. It follows the oracle-authoring and oracle-review skills.

Requirement	Outcome
ORC-001	Authorities and finite limits are explicit above and beside the models.
ORC-002	Metadata uses authoring shape, cache uses caller declarations, and completion uses primary transaction state. None imports the production semantic classifier for its expected answer. Compiler-generated projection key spelling is the declared trusted comparison.
ORC-003	Laws, models, grammars, drivers, and comparisons remain distinct in the executable owners and named shared model.
ORC-004	Known witnesses reconstruct from the enumerated dimensions. Removing composition, match/order, option, or transaction-state axes loses the corresponding counterexamples. Bounds are 8 compositions, QueryRef depth 2, one held source update, 24 cache inputs, and 1–3 completion attempts. Invalid forms such as a spoofed direct functional row are not fabricated as legal direct returns.
ORC-005	Public Collection fields at three cuts; public admission throws/rejections; transaction state/outcome/rows after each action. Held-source state is observed before the metadata comparison. No concrete missing-input hypothesis remains within those cuts.
ORC-006	Original and narrow hostile implementations fail at the intended comparisons, with counts above.
ORC-007	The new metadata/cache/completion additions are exhaustive finite grammars, not sampled generated properties. Existing important random optimistic, identity, and replay campaigns keep their fixed/random parity and original replay controls/budgets.
ORC-008	Cache/metadata judgments are stateless. The transaction model reuses its existing four states; legal completion and terminal outcomes distinguish them.
ORC-009	Collection, query identity, publication, pending/persisting, and settlement follow the project glossary. Local option claims are runtime references; transport hashes carry none.
ORC-010	Metadata uses existing checkWithCleanup. Transaction cleanup retains the primary failure as AggregateError cause. Cache drivers release observers, client state, and source Collections in finally blocks.
ORC-011	No unaddressed shared-fault hypothesis was identified. The clean sibling supplies key spelling only. Independent authoring rules and hostile mutants challenge the semantic judgments without cloning compiler control flow.
ORC-012	This versioned record identifies the exact repaired commit, evidence, process order, all outcomes, and finite limits.
ORC-013	Nullable/matched spread-order neighbors, same/distinct cache-key controls, and pending/persisting/completed/failed attempt histories distinguish the conditional laws.
ORC-014	Real React reuses the shared cache model/comparison. Offline callers exercise pending external completion in restoration. Metadata is explicitly a real-core Collection boundary claim, not an assertion about a remote SDK or native host.
ORC-015	Metadata's measured counts are above. Every core/React cache case asserts its path's admission reach. Every completion starting state reaches three histories.
ORC-016	New regressions are inputs to the shared model/driver/checker. Ordinary identity/warning tests remain outside oracle files.

The complete declared laws are encoded and asserted at their named cuts for these finite grammars. No in-scope cell with a known counterexample is being relabeled as an external limit. Coverage ownership and bounds are recorded in oracle-coverage.md.

Code weight

pnpm size:compare --packages db,react-db,query-db-collection --files compares production bundles with merge-base bc77952e5. DB grows 199 gzip/139 brotli bytes; React saves 199/190; Query saves 340/224. Total: 340 gzip and 275 brotli bytes saved. The typical app saves 276 gzip/134 brotli bytes.

Against starting PR head 66454803b with --base 66454803b --exact-base, these repairs add 84 gzip/91 brotli bytes to DB and 39 gzip/100 brotli bytes to the typical app. React/Query package runtime bundles are unchanged. Added local claims distinguish two incompatible callers that portable hashes cannot distinguish; recursive metadata enforcement and transaction admission also need checks. Refactors removed the unused warning Set/API and recompile mode, hoisted per-row alias construction, reused error 234 and the existing transaction admission error, and avoided a new metadata registry or lifecycle. Those savings do not offset every guard byte. Tests and contract documentation grow separately and do not ship in these measurements.

Reviewer assessment and readiness

Hire, with calibration guidance. The reviewer found reproducible failing tests, composition bugs, a real missing cache boundary, an honest peer mismatch, and inexpensive cleanup. The runtime repros had high value. Prioritization correctly put failing tests and metadata above code weight. The proposed direction needed context: restoring option-reference identity would reintroduce render churn, a major release would contradict the maintainer's explicit minor decision, and a broader Offline peer would claim nonexistent APIs. The downstream TypeError/ERESOLVE wording also exceeded the experiments performed. The reviewer clearly disclosed their setup failures and moved-head scope, which improves trust.

Item accounting and authorized repairs are complete for this review. Whole-PR readiness remains unproven. CI on the starting pushed head was red in several DB, adapter, framework, SQLite, and browser jobs. This evaluation did not run native-provider E2E or independently review all 44 intervening files. Existing main-imported expected-failure persistence witnesses in #2281 remain separately documented product gaps, not evidence that these repairs failed. Later origin/main commits were fetched for context but are not merged by this repair. The new pushed head needs its own CI result; local green comparisons cannot supply it.