RC release repairs after the oracle campaign#

All 26 instrument chunks received independent acceptance before executable production repairs began. The parent is 5fa6eca05530bb9e1f4748b7c00ae60976da2808. The full pre-repair campaign remains recoverable at db38b4e009146af53e46aeeef3206269f5968af8. The scope record preserves broader open classes and their accepted laws. No generated documentation enters this change.

Law, reach, RED, GREEN, mutant and limits#

Publication#

CONTRIBUTING requires stable versions on latest and candidates on rc. The independent release ledger judges exact versions, tags, duplicate uploads, retained successes and raw manifest/prerelease-state restoration. The old publisher gives 14 HTTP assertion failures and 12 command-receiver tag failures. Exact-version metadata selection and explicit upload tags make all 167 owner checks and 38 ordinary controls pass. Each of the 29 HTTP histories reaches its declared metadata, comparison and restoration cuts. Original-code, wrong-tag and default-selector mutants fail the intended public comparisons. The commands select the release-history, publish-history and publish-http oracle runners and ordinary version/publisher/release-fixture tests. This covers actual npm/pnpm/Changesets against a loopback registry, not public publication or live Actions authentication. The normal inherited tag output is preserved.

Cache admission and hydration#

The approved rule rejects conflicting source/getKey/schema claims under one cached identity while mounted hooks retain their inline options. Portable hydration accepts its first local claim, preserves active claims across newer data, and retires them on failure or consumption. Two production lines enforce server admission and preserve row options on non-error hydration replacement. Fresh pre-edit runs reproduce 1,536 admission failures across core and real React server receivers. Repaired results: 6,556 core and 1,440 React owner checks, plus 258 neighboring checks, all pass. Declared core routes and real React server cuts run. Omitting either line restores its intended admission failures; retirement controls remain green. Commands select the cache options/lifecycle owners and React cache options/first-registration owners. Arbitrary concurrent rendering, hydrateRoot, Router transport and other-framework first registration remain outside this bounded evidence.

Restored Offline transactions and the clean build#

A failed core restoration snapshot stays failed even if independent durable outbox work later succeeds. The caller now avoids externally completing an already settled snapshot. The core pending-only admission guard stays intact. The unchanged Offline owner initially has 14 warning-comparison failures. The repair passes all 87 Offline checks, all 287 core outcome checks and all 33 persisted-receipt examples. All 220 receiving cuts run once. Restoring the old caller reproduces exactly 14 intended failures. Three source type checks pass. The modeled scope is controlled storage/provider delivery with bounded restored sibling histories; it does not establish native durability or arbitrary retries.

Offline now explicitly declares its DB workspace development dependency, and the persisted receipt fixture drops its obsolete object return without changing its awaited barrier. Lock generation attempts encountered unrelated registry resolution failures. The final importer move is mechanical, not represented as pnpm-generated. A separate fresh frozen-lockfile install succeeds against that exact lock; the actual clean full build, root test typecheck and SQLite core typecheck pass. No local override or dependency downgrade is included.

Published row types#

The retained generated public-output owner independently requires metadata on an unmatched facade's empty row and discriminant-specific ordinary union fields. The old implementation fails 24 campaigns: nullable observations and 96 union spread comparisons. Optional reserved fields are removed only when required metadata attaches, and brand removal distributes its existing rule per union member. All 33 owner tests pass, with 70 states reached by each of 24 histories. The paired runtime owner passes 1,604 checks and six declaration neighbors compile. Independent review reruns the 33 checks and declaration neighbors. An isolated original-intersection mutant fails 24 nullable comparisons; an isolated nondistributive-brand mutant fails 12 union campaigns. Broader callback type ownership and installed declaration portability remain separate receiving boundaries.

Authored mutation guidance#

The accepted mutation law requires server confirmation before a successful handler returns. The actual error-handling POST example now awaits explicit refetch. Current prose removes automatic-refetch and returned-txid advice. Pre-edit extraction reproduces two settled-row failures. Native Vitest 4 runs pass 134 Query, 56 Electric and 85 shared-control/type checks. The exact original POST handler mutant executes and fails the settled-row comparison. Independent review repeats these results. A constructor-compatible Electric mock changes only the receiving fixture, preserving its model, histories and comparisons; its earlier Vitest 4 setup failure is retained separately. This evidence covers selected actual handlers and controlled collaborators, not live services.

Generated error docs and production messages#

Source PRs judge the actual generator against frozen catalogs. The separate docs PR owns generated-page freshness. Strict read-only stdout and command wiring repair the old tooling's 12 assertion failures. Exact final-source results are 39 passes, stdout reception once and catalog comparison once. Restored-old-generator and command-body mutants produce 10 and two intended failures respectively. No catalog or oracle expectation changes accompany the repair. Actual stale-page checks first demonstrate the premise. The unchanged real ESM/CommonJS erasure script then checks 263 literals, including 22 shared literals, with development retention and production erasure. Actual Typedoc generates all 14 output directories with no errors and 15 warnings; the final generator check passes. All generated files remain confined to disposable workspaces. This is not a live Actions execution claim.

Exact source and receiving status#

The integrated product/input cut freezes 3,393 entries at 07:06:43 UTC, SHA256 e3c7f444478fa49412d18f18d44058baf8c2c91cff090f975b5d430d60b49bc2. The normal precommit hook then reordered imports in ten test runners. An AST audit at 6e6034dcb14d35012e1bf41eb035d3c49a52845f verifies identical import sets and test bodies: 3,382 entries remain byte-identical, one deletion remains absent, and ten differ only in import order. Frozen receiving results therefore do not claim byte equality for those ten runners. CI tests the pushed sources. The actual initial version CLI succeeds with private existing GitHub authentication for changelog reads. All 25 actual tarballs validate: 23 versions at 1.0.0-rc.1, Query 1.5.0 and Offline 1.2.0; 156 export targets and 50 wrong-version/missing-export controls run. Packed consumer runtime and declaration checks, plus final-head CI, remain pending at this record's cut. A pnpm direct-file receiving attempt cannot resolve unpublished transitive IVM from the registry; no runtime/declaration comparison runs, so it supplies no API GREEN. This is retained as a setup-premise limitation, not a product defect.

A separate exact frozen stage runs the actual size command against origin/main at 95460bc875a2259b34eea534e5592a9d0394e73f. The default nine package selection saves 665 gzip bytes and 499 Brotli bytes. DB grows 215 gzip bytes while React, Query and Electric shrink. The typical app saves 276 gzip bytes; all eight app scenarios shrink. Authoritative inputs still match after execution. An earlier overlapping version/size attempt is discarded. Tests and contract documentation grow separately from these shipped-byte measurements.

Evidence fingerprints#

Raw logs and source/tool manifests are retained under the session's rc2171-oracle-challenge evidence directory. These report fingerprints bind the recorded outcomes; the executable owners retain their contracts and limits.

Independent oracle review records all applicable ORC requirements per chunk. The initial packed instrument has its own bounded independent review and wrong observation calibrations. Passing package manifests or source-public types cannot substitute for its still-pending installed API comparisons.

Post-push receiving checks and mechanical corrections#

At 6e6034dcb, every core, Collection-adapter, SQLite and Offline CI test group passes. Desktop and cloud/mobile E2E pass. The first pushed cut fails three fixture gates: a local name conflicts with the private-member mangle inventory; React's native source typecheck loses an inferred query context; and relocating CI's pnpm shell launcher breaks its relative CLI lookup. Browser E2E and the corrected final-head CI remain pending at this entry.

The local array rename passes the actual 1,152-case React owner and the 441-name mangle check. Explicitly deriving the schema receiver's context from its actual query passes the complete 2,956-case React package and the final 237-case native/focused selection, including 1,728 receiving cuts. Independent transpilation proves identical emitted runtime code for the context annotation and alpha-equivalent code for the array rename. Models, histories, comparisons, cleanup assertions and run budgets stay unchanged. The CI inference failure does not reproduce locally even before the annotation, so the environmental cause remains unknown and only a successful actual CI rerun closes that gate.

P06/P07/P13/P14 authored guidance now matches the existing logical-owner, release-before-reacquisition and same-run markReady() no-op laws. Changes to src/types.ts are confined to its LoadSubsetFn comment. Scoped validation and an exact executable-source comparison pass. P08's actual held-receipt callback witness and P14's discarded child-ready call-outcome observation remain open; correct prose does not establish behavioral coverage.

The posthook AST audit has SHA256 92a2a5c7ef45596f27bc669a20b991e7ec7d46529930b7607957fcc7c130223e. The schema fixture report is 892d79f14ff46b2dd14ba8da6033f536d1e0a8ed6f750e68d0a793cd84267090; the guidance correction report is 626e724401575f4149f9857ed886d2274f0c8ab390c60aae537b4de03eccb75c. Independent React fixture review retains the original CI RED and locally-green unchanged baseline rather than claiming a reproduced production repair.

The HTTP fixture now invokes PATH-selected pnpm at its installed path through a quoted POSIX exec forwarder. Nine ordinary controls pass. The unchanged HTTP owner passes 35 cases with native pnpm and 35 through a relative shell launcher; all 29 histories reach each declared state once. Restoring the original relocation fails the actual relative-CLI setup control. This is setup evidence, not a new product-law RED. Publisher, models, histories and semantic assertions stay unchanged. Independent replay accepts the bounded correction. Report SHA256: 219dc2db851d73af211d377d46165f9233f9435ee96e73a1cc0b0c2b8cbbdb60.

Initial installed package reception and baseline declaration attribution#

The initial candidate artifact cut passes eight installed runtime cells: ESM/CJS × Query/Offline × fulfilled/rejected. The shared mutation-confirmation and restored-settlement comparisons ran through real installed package imports, with 68 checkpoint/control receipts. Both installed declaration formats also pass the shared handler-admission law: 117 candidates and 72 expected negative diagnostics per format, including missing-negative calibration.

The native npm install used a controlled loopback registry serving unchanged actual release tarballs plus seven explicitly cached external repacks. All 11 installed packages have actual metadata/archive HTTP receipts and exact lock version/origin/SRI checks; selected installed exports match the tarballs. This is native installed reception under a controlled registry premise, without a claim about public-registry archive provenance for external repacks.

The original exported-inference witness remains RED in both formats. Exporting the inferred live-query factory produces TS2742 twice (private query/compiler/types and query/live/internal) and TS4058 (LIVE_QUERY_INTERNAL); exporting its inferred Collection value produces TS2742 twice and TS4023. A strict installed same-path baseline from exact fetched main 95460bc875a2259b34eea534e5592a9d0394e73f reproduces the same diagnostics. This broader unchanged-main declaration-portability defect is preserved for followup, with no production repair or full declaration-compatibility claim. An agent-added narrow Collection<Row, number> annotation separately produces TS2322 on both cuts and is an invalid control, not the original product defect.

A separately executed minimal public-view annotation emits without diagnostics in both formats on both cuts:

type PublicRows = {
  readonly toArray: ReadonlyArray<{ id: number; version: number; value: number }>
}
// receiver is private in this separate control only.
export function annotated(): PublicRows { return receiver() }

This preserves only the declared toArray view; it does not establish a full-Collection annotation workaround. The original factory remains exported and unannotated in its own preserved witness. The independently inferred Offline executor also emits in both candidate formats.

One supplemental runtime assertion initially expected cleared health slots to be undefined; the public HealthNode contract requires null. That instrument error and original run remain preserved. The authority-corrected assertion received independent review and negative controls before all eight cells were rerun. Initial failed public/direct-file install attempts and a rejected npm update-notifier request in the first baseline lane also remain separate setup evidence, with no product-comparison credit.

Artifacts: /private/tmp/rc2171-oracle-challenge/o22-initial-frozen-070643/evidence/final-receiving-classification.json (SHA256 b8e2e501b3ca87b90ba76f61772d99b9e7272620efa886df8a82ec67bed4d13d). Original factory source: /private/tmp/rc2171-oracle-challenge/o22-initial-packed-support/exported-receiver-repro.mts (SHA256 c6c8c1da415901f4935f611387e7f6a3234b5f9753544256f0680038dcc1b50d). Current/main final probe receipts have SHA256 eb157fdc5f567fc04647d206762d794455a998620adc3d9383abf74e0bfc503c / 2987feb2620ba1699869b12dbe51c811b6b0e6c389d06a176bf9a417d1827495; each includes exact factory, const and control source paths.

The tarballs derive from frozen input HEAD 5fa6eca05530bb9e1f4748b7c00ae60976da2808. All 300 frozen production-source files matched committed 6e6034dcb14d35012e1bf41eb035d3c49a52845f at the recorded continuity check. Later uncommitted LoadSubsetFn guidance comments and fixture-only edits were not rebuilt in this artifact cut. The scope is the initial candidate cut, not the full four-cut release matrix, hosted Actions, production authentication, browser/native hosts or live providers. Offline receiving seeds durable outbox data through the public OutboxManager, then starts a fresh executor; it does not exercise two actual executors creating durable state.

Second CI schema-fixture correction#

At pushed head 180b920edd6c88a7024ed407cd04934678c7d5bf, the framework job still rejects the two actual React schema-hook calls with TS2769. The previous context annotation did not close that gate. Independent source checking now reproduces both diagnostics after observing the context and hook return types before requesting diagnostics. The identical cold program passes. This is a TypeScript comparison-order distinction, not evidence of different runtime dependencies. The wider public mutation-input/full-handler problem also reproduces on exact main; its separate follow-up remains open in the scope record.

The recorder now declares only the transaction mutation fields it consumes: key, original, modified and changes. It still records every ordinary payload field and compares against the unchanged independent model. Original and corrected runtime JavaScript are byte-identical, SHA256 3a560ea22d9bbb4f683b695a245869c8b1e71996e97ca35fac4374b5ae549091. Actual corrected React and Preact programs pass cold and after type observation. Injected source-local TS2322 controls still fail in each checked mode. These controls establish compiler admission, not a new product-law mutant kill.

Native React runs pass 237 checks in three files, including 21 typed cases; Preact passes 80 in three files, including eight typed cases. React live, ready-source Suspense and Preact each reach all 864 declared cells exactly once. Both full raw package typechecks and focused lint pass. No model, grammar, comparison, cleanup, reach requirement, runtime hook or production behavior changes. Two independent reviewers accept the bounded correction. Actual final-head CI remains required; these local results do not close public mutation typing, typed-schema inference, initial suspension or concurrent/SSR receiving paths.

Report fingerprints, under the original campaign evidence directory:

• schema-180-structural-fixture-final-evidence.md: a3a7710c5420f970b0b7105b780e50e24bebe354b07fd6301d4c4ee180ba3ed2.
• schema-structural-driver-independent-review.md: 00456d80b6e356a77c93cc2df67f57961d7dbee075413684b9e4c039c9aa2540.
• schema-structural-handler-second-review.md: 3c8a12ceada729cee932ff7090f486932c65175239fff76a371904cc800d2fd8.

SQLite generated reach correction#

At 180b920ed, all 40 random histories complete their public comparisons, but the campaign fails because none reaches an aborted-only demand. The post-campaign guard did not preserve its seed. Unchanged native seed 18 reproduces that reach failure after 40 comparisons; this is an honest grammar gap, not a production mismatch.

The original unrestricted history grammar and 40-run budget remain unchanged. Each normal campaign adds two generated packs of nine legal histories. Every pack independently requires all 15 existing reach states through the unchanged production driver, independent model and comparison. The required packs have their own registered seed/path replay coordinate. Seed-only full campaigns still enforce reach; direct path replay runs only its selected property. The native failure formatter now preserves the actual campaign seed and cause.

The complete native owner passes five tests. Fixed and fresh-random campaigns each run 40 unrestricted plus 18 required histories and pass in 90–92 seconds. The formerly failing seed 18 now passes. Direct original and required-property replays pass separately; independent review observes the required replay's single guarded witness and all 15 states. Removing abort from the required pack fails its own reach requirement. Removing the production abort fence in an isolated host fails the actual offline status comparison: expected loading, observed ready with a row. Independent review repeats both controls.

Only the two outer campaign timeouts increase from 120 to 180 seconds to allow for the additional histories. Internal deadlines, observations, comparisons, minimum reach and cleanup remain unchanged. Scoped source types, full ESLint, oracle admission and the run-budget audit pass. No executable production or model changes enter this correction. Controlled Node SQLite observations do not establish arbitrary-history, browser or live-provider behavior.

The author report demand-reach-final-evidence.md has SHA256 cacc43eac3d276157606aefa09136a479e41e8be7db2b79dd805e60bee48ef68. The final source freeze is f2d80fbb4d1f2c2b82cbb0451b3d352b5f4cf1240017e63e45c9f6a0a96887ab. Both are retained under the original campaign evidence directory. Actual final-head CI remains required.

The independent verdict demand-reach-independent-review.md has SHA256 45c2e7d843a6ebd4c3898957c1b4d698450341beda8af8382b13e72959060e43. It binds the copied source hashes, direct replay, both intended control failures and the two outer timeout literals.

Named replay registration receiving correction#

CI on d9911f17b passes 40 of 41 replay controls but rejects the new persisted-demand-coverage.required coordinate as no-named-owner. Earlier direct Vitest replay proved the property and its guard could run but bypassed the repository's manifest-to-command lookup. The existing independent manifest check correctly catches this integration omission; its expectations stay intact.

Adding required beside history in the existing owner entry repairs that lookup. No production, model, grammar, guard, comparison or budget changes. The author reproduces the manifest RED, then passes all 41 existing replay controls. Author and reviewer each execute the actual repository named replay CLI through the default SQLite package config at required/seed18/path0. Both runs emit exactly one successful matching guarded witness with numRuns1. The reviewer also independently reproduces pre-edit CLI rejection and passes all six manifest controls. A custom runner alone no longer supplies the claimed named-command receiving evidence. Hosted final-head CI remains required.

Author evidence demand-registration-author-evidence.md has SHA256 3cd8bb335a916fc073a7ae2139aa104e9351ad4f75d22ee99a2c44b8a2c218d9. Independent verdict demand-registration-independent-review.md has SHA256 b22e5109bd08f0436d9fcc62d78de5d26da686584b9a2882e626621f66177385. The manifest source hash is 3f1c724c48171b94413c787021d9d948212bdd28edcd84e783996b86722ac9eb. Evidence remains in the original campaign directory.

Formatting continuity and later CI discoveries#

The formatting bot's d9911f17b changes only the schema recorder's callback parameter layout and optional trailing comma. Its TypeScript output differs only by that comma; minified runtime output is byte-identical. Strict raw-output hash checks initially reject the formatting difference, and the retained audit records both hashes and the exact normalized difference. Audit release-autofix-d9911f17b-audit.json has SHA256 16c36655accb99744919b7e4d97a9e035f6a85b85f13ac2ccf900d4ea9b87f6b. No product code changes in that bot commit.

On this cut, framework and SQLite core CI pass. The replay manifest omission above and source-health's missing random reach still fail separate gates. DB core also finds a retained-publication mismatch that independently reproduces on exact main. Its active oracle remains unchanged, and the scope record preserves that open baseline defect. A later passing random run cannot close its recorded counterexample. Final-head CI and release readiness are separate judgments from this deferred class.

Source-health structural reach correction#

CI seed -2135407433 passes all 60 original source-health history comparisons but never selects the opt-in snapshot prefix. The unchanged campaign reproduces its afterAll RED: snapshot outside reload, markReady after fail and blind insert of a kept key during reload each have zero reach. The established snapshot, reload and source-health laws remain unchanged; this is missing sampling reach.

The additive source-health.required-history lanes execute every one of the nine existing structural prefixes, followed by 0–12 generated existing steps. Each fixed/random lane runs six cases, independently enforces all 26 declared states and reaches every state at least six times. Required cases use join or nested contexts with direct subscribers. The unchanged original 60 random histories retain all six shapes and both subscriber choices. Models, driver, public comparisons, named histories, original grammar and budgets stay intact. Both replay registries and selectors include the new coordinate, preserving the separately accepted SQLite required mapping.

Author and independent reviewer each pass the complete 506-test owner and scoped TypeScript checks. Actual default-config named CLI replay selects the new coordinate with one matching successful receipt at seed -2135407433/path0; all four existing coordinates also execute in author checks. Global manifest controls pass six tests. Prettier, scoped lint, changed-oracle lint and the 441-name mangle check pass. All 154 DB/IVM production source files match d991. No executable production repair enters this change.

Omitting a required prefix rejects its lane's missing reach. The fixed-only ablation fails even when the other lane covers the aggregate. A scratch-only snapshot mutant preserves begin but merges commit; the guarded CLI rejects public Collection rows at step3 commit, actual [[1,1]] versus expected []. Restoring production passes the captured seed/path0:0. The restored formerly shrunk path reports one property receipt and ten fast-check runs, which are preserved rather than reported as one history. These are assertion failures, not setup failures. Independent review repeats both sensitivity checks.

This closes the bounded sampling gap for the owner's declared premises, not all source-health, provider, framework or concurrency behavior. Author evidence source-health-reach-repair-evidence.md has SHA256 0a711cfeeb1f3e3ef5d6bd4270f2f74a3b3532edb08c4c9790df537cf9a2f62e. Independent verdict source-health-independent-review.md has SHA256 51693ba468e03c347988877d865faf0328bc8a637f2364eafa3a963dd6e80023. Both remain under the original campaign evidence directory. Actual final-head CI remains required, and the independently confirmed baseline replay defect above stays open under the documented release scope.