# Content temporarily unavailable
# RC release repairs after the oracle campaign

All 26 instrument chunks received independent acceptance before executable
production repairs began. The parent is `5fa6eca05530bb9e1f4748b7c00ae60976da2808`.
The full pre-repair campaign remains recoverable at
`db38b4e009146af53e46aeeef3206269f5968af8`. The
[scope record](2026-10-29-pr-2171-deferred-oracles.md) preserves broader open
classes and their accepted laws. No generated documentation enters this change.

## Law, reach, RED, GREEN, mutant and limits

### Publication

CONTRIBUTING requires stable versions on `latest` and candidates on `rc`.
The independent release ledger judges exact versions, tags, duplicate uploads,
retained successes and raw manifest/prerelease-state restoration. The old
publisher gives 14 HTTP assertion failures and 12 command-receiver tag
failures. Exact-version metadata selection and explicit upload tags make all
167 owner checks and 38 ordinary controls pass. Each of the 29 HTTP histories
reaches its declared metadata, comparison and restoration cuts. Original-code,
wrong-tag and default-selector mutants fail the intended public comparisons.
The commands select the release-history, publish-history and publish-http
oracle runners and ordinary version/publisher/release-fixture tests. This covers actual
npm/pnpm/Changesets against a loopback registry, not public publication or live
Actions authentication. The normal inherited tag output is preserved.

### Cache admission and hydration

The approved rule rejects conflicting source/getKey/schema claims under one
cached identity while mounted hooks retain their inline options. Portable
hydration accepts its first local claim, preserves active claims across newer
data, and retires them on failure or consumption. Two production lines enforce
server admission and preserve row options on non-error hydration replacement.
Fresh pre-edit runs reproduce 1,536 admission failures across core and real
React server receivers. Repaired results: 6,556 core and 1,440 React owner checks,
plus 258 neighboring checks, all pass. Declared core routes and real React
server cuts run. Omitting either line restores its intended admission failures;
retirement controls remain green. Commands select the cache options/lifecycle
owners and React cache options/first-registration owners. Arbitrary concurrent
rendering, hydrateRoot, Router transport and other-framework first registration
remain outside this bounded evidence.

### Restored Offline transactions and the clean build

A failed core restoration snapshot stays failed even if independent durable
outbox work later succeeds. The caller now avoids externally completing an
already settled snapshot. The core pending-only admission guard stays intact.
The unchanged Offline owner initially has 14 warning-comparison failures. The
repair passes all 87 Offline checks, all 287 core outcome checks and all 33
persisted-receipt examples. All 220 receiving cuts run once. Restoring the old
caller reproduces exactly 14 intended failures. Three source type checks pass.
The modeled scope is controlled storage/provider delivery with bounded restored
sibling histories; it does not establish native durability or arbitrary retries.

Offline now explicitly declares its DB workspace development dependency, and
the persisted receipt fixture drops its obsolete object return without changing
its awaited barrier. Lock generation attempts encountered unrelated registry
resolution failures. The final importer move is mechanical, not represented as
pnpm-generated. A separate fresh frozen-lockfile install succeeds against that
exact lock; the actual clean full build, root test typecheck and SQLite core
typecheck pass. No local override or dependency downgrade is included.

### Published row types

The retained generated public-output owner independently requires metadata on
an unmatched facade's empty row and discriminant-specific ordinary union fields.
The old implementation fails 24 campaigns: nullable observations and 96 union
spread comparisons. Optional reserved fields are removed only when required
metadata attaches, and brand removal distributes its existing rule per union
member. All 33 owner tests pass, with 70 states reached by each of 24 histories.
The paired runtime owner passes 1,604 checks and six declaration neighbors
compile. Independent review reruns the 33 checks and declaration neighbors.
An isolated original-intersection mutant fails 24 nullable comparisons; an
isolated nondistributive-brand mutant fails 12 union campaigns. Broader callback
type ownership and installed declaration portability remain separate receiving
boundaries.

### Authored mutation guidance

The accepted mutation law requires server confirmation before a successful
handler returns. The actual error-handling POST example now awaits explicit
refetch. Current prose removes automatic-refetch and returned-txid advice.
Pre-edit extraction reproduces two settled-row failures. Native Vitest 4 runs
pass 134 Query, 56 Electric and 85 shared-control/type checks. The exact original
POST handler mutant executes and fails the settled-row comparison. Independent
review repeats these results. A constructor-compatible Electric mock changes
only the receiving fixture, preserving its model, histories and comparisons;
its earlier Vitest 4 setup failure is retained separately. This evidence covers
selected actual handlers and controlled collaborators, not live services.

### Generated error docs and production messages

Source PRs judge the actual generator against frozen catalogs. The separate
docs PR owns generated-page freshness. Strict read-only stdout and command
wiring repair the old tooling's 12 assertion failures. Exact final-source
results are 39 passes, stdout reception once and catalog comparison once.
Restored-old-generator and command-body mutants produce 10 and two intended
failures respectively. No catalog or oracle expectation changes accompany the
repair. Actual stale-page checks first demonstrate the premise. The unchanged
real ESM/CommonJS erasure script then checks 263 literals, including 22 shared
literals, with development retention and production erasure. Actual Typedoc
generates all 14 output directories with no errors and 15 warnings; the final
generator check passes. All generated files remain confined to disposable
workspaces. This is not a live Actions execution claim.

## Exact source and receiving status

The integrated product/input cut freezes 3,393 entries at 07:06:43 UTC, SHA256
`e3c7f444478fa49412d18f18d44058baf8c2c91cff090f975b5d430d60b49bc2`.
The normal precommit hook then reordered imports in ten test runners. An AST
audit at `6e6034dcb14d35012e1bf41eb035d3c49a52845f` verifies identical import
sets and test bodies: 3,382 entries remain byte-identical, one deletion remains
absent, and ten differ only in import order. Frozen receiving results therefore
do not claim byte equality for those ten runners. CI tests the pushed sources.
The actual initial version CLI succeeds with private existing
GitHub authentication for changelog reads. All 25 actual tarballs validate: 23
versions at `1.0.0-rc.1`, Query `1.5.0` and Offline `1.2.0`; 156 export targets
and 50 wrong-version/missing-export controls run. Packed consumer runtime and
declaration checks, plus final-head CI, remain pending at this record's cut.
A pnpm direct-file receiving attempt cannot resolve unpublished transitive IVM
from the registry; no runtime/declaration comparison runs, so it supplies no
API GREEN. This is retained as a setup-premise limitation, not a product defect.

A separate exact frozen stage runs the actual size command against
`origin/main` at `95460bc875a2259b34eea534e5592a9d0394e73f`. The default nine
package selection saves 665 gzip bytes and 499 Brotli bytes. DB grows 215 gzip
bytes while React, Query and Electric shrink. The typical app saves 276 gzip
bytes; all eight app scenarios shrink. Authoritative inputs still match after
execution. An earlier overlapping version/size attempt is discarded. Tests and
contract documentation grow separately from these shipped-byte measurements.

## Evidence fingerprints

Raw logs and source/tool manifests are retained under the session's
`rc2171-oracle-challenge` evidence directory. These report fingerprints bind
the recorded outcomes; the executable owners retain their contracts and limits.

| Report | SHA256 |
| --- | --- |
| Publisher repair | `94fbcd4e3c77657b79ac1aea973d93d5dc5cab97f3529fd861c8c0a436487eca` |
| Cache repair | `f921b66ea01860b6a948ceec134f4dcb04cf45ebc705ae238ca57f4d78f15156` |
| Offline repair | `dac0746f32ce697fb7595dfbad1e1d3b881e765ad5815645e41c0e43f1219174` |
| Published type repair | `876b4f7620fe93fa59d470fe40066d58da4e95cef7cbebbeb4195501a48b7053` |
| Guidance repair | `7fa678d03b118b1e413568292a378255bcfdd7746b64a24c05970204f010ef15` |
| Error-doc receiving checks | `2c94a4b1388014a3329d80b9e8f852f5e6eb0c4e6cd555ca69ebe5948abb2c29` |

Independent oracle review records all applicable ORC requirements per chunk.
The initial packed instrument has its own bounded independent review and wrong
observation calibrations. Passing package manifests or source-public types
cannot substitute for its still-pending installed API comparisons.

## Post-push receiving checks and mechanical corrections

At `6e6034dcb`, every core, Collection-adapter, SQLite and Offline CI test
group passes. Desktop and cloud/mobile E2E pass. The first pushed cut fails
three fixture gates: a local name conflicts with the private-member mangle
inventory; React's native source typecheck loses an inferred query context;
and relocating CI's pnpm shell launcher breaks its relative CLI lookup.
Browser E2E and the corrected final-head CI remain pending at this entry.

The local array rename passes the actual 1,152-case React owner and the
441-name mangle check. Explicitly deriving the schema receiver's context from
its actual query passes the complete 2,956-case React package and the final
237-case native/focused selection, including 1,728 receiving cuts. Independent
transpilation proves identical emitted runtime code for the context annotation
and alpha-equivalent code for the array rename. Models, histories, comparisons,
cleanup assertions and run budgets stay unchanged. The CI inference failure
does not reproduce locally even before the annotation, so the environmental
cause remains unknown and only a successful actual CI rerun closes that gate.

P06/P07/P13/P14 authored guidance now matches the existing logical-owner,
release-before-reacquisition and same-run `markReady()` no-op laws. Changes to
`src/types.ts` are confined to its `LoadSubsetFn` comment. Scoped validation and
an exact executable-source comparison pass. P08's actual held-receipt callback
witness and P14's discarded child-ready call-outcome observation remain open;
correct prose does not establish behavioral coverage.

The posthook AST audit has SHA256
`92a2a5c7ef45596f27bc669a20b991e7ec7d46529930b7607957fcc7c130223e`.
The schema fixture report is
`892d79f14ff46b2dd14ba8da6033f536d1e0a8ed6f750e68d0a793cd84267090`;
the guidance correction report is
`626e724401575f4149f9857ed886d2274f0c8ab390c60aae537b4de03eccb75c`.
Independent React fixture review retains the original CI RED and locally-green
unchanged baseline rather than claiming a reproduced production repair.

The HTTP fixture now invokes PATH-selected pnpm at its installed path through a
quoted POSIX `exec` forwarder. Nine ordinary controls pass. The unchanged HTTP
owner passes 35 cases with native pnpm and 35 through a relative shell launcher;
all 29 histories reach each declared state once. Restoring the original
relocation fails the actual relative-CLI setup control. This is setup evidence,
not a new product-law RED. Publisher, models, histories and semantic assertions
stay unchanged. Independent replay accepts the bounded correction. Report SHA256:
`219dc2db851d73af211d377d46165f9233f9435ee96e73a1cc0b0c2b8cbbdb60`.

### Initial installed package reception and baseline declaration attribution

The initial candidate artifact cut passes eight installed runtime cells: ESM/CJS × Query/Offline × fulfilled/rejected. The shared mutation-confirmation and restored-settlement comparisons ran through real installed package imports, with 68 checkpoint/control receipts. Both installed declaration formats also pass the shared handler-admission law: 117 candidates and 72 expected negative diagnostics per format, including missing-negative calibration.

The native npm install used a controlled loopback registry serving unchanged actual release tarballs plus seven explicitly cached external repacks. All 11 installed packages have actual metadata/archive HTTP receipts and exact lock version/origin/SRI checks; selected installed exports match the tarballs. This is native installed reception under a controlled registry premise, without a claim about public-registry archive provenance for external repacks.

The original exported-inference witness remains RED in both formats. Exporting the inferred live-query factory produces TS2742 twice (private `query/compiler/types` and `query/live/internal`) and TS4058 (`LIVE_QUERY_INTERNAL`); exporting its inferred Collection value produces TS2742 twice and TS4023. A strict installed same-path baseline from exact fetched main `95460bc875a2259b34eea534e5592a9d0394e73f` reproduces the same diagnostics. This broader unchanged-main declaration-portability defect is preserved for followup, with no production repair or full declaration-compatibility claim. An agent-added narrow `Collection<Row, number>` annotation separately produces TS2322 on both cuts and is an invalid control, not the original product defect.

A separately executed minimal public-view annotation emits without diagnostics in both formats on both cuts:

```ts
type PublicRows = {
  readonly toArray: ReadonlyArray<{ id: number; version: number; value: number }>
}
// receiver is private in this separate control only.
export function annotated(): PublicRows { return receiver() }
```

This preserves only the declared `toArray` view; it does not establish a full-Collection annotation workaround. The original factory remains exported and unannotated in its own preserved witness. The independently inferred Offline executor also emits in both candidate formats.

One supplemental runtime assertion initially expected cleared health slots to be `undefined`; the public `HealthNode` contract requires `null`. That instrument error and original run remain preserved. The authority-corrected assertion received independent review and negative controls before all eight cells were rerun. Initial failed public/direct-file install attempts and a rejected npm update-notifier request in the first baseline lane also remain separate setup evidence, with no product-comparison credit.

Artifacts: `/private/tmp/rc2171-oracle-challenge/o22-initial-frozen-070643/evidence/final-receiving-classification.json` (SHA256 `b8e2e501b3ca87b90ba76f61772d99b9e7272620efa886df8a82ec67bed4d13d`). Original factory source: `/private/tmp/rc2171-oracle-challenge/o22-initial-packed-support/exported-receiver-repro.mts` (SHA256 `c6c8c1da415901f4935f611387e7f6a3234b5f9753544256f0680038dcc1b50d`). Current/main final probe receipts have SHA256 `eb157fdc5f567fc04647d206762d794455a998620adc3d9383abf74e0bfc503c` / `2987feb2620ba1699869b12dbe51c811b6b0e6c389d06a176bf9a417d1827495`; each includes exact factory, const and control source paths.

The tarballs derive from frozen input HEAD `5fa6eca05530bb9e1f4748b7c00ae60976da2808`. All 300 frozen production-source files matched committed `6e6034dcb14d35012e1bf41eb035d3c49a52845f` at the recorded continuity check. Later uncommitted LoadSubsetFn guidance comments and fixture-only edits were not rebuilt in this artifact cut. The scope is the initial candidate cut, not the full four-cut release matrix, hosted Actions, production authentication, browser/native hosts or live providers. Offline receiving seeds durable outbox data through the public OutboxManager, then starts a fresh executor; it does not exercise two actual executors creating durable state.


## Second CI schema-fixture correction

At pushed head `180b920edd6c88a7024ed407cd04934678c7d5bf`, the framework
job still rejects the two actual React schema-hook calls with TS2769. The
previous context annotation did not close that gate. Independent source
checking now reproduces both diagnostics after observing the context and hook
return types before requesting diagnostics. The identical cold program passes.
This is a TypeScript comparison-order distinction, not evidence of different
runtime dependencies. The wider public mutation-input/full-handler problem
also reproduces on exact main; its separate follow-up remains open in the
[scope record](2026-10-29-pr-2171-deferred-oracles.md).

The recorder now declares only the transaction mutation fields it consumes:
key, original, modified and changes. It still records every ordinary payload
field and compares against the unchanged independent model. Original and
corrected runtime JavaScript are byte-identical, SHA256
`3a560ea22d9bbb4f683b695a245869c8b1e71996e97ca35fac4374b5ae549091`.
Actual corrected React and Preact programs pass cold and after type observation.
Injected source-local TS2322 controls still fail in each checked mode. These
controls establish compiler admission, not a new product-law mutant kill.

Native React runs pass 237 checks in three files, including 21 typed cases;
Preact passes 80 in three files, including eight typed cases. React live,
ready-source Suspense and Preact each reach all 864 declared cells exactly once.
Both full raw package typechecks and focused lint pass. No model, grammar,
comparison, cleanup, reach requirement, runtime hook or production behavior
changes. Two independent reviewers accept the bounded correction. Actual
final-head CI remains required; these local results do not close public
mutation typing, typed-schema inference, initial suspension or concurrent/SSR
receiving paths.

Report fingerprints, under the original campaign evidence directory:

- `schema-180-structural-fixture-final-evidence.md`:
  `a3a7710c5420f970b0b7105b780e50e24bebe354b07fd6301d4c4ee180ba3ed2`.
- `schema-structural-driver-independent-review.md`:
  `00456d80b6e356a77c93cc2df67f57961d7dbee075413684b9e4c039c9aa2540`.
- `schema-structural-handler-second-review.md`:
  `3c8a12ceada729cee932ff7090f486932c65175239fff76a371904cc800d2fd8`.


## SQLite generated reach correction

At `180b920ed`, all 40 random histories complete their public comparisons,
but the campaign fails because none reaches an aborted-only demand. The
post-campaign guard did not preserve its seed. Unchanged native seed 18
reproduces that reach failure after 40 comparisons; this is an honest grammar
gap, not a production mismatch.

The original unrestricted history grammar and 40-run budget remain unchanged.
Each normal campaign adds two generated packs of nine legal histories. Every
pack independently requires all 15 existing reach states through the unchanged
production driver, independent model and comparison. The required packs have
their own registered seed/path replay coordinate. Seed-only full campaigns
still enforce reach; direct path replay runs only its selected property. The
native failure formatter now preserves the actual campaign seed and cause.

The complete native owner passes five tests. Fixed and fresh-random campaigns
each run 40 unrestricted plus 18 required histories and pass in 90–92 seconds.
The formerly failing seed 18 now passes. Direct original and required-property
replays pass separately; independent review observes the required replay's
single guarded witness and all 15 states. Removing abort from the required
pack fails its own reach requirement. Removing the production abort fence in
an isolated host fails the actual offline status comparison: expected loading,
observed ready with a row. Independent review repeats both controls.

Only the two outer campaign timeouts increase from 120 to 180 seconds to allow
for the additional histories. Internal deadlines, observations, comparisons,
minimum reach and cleanup remain unchanged. Scoped source types, full ESLint,
oracle admission and the run-budget audit pass. No executable production or
model changes enter this correction. Controlled Node SQLite observations do
not establish arbitrary-history, browser or live-provider behavior.

The author report `demand-reach-final-evidence.md` has SHA256
`cacc43eac3d276157606aefa09136a479e41e8be7db2b79dd805e60bee48ef68`.
The final source freeze is
`f2d80fbb4d1f2c2b82cbb0451b3d352b5f4cf1240017e63e45c9f6a0a96887ab`.
Both are retained under the original campaign evidence directory. Actual
final-head CI remains required.

The independent verdict `demand-reach-independent-review.md` has SHA256
`45c2e7d843a6ebd4c3898957c1b4d698450341beda8af8382b13e72959060e43`.
It binds the copied source hashes, direct replay, both intended control failures
and the two outer timeout literals.


## Named replay registration receiving correction

CI on `d9911f17b` passes 40 of 41 replay controls but rejects the new
`persisted-demand-coverage.required` coordinate as `no-named-owner`. Earlier
direct Vitest replay proved the property and its guard could run but bypassed
the repository's manifest-to-command lookup. The existing independent manifest
check correctly catches this integration omission; its expectations stay intact.

Adding `required` beside `history` in the existing owner entry repairs that
lookup. No production, model, grammar, guard, comparison or budget changes.
The author reproduces the manifest RED, then passes all 41 existing replay
controls. Author and reviewer each execute the actual repository named replay
CLI through the default SQLite package config at required/seed18/path0. Both
runs emit exactly one successful matching guarded witness with numRuns1.
The reviewer also independently reproduces pre-edit CLI rejection and passes
all six manifest controls. A custom runner alone no longer supplies the claimed
named-command receiving evidence. Hosted final-head CI remains required.

Author evidence `demand-registration-author-evidence.md` has SHA256
`3cd8bb335a916fc073a7ae2139aa104e9351ad4f75d22ee99a2c44b8a2c218d9`.
Independent verdict `demand-registration-independent-review.md` has SHA256
`b22e5109bd08f0436d9fcc62d78de5d26da686584b9a2882e626621f66177385`.
The manifest source hash is
`3f1c724c48171b94413c787021d9d948212bdd28edcd84e783996b86722ac9eb`.
Evidence remains in the original campaign directory.


## Formatting continuity and later CI discoveries

The formatting bot's `d9911f17b` changes only the schema recorder's callback
parameter layout and optional trailing comma. Its TypeScript output differs
only by that comma; minified runtime output is byte-identical. Strict raw-output
hash checks initially reject the formatting difference, and the retained audit
records both hashes and the exact normalized difference. Audit
`release-autofix-d9911f17b-audit.json` has SHA256 `16c36655accb99744919b7e4d97a9e035f6a85b85f13ac2ccf900d4ea9b87f6b`.
No product code changes in that bot commit.

On this cut, framework and SQLite core CI pass. The replay manifest omission
above and source-health's missing random reach still fail separate gates.
DB core also finds a retained-publication mismatch that independently
reproduces on exact main. Its active oracle remains unchanged, and the
[scope record](2026-10-29-pr-2171-deferred-oracles.md#shared-source-replay-with-late-include-demand)
preserves that open baseline defect. A later passing random run cannot close
its recorded counterexample. Final-head CI and release readiness are separate
judgments from this deferred class.


## Source-health structural reach correction

CI seed -2135407433 passes all 60 original source-health history comparisons
but never selects the opt-in snapshot prefix. The unchanged campaign reproduces
its afterAll RED: snapshot outside reload, markReady after fail and blind insert
of a kept key during reload each have zero reach. The established snapshot,
reload and source-health laws remain unchanged; this is missing sampling reach.

The additive `source-health.required-history` lanes execute every one of the
nine existing structural prefixes, followed by 0–12 generated existing steps.
Each fixed/random lane runs six cases, independently enforces all 26 declared
states and reaches every state at least six times. Required cases use join or
nested contexts with direct subscribers. The unchanged original 60 random
histories retain all six shapes and both subscriber choices. Models, driver,
public comparisons, named histories, original grammar and budgets stay intact.
Both replay registries and selectors include the new coordinate, preserving
the separately accepted SQLite required mapping.

Author and independent reviewer each pass the complete 506-test owner and
scoped TypeScript checks. Actual default-config named CLI replay selects the
new coordinate with one matching successful receipt at seed -2135407433/path0;
all four existing coordinates also execute in author checks. Global manifest
controls pass six tests. Prettier, scoped lint, changed-oracle lint and the
441-name mangle check pass. All 154 DB/IVM production source files match d991.
No executable production repair enters this change.

Omitting a required prefix rejects its lane's missing reach. The fixed-only
ablation fails even when the other lane covers the aggregate. A scratch-only
snapshot mutant preserves begin but merges commit; the guarded CLI rejects
public Collection rows at step3 commit, actual [[1,1]] versus expected [].
Restoring production passes the captured seed/path0:0. The restored formerly
shrunk path reports one property receipt and ten fast-check runs, which are
preserved rather than reported as one history. These are assertion failures,
not setup failures. Independent review repeats both sensitivity checks.

This closes the bounded sampling gap for the owner's declared premises, not
all source-health, provider, framework or concurrency behavior. Author evidence
`source-health-reach-repair-evidence.md` has SHA256
`0a711cfeeb1f3e3ef5d6bd4270f2f74a3b3532edb08c4c9790df537cf9a2f62e`.
Independent verdict `source-health-independent-review.md` has SHA256
`51693ba468e03c347988877d865faf0328bc8a637f2364eafa3a963dd6e80023`.
Both remain under the original campaign evidence directory. Actual final-head
CI remains required, and the independently confirmed baseline replay defect
above stays open under the documented release scope.