Equality identity oracle review

Reviewed executable commit: 7f8617a474a8fa94c30586869c4695e819ac069b. The review checked GAP-07 from the code-weight audit. Its sole claim was a missing agreement test between D2 equality-value keys and query IR equality operands. The code review also found that the first generated grammar lacked unequal Date, Temporal, and byte pairs. Both coverage gaps are fixed in the reviewed commit. No product mismatch appeared in the tested domain.

Law and evidence boundary

Two values belong to the same D2 equality key exactly when their equality operands have the same query IR identity. The pair grammar declares equality before it calls either identity path. It checks both keys and the compiled equality predicate when each key is constructed. Nullish predicate results are null, although the two identity keys remain distinct.

The fixed cases cover signed zero, NaN, invalid Date, Date/timestamp, nullish values, BigInt, infinities, reserved-looking strings, empty binary values, Temporal types and dates, typed-array constructors, symbols, and functions. The generated cases vary primitive values, valid Date timestamps, Temporal dates, byte content and length, and nested references. Fixed and sampled pairs do not establish universal agreement for arbitrary JavaScript values or hash collision freedom. Ref proxies are expressions, not literal values here.

Oracle guide audit

Requirement	Outcome
ORC-001 Contract	getEqualityValueIdentity promises the equality relation for keyed state. Query IR equality operands preserve that relation for query reuse. The bounded domain and omissions appear above and in the coverage map.
ORC-002 Independence	Each pair carries its expected relation before production runs. The expected result does not call normalizeValue, either identity path, or the predicate evaluator.
ORC-003 Responsibilities	The oracle file states the law, pair model, value grammar, two key drivers, predicate driver, and key-construction check together.
ORC-004 Grammar	The fixed cases reconstruct the audit's signed-zero and binary examples. Equal and unequal generated Date, Temporal, and byte pairs distinguish value equality from broad collapsing. The bounded Date range stays 1,000 ms inside valid endpoints. Temporal days vary within January and cross a month boundary. Byte lengths span 1–140, with empty bytes fixed. Removing an axis loses its type boundary. Ref proxies are excluded because the IR treats them as expressions.
ORC-005 Path and observation	The check calls the real D2 key path, the real IR demand-key path, and compileExpression. It observes key equality and predicate output immediately after construction.
ORC-006 Calibration	An IR signed-zero mutant failed the fixed signed-zero assertion. A constructor-sensitive binary mutant failed on empty Buffer versus Uint8Array. A binary-content collapsing mutant failed the generated IR-key assertion on Buffer [0] versus Uint8Array [1]. Each result was an assertion failure at the intended checkpoint. The mutants were reverted.
ORC-007 Campaign and replay	The package oracle command includes the file. Fixed seed 20260928 and a seedless campaign use the same property and 160-run budget. The named replay manifest owns query-identity.equality-partition. Guarded replay of seed 20260928, shrink path 1:0:0, selected the property and reproduced the binary-content collapsing mutant.
ORC-008 Model state	Not applicable. The pair relation has no state or next action.
ORC-009 Vocabulary	EqualityPair is a model-only description of two values and their declared relation. D2 key and IR operand key name the two production observations.
ORC-010 Failure fidelity	The property has no acquired resource to clean up. Fast-check shrank the binary-content mutant to one differing byte and kept the IR-key assertion as the primary failure. Guarded replay retained the same binary-content failure.
ORC-011 Second formulation	The declared relation checks each identity independently. The compiled predicate supplies a third observation of the same declared pair without serving as the model. This detects a shared identity error against the declared relation.
ORC-012 Review record	This record names every applicable requirement, the reviewed executable commit, controls, limits, and replay evidence.

Verification

The final oracle file passed 32 tests. The neighboring identity tests and named replay manifest checks passed in the focused run.
TypeScript, ESLint, Prettier, and git diff --check passed on the reviewed executable commit.
The three temporary mutants failed by assertion. None timed out or failed during setup.

External-review follow-up

Reviewed executable commit: f83aaedb9cf267f1997152641442bc6f29bce453. The earlier record above applies to 7f8617a4. The later PR head ff90c360 added only that record. The external review then called the PR test-only and clean with zero findings. The production diff remains zero, but the zero-finding verdict missed four oracle evidence gaps:

ORC-004: The generated string branch originally compared a string only with itself. A mutant that collapsed all primitive strings to one D2 key passed all 20 equality checks. The first repair added unequal strings but only with different lengths. A first-character-plus-length key mutant then passed all 40 equality checks. The final grammar includes empty/equal strings, different strings, and same-prefix, same-length unequal strings. The fixed ab/ac pair and generated unequal pairs both reject that mutant.
ORC-005: Fixed pairs now run a public live-query groupBy. After initial publication, the check compares group count and row multiplicity with the declared pair relation. Under the first-character-plus-length mutant, the ab/ac public result had one group instead of two. The generated key check still observes internal identity, and no end-to-end subscription test proves subset-demand reuse. The coverage map assigns that witness to this owner.
ORC-007: The original replay evidence omitted its command and test-name filter. The direct command below selected one property execution. With the first-character-plus-length mutant it reported failed:true, at the D2-key assertion, for seed 20260928 and path 8:0:0. After reverting the mutant, the same command reported failed:false.
ORC-012: This entry identifies the exact executable commit reviewed for the follow-up. Any subsequent record-only commit does not change that code.

From packages/db, the direct replay command is:

shell

TANSTACK_DB_ORACLE_PROPERTY=query-identity.equality-partition \
TANSTACK_DB_ORACLE_SEED=20260928 \
TANSTACK_DB_ORACLE_PATH=8:0:0 \
node --import tsx tests/oracle-replay.ts \
  tests/query/identity-output-shape-oracle.test.ts \
  -t 'agrees across the supported value grammar, seed=undefined' \
  --maxWorkers=1 --coverage.enabled=false

The fixed-seed mutant campaign failed after nine cases and shrank to left: " ", right: " a". The guarded replay reached one execution and preserved the same failure class. All temporary mutants were reverted. The clean oracle passed 56 tests, the guarded replay and manifest suite passed 27 tests, and ESLint, Prettier, and git diff --check passed. The additional public path covers the fixed value pairs at initial publication; it does not close the mapped subset-demand reuse cell.

Main merge verification

Reviewed merged executable commit: d4f0507892584a2e59e96baea498989c41a2ae21. The merge kept the query-identity coverage note and main's SQLite coverage notes. It changed no query-identity oracle or runtime source from the follow-up reviewed above. At the merged commit, the oracle passed 56 tests, the direct seed 20260928 and path 8:0:0 replay completed one execution, and Prettier and git diff --check passed. The next record-only commit adds this entry and changes no executable code.

Current-main merge verification

Reviewed merged executable commit: c795bf24f417ac6342e8c45c19e5175d8a625e13. This normal merge brought in origin/main at 63362dc8 and retained both the query-identity coverage note and the newer coverage and oracle registrations from main. It made no query-identity runtime or oracle changes. The merged oracle passed 56 tests. Direct seed 20260928, path 8:0:0 replay selected one property execution and reported failed:false. ESLint, Prettier, and git diff --check passed.

For calibration, I temporarily changed the D2 equality key for primitive strings to either one constant or the first character plus length. Each mutant made the generated seed check fail at the D2-key assertion. Each also made the public ab/ac grouping check show one group instead of two. A direct replay of the first-character-plus-length mutant selected one property execution and reported failed:true at the same-prefix string assertion. Both mutants were removed after their RED runs. The later record-only commit changes no executable code.