DEC-03 window-overlap oracle review#

Reviewed semantic head: f42fbcf4a642bc936e91309241137325c6f034e3 (branch codex/audit-dec-03). Base: 33a194941c8d51f8f98babb999fef2987dd6ff8b. Owner: packages/db/tests/conformance/infinite-suite.ts, instantiated by the React, Vue, and Svelte receiving drivers.

Decision and boundary#

The maintainer chose this rule: after a failed preload overlaps a successful page request, hasNextPage follows the latest committed page count. The failed preload's error remains visible until explicit recovery. The earlier behavior forced continuation to false on the later page success. The fix recomputes continuation in the asynchronous page-success branch.

The bounded contract is finite ordered source rows × a page size of two × a failed initial-window preload × a successful second-page window × a public snapshot after each settlement. Four rows distinguish exact exhaustion; five rows distinguish a remaining row. The two settlement orders distinguish a failure followed by success from success followed by failure. Each history also checks explicit recovery. The model derives visible rows, page boundaries, params, continuation, status, and error from the source length, committed page count, and the chosen error lifetime. It does not copy the controller's failedHasNextPage cache.

The production driver calls the exported DB window controller in each package realm. It uses a real ordered live-query Collection and controls the two setWindow results with Promises. It checks the exact limits 3 and 5, then compares public snapshots at 12 checkpoints per driver. Current framework hooks expose fetchNextPage but no preload, so this test does not establish the same overlap through a hook. Adjacent shared scenarios retain hook paging coverage.

RED, GREEN, and hostile controls#

On unchanged production, the new shared cell failed in React, Vue, and Svelte at the failure-first, five-row final checkpoint: expected hasNextPage: true, received false. This was an assertion failure on the public snapshot. After the one-branch production change, the DB controller suite passed 75/75 and the package-local conformance suites passed React 36/36, Vue 38/38, and Svelte 38/38. The DB build, changed-file ESLint, Prettier, and git diff --check passed. Package-local Vitest configuration is required for the React and Svelte receiving suites.

Temporary wrong-design controls were built and tested, then removed:

• Restoring the asynchronous success assignment to false failed at the five-row continuation assertion.
• Leaving the failed continuation frozen through asynchronous success failed at the four-row exact-exhaustion assertion (true versus false).
• Clearing the error on later success failed the earlier Error identity assertion (undefined versus the sentinel Error).

A review suggested testing an additional synchronous page-success branch. A legal synchronous-success cell was reached by preparing the physical five-row window first. It passed with the synchronous assignment changed back to false: that mutant survived. The assignment was therefore removed from the fix. At synchronous success, requestPageCount has cleared an earlier error; a still-pending preload failure can run only after that synchronous call and then recomputes continuation itself. The surviving mutant and execution order make the synchronous assignment irrelevant to the reported public failure state. This does not claim all synchronous window behavior is covered.

ORC-001 through ORC-011#

This record supplies ORC-012 evidence for semantic head f42fbcf4a642bc936e91309241137325c6f034e3. It claims closure only for a failed initial preload overlapping an asynchronous second-page success on finite ordered local rows at the stated checkpoints. The coverage map retains framework hook scheduling and other acquisition paths outside this owner; a reachable counterexample there would require a separate witness.

Follow-up: subscribed source updates under a retained error#

Reviewed semantic head: 29d46e184981a2841d60e814904571642c81a021. This section preserves the earlier exact-head decision above. It extends the same direct-controller boundary after both overlap settlements, while the earlier pagination error remains visible and a controller subscriber is active.

The source-length model now checks a later insertion of the fifth row after a four-row overlap and a later removal of the fifth row after a five-row overlap. The observer must first publish the changed rows in the live-query Collection. At that checkpoint, the public controller snapshot must retain the original error and update hasNextPage to match the committed two-page prefix and the current source extent. Both settlement orders are included, followed by explicit recovery: four histories and 16 public checkpoints per receiving driver. An unsubscribed controller has no observer-update claim.

On the prior head, insertion produced five published rows and retained the error but reported hasNextPage: false instead of true; removal produced four rows and reported true instead of false. Both were public assertion failures. The permanent shared conformance cell failed on the original implementation at the first insertion checkpoint. The fix refreshes the cached continuation on a ready observer notification while a pagination error is visible, without changing the error lifetime. After the fix, targeted overlap cells passed in React, Vue, and Svelte; the DB controller suite passed 75/75, and full receiving suites passed React 36/36, Vue 38/38, and Svelte 38/38. Changed-file ESLint, Prettier, and git diff --check passed.

Two temporary synchronous-success probes also reached literal-true page success. One held an earlier preload failure until after synchronous page commit; that later failure recomputed continuation correctly. The other began with a visible error, which cleared before synchronous page commit. Both passed and were removed. They support the earlier record's narrow statement that the surviving synchronous-assignment mutant does not cause the reported retained-error failure; they do not claim complete synchronous-path coverage.

This follow-up supplies ORC-012 evidence for semantic head 29d46e184981a2841d60e814904571642c81a021. It closes the subscribed, ready-observer source-update cell for these finite ordered rows and public checkpoints. Framework hook overlap scheduling and other acquisition paths remain outside the claim, as recorded in the coverage map.

Follow-up: detached snapshot reads under a retained error#

Reviewed semantic head: fa5a3185 (branch codex/audit-dec-03). The earlier sections retain their exact-head claims. This follow-up extends the same shared conformance owner to a controller with no active subscriber. The preloaded live query retains a five-row physical window. After a subscribed source update and unsubscribe, a second source write reverses the fifth row's presence. A direct getSnapshot() read must derive continuation from those current rows while preserving the earlier error until explicit recovery. Four or five source rows cross both settlement orders. The shared model still computes its answer from source length and committed page count, not the controller's cached value. The cell now checks 20 public snapshots in each receiving driver.

At parent head 0b0ca99c, React's public snapshot had the correct four rows and retained error after the detached removal, but hasNextPage remained true instead of false. The same oracle was green after moving continuation recomputation from the subscriber callback into getSnapshot(). It also covers the reverse four-to-five-row transition. The DB controller suite passed 75/75, and the full receiving suites passed React 36/36, Vue 38/38, and Svelte 38/38 before the final one-line simplification. The DB package was built before the Svelte run, which imports its built entry point. After that simplification, the DB suite passed 75/75 and the focused shared cell passed in all three receiving drivers. Changed-file ESLint, Prettier, and git diff --check passed.

A separate temporary control reached the synchronous page-success assignment with a held earlier preload failure. Replacing that assignment with a throw failed at the intended line; changing its value from false to true left the public error snapshot correct because the later failure recomputed continuation. Both controls were restored, then the dead synchronous write was removed. This supports only the stated execution order; it does not prove every synchronous history equivalent.

The rereview's broader explanation that every error-entry path recomputes continuation is too strong. The requestPageCount synchronous throw and asynchronous rejection paths preserve a captured previousHasNextPage value. Those paths do not read the dead synchronous assignment. Their distinct overlap histories are not established by the diagnostic probe above.

ORC-001 through ORC-003 remain grounded in the maintainer's overlap decision, the source-length model, and the adjacent shared contract/model/driver/check. ORC-004 and ORC-007 remain inapplicable because the four histories form an explicit bounded matrix. ORC-005 reaches the exported controller in all three package realms and compares rows, pages, params, continuation, fetching, status, and error at the detached read. ORC-006 is supported by the original RED result and the same-path synchronous controls above. ORC-008 is inapplicable because the reference has no mutable state. ORC-009 maps pageSucceeded and preloadFailed as in the earlier section. ORC-010 retains the scenario's controlled gate release and cleanup. ORC-011 remains inapplicable within this direct-controller boundary because no new plausible shared semantic fault requiring a second formulation was identified. This section supplies ORC-012 evidence for the named semantic head.

The added claim covers a detached getSnapshot() after the preloaded source publishes a change within a retained physical window. It makes no notification claim without a subscriber. Hook scheduling, arbitrary provider acquisition, and other source-state transitions remain outside this cell.

Post-merge validation#

Semantic head 5dfd32c7 merges current origin/main through e16d46ce without changing the controller or its oracle. On that merged head, the DB build passed; the controller suite passed 75/75; and the full React, Vue, and Svelte receiving suites passed 36/36, 38/38, and 38/38. Changed-file ESLint, Prettier, and diff checks passed. The full PR's controller source diff against the merge base is 9 additions and 10 deletions: net minus one production line.

Main later advanced to 68f0b65c. Merge head 3e930add preserved the window-controller coverage row and main's new hash-oracle row. The controller and shared conformance owner did not change in this merge. The DB build and full DB, React, Vue, and Svelte suites passed again at the same counts.