Ordered Effect startup oracle review

Reviewed state

Base commit: 33a194941c8d51f8f98babb999fef2987dd6ff8b.
Reviewed change: the Git tree containing this record, the ordered-work oracle extension, and the coverage-map update. The eventual commit and pull request identify that immutable tree.
Primary executable owner: packages/db/tests/query/ordered-work-oracle.property.test.ts.

A file cannot contain the hash of its own commit. This record fixes the comparison base and the changed tree's contents.

Claim and limits

The live-query architecture requires ordered Effect callbacks to retain the last complete result while an authoritative repair advances the private D2 graph. The first callback after startup must represent the completed ordered window, even if another source's subscription synchronously changes the ordered source before all subscriptions exist.

The fixed history begins with two numeric ranks and an indexed width-one request. The first request installs row 1. Subscribing to an empty sibling source then updates row 1 from rank 1 to rank 3. The independent final order is row 2 at rank 2, then row 1 at rank 3. The Effect must emit one enter for row 2. A transient enter for row 1 violates the callback-publication gate.

This witness covers one synchronous update through an in-memory on-demand source, a direct LEFT join, and one indexed ordered request. It does not prove other source orders, multiple buffered changes, asynchronous changes during startup, or remote provider ordering. Those nearby histories remain with the ordered-work owner in the coverage map.

ORC-001 through ORC-011

Requirement	Outcome	Evidence
ORC-001: contract authority and limits	Pass	The architecture's ordered request and Effect callback gate sections authorize repair before callback publication. This record bounds the witness.
ORC-002: independent judgment	Pass	The two-row numeric rank order and expected single enter come from the source truth Map, not the ordered loader or D2's comparator.
ORC-003: distinguishable responsibilities	Pass	The oracle header states the law. The fixed-history comment states the model and schedule. The two Collections and createEffect drive production. Exact batches and the repair request are checked after startup and microtasks settle.
ORC-004: generated-history grammar controls	Not applicable	This adds a fixed controlled history to an existing oracle; it does not claim generated coverage for this startup schedule.
ORC-005: production path and observation	Pass	The sibling subscribeChanges hook checks the first ordered request, its one-row limit, and row 1's installed source value before the synchronous rank update. It records that the hook ran. onBatch captures every public delta batch.
ORC-006: checker calibration	Pass	Replacing the buffered drain's handleSourceChanges call with direct sendChangesToD2 fails the exact batch assertion. With the final provider fixture, the mutant emits enter for row 1 instead of row 2. This is an assertion failure at the callback checkpoint.
ORC-007: fixed/random campaigns and replay	Not applicable	The new lane is a fixed witness. It does not change the existing generated ordered-work campaigns or replay interface.
ORC-008: stateful-model minimality	Not applicable	The witness adds no state to an existing reference model.
ORC-009: vocabulary mapping	Pass	Source Collection, ordered request, repair, private D2 graph, and Effect callback use the architecture and project glossary meanings. The source truth Map is fixture data, not a second production lifecycle.
ORC-010: failure fidelity and cleanup	Pass	withHistoryCleanup preserves a primary startup or batch assertion while disposing the Effect and cleaning both Collections. The recorded mutant reached the batch comparison.
ORC-011: independent second formulation	Not applicable	No plausible shared semantic fault in the two-row numeric order needs a second query formulation for this callback-gate claim. The public batch and provider repair request give separate observations of the same startup history.

ORC-012 is satisfied by this base-identified review record and its link from the coverage map. The pull request records the final immutable commit.

Verification

On the unmodified production code, the focused witness passes. Both ordered owners pass 340 tests. The @tanstack/db-ivm and @tanstack/db builds, tsc --noEmit -p packages/db/tsconfig.json, and changed-file ESLint pass. The temporary mutant was restored before the green run.

External review follow-up

The review of local and remote-tracking commit 72aa5af26513e725dfdaae84e11d810cf42b8070 found three test/release hygiene issues. The PR adds no published code, so the patch changeset was removed under the repository's release guidance.

The startup test used one flushPromises() turn before comparing batches. An adversarial callback that queued a duplicate batch through two nested timers passed that comparison. Draining the controlled timer queue before the exact batch comparison made the same wrong callback fail. The synchronous provider fixture schedules no later external work, so that queue drain is the test's callback observation cut.

The sibling-subscription hook also applied its rank update on every call. One extra subscription after Effect startup failed at the row-rank setup assertion, and one before startup failed at the ordered-request setup assertion. The hook now applies the update only on its first invocation after the initial ordered request. Both extra-subscription probes pass with that guard, while the existing changedDuringStart and exact batch assertions still require the intended history and public result.