# Content temporarily unavailable
# Index unit retirement: nullish exact membership

The source-isolated loss audit used baseline `73a5d4ec4`. The receiving owner is
`packages/db/tests/index-update-oracle.property.test.ts`. No source block below
was an exact witness in that baseline: its generated update values were numeric,
and its fixed nullish case read ranges and cursors rather than equality buckets.

## Transfer ledger before retirement

| Legacy block | Smallest source state and direct action | Exact source observation and law | Plausible wrong result |
| --- | --- | --- | --- |
| `index-update-short-circuit.test.ts`, `does not conflate undefined and null` | BasicIndex and BTreeIndex: fresh `a=undefined`; update `a→null` | At update return, `lookup('eq', undefined)=∅` and `lookup('eq', null)={a}`. The title states distinct exact membership. | A loose-nullish shortcut leaves `a` in the old bucket; a dispatch that returns the comparator group includes it in both. |
| `btree-index-undefined-values.test.ts`, `should update item from defined to undefined value` | BTreeIndex: fresh `a=1`; update `a→undefined` | At update return, `equalityLookup(1)=∅` and `equalityLookup(undefined)={a}`. | The old key retires but the new undefined key is lost. |
| Same file, `should update item from undefined to defined value` | BTreeIndex: fresh `a=undefined`; update `a→1` | At update return, `equalityLookup(undefined)=∅` and `equalityLookup(1)={a}`. | The new key arrives but the undefined membership remains. |
| Same file, `should update item from undefined to undefined (same value)` | BTreeIndex: fresh `a=undefined`; update `a→undefined` | At update return, `equalityLookup(undefined)={a}`. This checks conservation, not bucket identity. | Remove without re-add drops `a`. |
| Same file, `should handle mixed undefined and null values` | BTreeIndex: fresh adds `null1=null`, `undef1=undefined`, `num1=1` | The two exact lookups return their respective singleton sets. The block checks no ordering despite its enclosing heading. | Returning the shared nullish comparator group for either value includes the other key. |

The BTree file's opening infinite-loop and sentinel comments concern traversal;
they do not establish an equality law. `IndexInterface` exposes both lookup
methods, and the established direct-index tests distinguish nullish exact
values. The receiving oracle already states the separation between exact
membership and comparator position. This transfer is limited to direct index
methods. A live-query WHERE comparison with a nullish operand follows
three-valued logic, so it is outside this law.

## Receiving law and evidence to check

A plain source `Map` retains each key's exact value. The oracle recomputes
equality buckets without index normalization or comparator classification.
It drives each source action through BasicIndex and BTreeIndex and checks
`keyCount`, indexed keys, `equalityLookup`, and `lookup('eq')` after return.
Five fresh singleton or coexisting-add histories reconstruct the source cases;
an additional `null→undefined` singleton and fixed/random put/delete histories
challenge nearby legal transitions. The generated domain is three keys and
`undefined`, `null`, `1`, `2`. A direct update of an absent source key is
excluded; the driver uses `add` for that source action.

A skipped `undefined→null` update and a wrong `lookup('eq')` union are intended
to fail the model comparison. Both controls must reach the relevant method and
fail at the returned-action lookup assertion. The nullish scope does not imply
ordered, range, `IN`, live-query, bucket-identity, or instrumentation coverage.

## Execution and hostile review

The reviewed code head is `0d21a22ec56bc06a47776690d7cdbfded0ae9acc`.
The five ledger blocks were removed at that head; no other test block in either
source file was retired. The oracle and both remaining source files passed
411/411 targeted tests with zero type errors. The named replay manifest's
selector tests passed. Fixed seed `20261012` and a seedless campaign each run
the same nullish property with 100 histories per index type. Guarded replay at
seed `20261012`, path `0` selected only the BasicIndex and BTreeIndex random
lanes and recorded one completed 100-run witness for each.

The in-test skipped-update and unioned-lookup controls fail at the intended
Map-versus-lookup assertion. For replay failure fidelity, a temporary wrong
expected rule treated every `undefined` bucket as empty. It failed the
`equalityLookup(undefined)` comparison with seed `20261012`, shrink path
`0:1:1:1:1:1:0`, and counterexample `put(a, undefined)`. The guarded replay
reached one BasicIndex witness, marked it failed, and exited nonzero. After
restoring the oracle, that exact replay passed. This was a temporary model
fault for replay calibration, not a production mutant or a production bug.

The independent hostile reviewer `/root/review_nullish_membership` first found
that the new property lacked a checked replay manifest entry. That setup
failure was not counted as an oracle kill. The manifest entry, selector, and
async property reporter were repaired. The reviewer rechecked the committed
head after the commit hook and found no remaining semantic blocker. No
production defect was demonstrated, so production code did not change.

## Oracle guide audit at the reviewed head

| Requirement | Outcome |
| --- | --- |
| ORC-001 | The established direct-index tests and `IndexInterface` exact-lookup methods supply the law. The claim excludes live-query WHERE nullish equality and the other observations listed above. |
| ORC-002 | A native source Map computes exact buckets without production normalization, comparator classification, or index storage. |
| ORC-003 | Opening prose states the law and limits; adjacent prose names the Map rule, legal actions, real index methods, observed sets, and returned-action checkpoint. |
| ORC-004 | Five fresh histories reconstruct the old witnesses; the adjacent `null→undefined` case and generated put/delete histories add nearby states. Removing either nullish value loses the distinguishing law; removing defined values loses defined/nullish moves; one key loses surviving-peer histories. The domain is three keys, four values, and at most 40 generated actions. An absent-key direct `update` is excluded because the source driver calls `add`. |
| ORC-005 | Both index types call real `add`, `update`, and `remove`, then compare exact returned sets and key count after each action. The fixed histories reach all five source states. |
| ORC-006 | A skipped `undefined→null` update and a unioned `lookup('eq')` result each cause an assertion failure at the exact-membership check. |
| ORC-007 | Fixed and seedless campaigns share one property, generator, recorder, comparison, and 100-run budget. The named guarded replay reaches the requested seed/path, and a captured controlled failure replays as a failed witness. |
| ORC-008 | The Map keeps key/value ownership because a later update or delete can distinguish sources with equal bucket sizes but different owners. |
| ORC-009 | `put` is a model source action mapped to index `add` or `update`; `delete` maps to `remove`. The shared terms `history`, `observation`, and `checkpoint` follow the glossary. |
| ORC-010 | The wrong-result spies restore in `finally`; the replay guard retains the failure witness separately from process status. No external resources are acquired. |
| ORC-011 | No plausible shared semantic fault requiring a second formulation was identified for the bounded nullish Map rule. Ordered comparator behavior is deliberately outside it. |
| ORC-012 | This record names the exact reviewed code head, audit result, controls, execution, and remaining scope. |
| ORC-013 | The `undefined→null` singleton and coexisting null/undefined adds distinguish no-op update and bucket-union alternatives at returned-action lookup checks. |
| ORC-014 | No controlled provider or host premise supports a claim about a real provider or host. |

The next nullish candidates need their own observations: ordered and cursor
reads, `IN` union, custom comparator arguments, and the public live-query
path. The remaining source tests continue to own their exact assertions until
those transfers pass the same gates.