Index unit retirement: exact and IN membership

The source-isolated Field Lab loss audits used b56d1a45c as the frozen baseline. The receiving owner is packages/db/tests/index-update-oracle.property.test.ts. Its prior nullish Map law checked equalityLookup and lookup('eq'), but explicitly excluded IN. The four legacy blocks below were retired at reviewed code head d880f3139bbbba7141dc658d84d3602217c2960f.

Transfer ledger before retirement

Legacy block in btree-index-undefined-values.test.ts	Smallest source history and returned-add observation	Plausible wrong result	Receiving witness
should find items with undefined indexed value	Add a=active, b=undefined, c=inactive, d=undefined on status; equalityLookup(undefined)={b,d}.	A lookup drops one of the two owners or includes a string peer.	The fixed four-add string history computes every exact set from a source Map after each add.
should return empty set when no undefined values exist	Add a=1, b=2; equalityLookup(undefined)=∅ in a nonempty index.	A missing-bucket fallback returns a defined key.	The fixed all-defined history reads the absent group after both adds.
should handle undefined in inArrayLookup	Add undef=undefined, one=1, two=2, three=3; inArrayLookup([undefined,1])={undef,one}.	The method ignores the undefined operand, returns only one group, or includes a distractor.	The fixed four-add history and mixed-list probe compare the full set from the Map.
should handle inArrayLookup with only undefined	Add undef1=undefined, undef2=undefined, one=1; inArrayLookup([undefined])={undef1,undef2}.	An undefined-only list returns empty or loses one owner.	The fixed three-add history and singleton-list probe compare the full set from the Map.

The IndexInterface exposes direct exact and IN methods. A source Map owns keys and values; equality selects one exact-value group, while IN selects keys whose source value occurs in its operand list. The expectation does not call either production lookup, normalized-key helper, or comparator. The driver checks both direct methods and lookup('eq')/lookup('in') for BasicIndex and BTreeIndex after each source action returns. A generated three-key, five-value put/delete grammar checks nearby transitions with empty, repeated, both orders of a mixed list, and nullish-only operand lists. The fixed four-key and string histories preserve distinctions outside that domain.

This is a direct-index set-selection law. It does not specify live-query WHERE or IN nullish semantics, ordered traversal, range lookup, bucket identity, or instrumentation. The index-update-short-circuit.test.ts block that also calls lookup('in') stays: its performance.now non-call assertion cannot be observed by this result oracle. The BTree file's traversal, range, custom comparator, storage, and live-query blocks also stay.

Execution and hostile review

The four ledger blocks were removed; the BTree file now has 12 tests instead of 16. The receiving oracle, the remaining BTree file, and the short-circuit file passed together: 423/423 tests and no type errors. The receiving oracle's fixed-seed and seedless campaigns use the same 100-run property for each index type. The guarded replay for index-update.nullish-membership at seed 20261012, path 0 reached two executions, one per index type, with 100 runs each. The named replay manifest checks passed.

The in-test wrong-result controls make a lookup lose one undefined owner, drop the trailing undefined operand in [1, undefined], lose one owner from [undefined], and return only the first group through lookup('in'). Each reaches the relevant method and fails the Map comparison. The earlier skipped-update and unioned-equality controls still pass their calibration.

For failure replay, a temporary wrong expected rule cleared the Map result for [undefined, 1]. The random lane failed at the direct inArrayLookup comparison on put(a, undefined) with seed 20261012 and shrink path 0:1:0:1:1:1:1:0. Guarded replay reached both index lanes, recorded a failed one-run witness for each, and exited nonzero. After removing the temporary fault, that exact replay passed both lanes. This was a model fault for checker and replay calibration, not a production mutant or a production defect.

The fresh hostile reviewer /root/review_in_membership inspected the source blocks, production implementations, ledger, oracle, and coverage map. It found a position-sensitive survivor: all original mixed probes had undefined first. Adding [1, undefined] and a control that drops its trailing undefined operand killed that survivor. The reviewer independently ran the nullish membership slice (36 passed, no type errors) and found no remaining semantic blocker to retiring the four named blocks. It did not run a production mutant. No production change was justified by this round.

The reviewer rechecked committed head d880f3139bbbba7141dc658d84d3602217c2960f after the commit hook. The commit removed exactly the four ledger blocks and retained the reviewed oracle and coverage claims. The reviewer reran all three targeted files: 423/423 passed with no type errors. git show --check was clean. No new blocker arose.

Oracle guide audit

Requirement	Outcome
ORC-001	IndexInterface and the established direct-index tests supply exact and IN set-selection obligations. The claim excludes WHERE semantics, ordered and range reads, bucket identity, timing, and arbitrary JavaScript values.
ORC-002	A source Map supplies ownership. Expected exact sets come from Map grouping; expected IN sets come from operand membership over source rows. Neither uses production normalization, comparator classification, or another production lookup.
ORC-003	Prose beside the model names the law, grammar, direct index driver, returned sets, and after-action checkpoint.
ORC-004	The four fixed histories reconstruct every retired source state and operand. The generated grammar has three keys, five numeric/nullish values, up to 40 put/delete actions, and empty, repeated, mixed, reversed-mixed, and nullish-only lists. The fixed string and four-key histories cover values and width outside that grammar. Removing undefined loses the reported case; removing null loses nullish distinction; removing defined values loses mixed selection and moves; one key loses peer retention. Direct update of an absent source key is excluded.
ORC-005	Both real index classes execute add, update, and remove. The checker compares equalityLookup, lookup('eq'), inArrayLookup, lookup('in'), key count, and indexed keys after each action returns.
ORC-006	Four new wrong-result controls fail at the intended comparison; the temporary wrong expected rule also fails the generated IN comparison. No production mutant was run.
ORC-007	Fixed and seedless campaigns share one generator and check with 100 runs each per type. Guarded seed/path 0 replay reached both lanes; the captured 0:1:0:1:1:1:1:0 failure replayed as failed, then passed after restoration.
ORC-008	The Map retains each key's value because a later update or delete can distinguish states with the same bucket sizes but different owners. No model state was removed.
ORC-009	put maps to index add or update according to source ownership; delete maps to remove. IN operands are lists of source values, and the after-action comparison is the checkpoint.
ORC-010	Wrong-result spies restore in finally. Guarded replay records the property failure separately from child exit and cleans its temporary witness channel. The temporary model fault was removed after replay.
ORC-011	No plausible shared semantic fault requiring a second independent formulation was identified for this bounded primitive-value Map rule. The review's order-sensitive survivor was an enforcement gap and is now checked.
ORC-012	This versioned ledger records source assertions, law limits, execution, hostile review, and remaining scope against exact reviewed code head d880f3139bbbba7141dc658d84d3602217c2960f.
ORC-013	[undefined, 1] versus [1, undefined] distinguishes operand-order dependence; [undefined] with two owners rejects first-owner-only selection; [] and [1, 1] check empty and duplicate boundaries. The wrong-result controls fail at returned-set comparisons.
ORC-014	No controlled provider or host premise is used to claim real-provider or host behavior.

The remaining legacy blocks keep their distinct observations. The short-circuit timing assertion, BTree traversal and range behavior, custom comparator arguments, storage representation, and public live-query result still need their own owners before retirement.