# Content temporarily unavailable
# Index unit retirement: undefined ordered reads and ranges

The source-isolated Field Lab loss audits compared the remaining direct
traversal and range blocks in `btree-index-undefined-values.test.ts` against
`index-update-oracle.property.test.ts` at frozen head
`df18f41bba07589c4aa8a4b17ca676be7d39dc15`. The receiver checked one-owner
undefined cursors and numeric ranges, but its generated nullish lane checked
only exact and `IN` membership. The table freezes the source assertions before
changing the receiver. A proposed witness is not retirement evidence until it
executes, rejects a wrong result, and survives hostile review.

| Legacy block | Source assertion at the returned-action checkpoint | Loss in frozen receiver | Proposed transfer |
| --- | --- | --- | --- |
| `take(n, undefined)` versus `takeFromStart(n)` | After `a=undefined,b=1,c=2`, `takeFromStart(3)` has three keys and `take(3, undefined)=[b,c]`. | The explicit cursor has a singleton analogue; the default-policy endpoint cut is absent. | Sort source rows with nullish values first; compare both exact arrays after each add, with a fixed three-row history. |
| `takeReversed(n, undefined)` versus `takeReversedFromEnd(n)` | In a fresh copy of the same state, the endpoint returns three keys and the explicit cursor returns none. | The explicit reverse cursor has a singleton analogue; the nullish endpoint cut is absent. | Compare both exact reverse arrays in the same fixed history. |
| Store and retrieve three undefined owners | After `a,b,c=undefined`, `takeFromStart(10)=[a,b,c]` and `equalityLookup(undefined).size=3`. | Two-owner exact membership is fixed; three-owner ordered output is absent. | Pin all three owners and compare exact arrays and source-derived equality sets. |
| Remove one of two undefined owners | After adding `a,b=undefined` and removing `a`, exact lookup has size one and contains `b`. | Reachable in generated put/delete histories, but the two-owner deletion cut is not pinned. | Pin the removal and compare the complete exact set after it returns. |
| Iterate past multiple undefined owners | After `undef1,undef2,undef3=undefined`, then `one=1,two=2`, `take(10,undefined)=[one,two]`. | One-owner cursor and multi-owner membership checks never meet. | Pin the five-row history and compare exact cursor arrays after each add. |
| Explicit undefined versus omitted lower range bound | After `undef=undefined,one=1,two=2,three=3`, `{from:undefined,to:2}` inclusive returns exactly `{undef,one,two}`; `{to:2}` returns three keys. | Numeric bounds and nullish upper-only reads are separate fixtures. | Source-derived range sets check explicit and omitted lower bounds, plus exclusive variants that distinguish them, after a fixed four-row history. |
| Double undefined range bound | After `a,b=undefined,c=1`, `{from:undefined,to:undefined}` inclusive returns exactly `{a,b}` and excludes `c`. | No double-bound range check with two undefined owners. | Pin this state and compare the full set against source-derived bounds. |

The proposed law follows `DEFAULT_COMPARE_OPTIONS` and `defaultComparator`
in `packages/db/src/utils.ts` and `packages/db/src/utils/comparison.ts`, the
direct cursor comments in `packages/db/src/indexes/btree-index.ts`, the
key tie-order contract exercised by `deterministic-ordering.test.ts`, and the
frozen legacy assertions. `IndexInterface` establishes the direct methods but
its reference page does not specify these ordering details. The bounded law
uses default ascending order with nullish values first, positive numbers
ascending, and row keys ordered within one comparator position. Its domain is
`undefined`, `null`, and the numbers 1–3; negative numbers are outside it.
`null` and `undefined` occupy one comparator position for ordered reads while
remaining distinct exact lookup groups. A source Map retains key ownership.
The model sorts and filters that Map; it does not call the index comparator,
normalization, cursor, or range machinery to compute expected results.
`take` and `takeReversed` exclude the cursor's comparator position. Endpoint
methods have no cursor. A range bound exists only when its field is supplied;
an inclusivity flag without that bound has no effect. The production path is
the direct `IndexInterface` on both BasicIndex and BTreeIndex. Unfiltered
ordered arrays at n=1, 3, and 10 and full sets for ten selected forward range
shapes are compared after each add, update, or remove returns. The owner does
not claim all bound combinations or filtered takes.

The default-order and string-order tests inspect `orderedEntriesArray`, a test
view of internal entries. Those two blocks remain until their private
observation has a receiving owner or the test's representation claim is
explicitly retired. The custom-comparator argument, `valueMapData` storage,
and public live-query blocks also remain. This direct-index law makes no claim
about those observations or live-query scheduling.

## Execution and hostile review

The seven ledger blocks were removed after the hostile review. The BTree file
now has five tests. The receiving oracle and that file passed together:
415/415 tests. The package TypeScript check and `git diff --check` passed.
The fixed-seed and seedless nullish campaigns run the same source actions,
checker, and 100-run budget for both index classes. A guarded replay at seed
`20261012`, path `0`, reached both classes with 100 successful runs each. The
named replay harness passed its 36 tests.

Five wrong-result controls force an endpoint read to lose the undefined owner,
an explicit cursor to repeat one of three undefined owners, an inclusive
explicit lower bound to drop undefined, a double undefined range to lose a
peer, and a null bound to drop its undefined comparator peer. Each fails the
intended source-Map comparison for both index classes and restores its spy in
`finally`. The earlier exact and `IN` controls continue to run.

For failure replay, a temporary wrong model rule cleared the expected set for
an explicit `undefined` lower bound and upper bound 2. The fixed campaign
failed at the forward range comparison on `put(a, undefined)`, seed `20261012`,
shrink path `0:0:0:0`. Guarded replay at that seed and path recorded one failed
run for each index class and exited nonzero. After removing the temporary rule,
the same guarded replay passed both classes. This was checker calibration, not
a production mutant or product defect. No production code changed.

The fresh hostile reviewer `/root/review_ordered_range_round4` read the full
legacy file, ledger, changed oracle, coverage map, reference material, and both
index implementations. It identified a surviving wrong design in the broader
claim: a range implementation could treat a `null` bound as an exact-null
bucket because no probe used null as a bound. Inclusive and exclusive null
probes plus a wrong-result control closed that gap. It also required the
contract authority and domain limits to be precise. Its final block-by-block
verdict found no lost source assertion among the seven retired blocks. It did
not run a production mutant. The default-order internal-entry, string-order
internal-entry, custom-comparator argument, storage-view, and live-query tests
remain in the source file.

## Oracle guide audit

| Requirement | Evidence and limit |
| --- | --- |
| ORC-001 | The default comparator, BTree cursor comments, deterministic key tie ordering, and frozen direct tests support the bounded law. The interface supplies the methods, not the full semantics. The claim is limited to default options, values `undefined`/`null`/1–3, unfiltered takes at n=1/3/10, and ten selected forward range shapes. |
| ORC-002 | A source Map owns rows. A fresh value-position sort predicts arrays; separate model-bound objects filter source rows for ranges. Neither calls production normalization, comparator, or traversal to compute an expected result. |
| ORC-003 | Opening and adjacent prose distinguish the law, source Map, action grammar, direct index driver, returned arrays/sets, and after-action comparison. |
| ORC-004 | Fixed three-row endpoint, five-row repeated-owner, two-owner removal, four-row range, and double-bound histories reconstruct all retired assertions. The generated put/delete tail has three owners and five values over 1–40 actions. Removing an endpoint method loses the absent-cursor distinction; one owner loses peer traversal; removing null loses comparator-position overlap; removing numeric successors loses cursor continuation; omitting bound presence loses the exclusive comparison. Negative numbers, arbitrary types, filtered takes, reverse ranges, and direct update of an absent owner are excluded. |
| ORC-005 | BasicIndex and BTreeIndex direct methods run after returned add, update, or remove. Exact arrays and complete sets preserve omissions, duplicates in arrays, order, and wrong membership. |
| ORC-006 | Five injected wrong results fail at the intended comparisons. The temporary wrong model rule failed at the forward range comparison and was removed. |
| ORC-007 | Fixed and seedless lanes use the same generated property and 100-run budget. Guarded seed/path `0` replay reached both lanes; captured failure path `0:0:0:0` failed both lanes under the temporary rule and passed after restoration. |
| ORC-008 | No model state was added: the existing Map retains owner-to-value association, needed for later update and delete. Sorted rows and bounds are recomputed observations. |
| ORC-009 | A model `put` maps to add or update according to source ownership; `delete` maps to remove when owned. Model comparator position combines null and undefined only for order/range, while exact membership keeps them distinct. |
| ORC-010 | Spies restore in `finally`; the guarded runner recorded the primary mismatch separately from process exit and removed its private witness channel. |
| ORC-011 | The reviewer found a missing probe, not a fault shared by the model and production. The added null-bound probe distinguishes the model rule from an exact-bucket interpretation. |
| ORC-012 | This versioned ledger holds source assertions, transfer, limits, execution, hostile verdict, and the exact committed-head recheck below. |
| ORC-013 | Explicit inclusive versus exclusive undefined and null bounds, paired with omitted bounds, distinguish presence and comparator-position grouping. The wrong-result controls fail at those comparisons. |
| ORC-014 | No host or external provider behavior is claimed. |

The public live-query issue regression remains the only test in this file that
crosses the Collection/query path. The other four retained tests observe
private BTree ordering or storage and custom-comparator arguments; direct
source-Map arrays and sets cannot replace those observations without a
separate contract decision and receiving witness.

## Exact committed-head recheck

The same hostile reviewer rechecked committed code head
`a72a7043d5750b33100ab95b7d3c6a490b15626c` after the commit hook. The
commit deletes exactly the seven reviewed blocks and keeps all five intended
legacy tests. The committed oracle retains the Map comparisons, null-bound
probes, and five wrong-result controls; no temporary calibration fault remains.
The two targeted files passed 415/415 tests with no type errors, and
`git show --check --oneline HEAD` passed. The reviewer found no new blocker.