Issue #1948: keyed MultiSet identity

Reviewed executable revision: 0641a0e2c8a0b6c7351162f667a2eca7662ca4cd. The unchanged production baseline was c879ba6d855914e5c0cac49af7a007eb5cabe7e4. The baseline code in packages/db-ivm/src/{multiset,utils}.ts is also identical to the local main checkout at c0d123b8, used for the isolated object probe.

Contract and boundary

MultiSet.consolidate() promises that keyed records merge only when their keys and values have the documented identity. String and numeric keys are different. Primitive values compare by value; objects and functions compare by reference, and distinct symbols remain distinct. A two-element value is a join tuple whose elements follow that leaf rule. After consolidate() returns, the complete output must retain each nonzero identity with its summed weight and first record. The input must remain unchanged. The oracle does not assert output order.

This record closes the reported direct MultiSet collisions for the oracle's bounded key/value grammar. It does not establish which @tanstack/db queries produce primitive keyed relation values or mixed-type source keys. A live-query production witness is still needed for those application paths; the coverage map names that gap.

RED and GREEN evidence

The old oracle excluded cross-type, delimiter, symbol, and function cases, so it remained green on the faulty implementation. The expanded oracle uses the same independent reference model for eight pinned collision cases and for a generated collision branch. Before the production change:

Eight pinned cases failed at multiplicity or missing-identity assertions.
Both generated campaigns failed. The fixed seed 2026929 shrank to path: "1:0", numeric and string keys with opposite weights. Direct replay reached the same missing-identity assertion.
An isolated process probe with a direct object and an object tuple under a delimiter-bearing key returned zero records. The two distinct records have weights 1 and -1 under the contract.

On 0641a0e2, the oracle passes all 22 tests. The exact fixed seed and path replay passes. The same object/tuple process probe returns two records with weights [1, -1]. All 649 @tanstack/db-ivm tests pass, package TypeScript typechecking passes, Prettier passes, and git diff --check passes.

The original production code is the hostile wrong design for this oracle: str_${String(value)} erases primitive type and reference identity, and bare | joins erase component boundaries. Its failures reached the intended public-result comparison. The repair type-tags primitive identities, uses a per-consolidation reference map, distinguishes a leaf from a tuple, and length-prefixes components. Positive controls keep same-symbol, same-function, signed-zero-key, and NaN-value merging intact.

Production code changes by +10 net lines. Test code grows to make the new grammar, named cases, and controls visible. No elapsed-time performance claim is made for the repaired hot path.

Oracle guide audit

Requirement	Outcome at reviewed revision
ORC-001	The oracle's opening contract cites MultiSet.consolidate() and limits the result to its direct API and bounded grammar.
ORC-002	The expected identity uses a type-tagged structured key and a local reference map. It does not call production getStringId or hash.
ORC-003	Contract, model, history grammar, production call, and refinement check remain separate in the oracle file.
ORC-004	Eight named cases reconstruct the reported regimes. The collision branch varies case and nonzero sign/magnitude; ordinary keyed histories vary record count and values. The fallback branch deliberately retains its original structural domain. A non-keyed record makes the keyed rule inapplicable.
ORC-005	The driver calls new MultiSet(records).consolidate().getInner() and compares every output identity, weight, and retained first record after return. The fixed campaign's reach witness covers every grammar mode.
ORC-006	Unchanged production failed at the intended assertions; the object/tuple process probe also failed before the repair and passed after it.
ORC-007	The same property, grammar, check, and 300-run budget execute with fixed seed 2026929 and a seedless random campaign. Seed-plus-path replay was checked RED and GREEN. No fc.commands are used.
ORC-008	Not applicable: the reference is stateless recomputation.
ORC-009	keyedCollision is documented as a grammar branch for the same keyed production path; caseName is only a replay label.
ORC-010	No external resources are acquired. Shrinking and direct replay preserve the missing-identity failure at the result checkpoint.
ORC-011	No separate shared semantic fault was named. The reference's structured key differs from production's length-prefixed composition, and the positive controls challenge adjacent identity equivalences.
ORC-012	This versioned record identifies the exact executable revision, RED/GREEN receipts, limits, and the outcomes above.

PR #1967 external-review follow-up

Reviewed executable revision: b39e162f82bfc8b228841970b0c31bd5624b508f. The review targeted bd0a95eaa39c5b99ae420752de3b5f100b4cd183. The production encoder did not change in this follow-up.

A new pinned witness uses NaN, Infinity, and -Infinity as numeric keys. Before the model repair, the witness failed at the multiplicity assertion. JSON.stringify converted all three raw numeric keys to null, so the model expected one group with weight 6. Production returned three distinct groups. The repaired model compares keys and leaves directly with SameValueZero, then compares the two elements of join tuples. It does not serialize keyed identity. The keyed generator now includes all three non-finite keys. The unkeyed structural fallback retains its former key and value domains.

The same focused witness is GREEN after the model repair. All 23 consolidation oracle tests, all 650 @tanstack/db-ivm tests, package typechecking, Prettier, and git diff --check pass. The full package run disabled coverage output. The old production files from c879ba6d were run with the new oracle in an isolated directory. The numeric/string-key witness failed at the public multiplicity comparison: production returned weight 2 where the model required weight 1. A bigint/number value witness failed at the missing-identity comparison. An initial isolated run stopped during TypeScript configuration setup; that run is not counted as a mutant kill. The reruns reached the assertions.

The external review also questioned the baseline label. c879ba6d was the recorded unchanged production baseline. c0d123b8 was its child and supplied the isolated object probe. Both commits have identical multiset.ts and utils.ts blobs. The coverage map's RED baseline is accurate.

Requirement	Follow-up outcome at reviewed revision
ORC-001	The keyed law and direct-API limit remain in the opening contract. It now names non-finite keys in the grammar.
ORC-002	Direct SameValueZero/reference equality supplies expected keyed groups. It does not use production's string encoding or getStringId.
ORC-003	Contract, model, grammar, production call, and result comparison remain visible in one file.
ORC-004	The pinned non-finite-key case reconstructs the false RED. The keyed generator adds those keys; the fallback generator keeps its prior domains. The earlier collision reconstruction and exclusions remain.
ORC-005	The driver still calls MultiSet.consolidate() and compares every output group, weight, and retained first record after return.
ORC-006	The unchanged pre-fix encoder fails the revised model at the intended public-result assertion. Setup failure was not credited.
ORC-007	Fixed and seedless 300-run campaigns retain the same grammar and comparison within each revision. Seed-plus-path replay support remains.
ORC-008	Not applicable: the model is stateless recomputation.
ORC-009	The keyedCollision grammar branch and replay label retain their declared mapping.
ORC-010	No external resources are acquired. The isolated baseline rerun reached the same result checkpoint.
ORC-011	A shared type/text encoding concern now has a second formulation: direct SameValueZero/reference equality. The old encoder fails it.
ORC-012	This append-only entry records the revised executable commit, false-RED repair, hostile baseline, GREEN checks, and limits.

Direct replay also used fixed seed 2026929 and shrink path 1:0 with the revised model. The old encoder failed after one replay case at missing identities, with numeric and string keys carrying opposite weights. The same seed and path passed on b39e162f.