Temporal persistence design grammar — frozen analytical state v1

Mode: exploratory. Provisional preservation list derived from source and the user's agreed repair direction; not user-confirmed exact equivalence. Target: the language of admissible typed-value persistence repairs in the current TanStack DB shared SQLite system. Production e21c280f3, sources E1–E10 in evidence.md. No production patch is proposed as verified.

Preservation list

ID	Property	Authority
I1	An accepted supported Temporal value retains kind and semantic value after reopen, in every supported carrier. Ordinary ISO strings remain strings.	User-required direction and issue request; extension of established Date preservation.
I2	Existing Date, BigInt, nonfinite and plain-data contracts remain unchanged; unrelated native classes acquire no support by accident.	Source controls E1/E5; last clause is inferred scope discipline.
I3	Public subset equality, range, order and windows match DB's current semantics, including distinct equality and ordering equivalences.	E2/E3 and existing expression-index contract.
I4	SQL candidate selection never discards a row the residual evaluator would accept; final limits apply after required residual evaluation/order.	Derived necessary condition from E2; not a new product rule.
I5	Rejection preserves the adapter's complete prior durable state; action coalescing cannot hide invalid earlier actions.	Existing adapter/work oracle E6. Does not claim pre-publication rejection.
I6	Changes preserve wrapper FIFO, error/receipt ownership and publication-before-durability behavior from #2002.	E7, user requirement to mesh with current work.
I7	SQL expression/index representations remain aligned and respect host binding caps and transaction-driver propagation.	E4/E5.
I8	Support is qualified by operation, constructor environment and execution boundary. Direct core success does not prove coordinator or host support.	Source boundary E8/E10 and user scope; explicit qualification is inferred.
I9	Reader compatibility and damaged prior bytes have explicit policies; never infer a lost Temporal value from an ordinary empty object.	E1 plus irreversibility inference. Old-reader support is unresolved, not asserted.
I10	Extend primary owners for each law and retain their limits; no second lifecycle or unconstrained codec framework is necessary to represent this value-domain repair.	User/code-weight instructions; no-framework conclusion is a provisional design constraint.

Model: candidate primitives

These are dimensions of one contract, not six proposed production classes.

ID	Candidate unit	Why it survives removal	Evidence
P1	Typed value witness: kind, lossless value, valid native/polyfill brand, constructor capability	Removing kind conflates string/date/Temporal; removing the brand admits spoofed tags.	E1/E3/E9
P2	Carrier occurrence: row field, nested record/array, inline or separate row metadata, collection metadata, replay/tombstone payload, query/index literal	A top-level-only repair leaves independent serializer entrances uncovered.	E1/E4/E6/E10
P3	Representation mapping: runtime value ↔ tagged wire/storage value, plus operation-specific query representation	Stored spelling alone cannot establish query semantics or old-reader behavior.	E1/E3/E4
P4	Operation and observation: encode/revive, equality, order, candidate filtering, pagination, index lifecycle, accepted/rejected committed write	Storing a value does not imply it can be ordered or safely filtered in SQL.	E2–E7
P5	Execution boundary: direct core, transaction driver, persisted wrapper/coordinator, platform host	Erasing boundary borrows admission, ordering or native-host evidence from a different route.	E5/E7/E8/E10
P6	Evidence obligation: positive path reach, independent expected result, checkpoint, wrong-design control, declared limit	Removing it promotes a green serializer/control into end-to-end support.	oracle-tests.md and E10

Relations, overlaps and grammar rules

Use the following notation to describe a case, not a new runtime interface:

Case := Value × Carrier × Operation × Boundary × Environment × HistoryWitness Environment := constructor availability + reader/format generation + index generation + host cap HistoryWitness := an existing owner's legal history populated with the new value domain

A configuration is admissible only when the relevant rules below have an owner and distinguishing evidence. The cross-product is constrained; it is not a requirement to enumerate arbitrary combinations or a claim all cases are valid.

ID	Rule and active overlap	Source versus inference
R1	Kind and lossless value survive encode/revive; a missing required constructor fails explicitly. Brand recognition alone is not proof of support.	Kind/value is target I1; missing-constructor policy is proposed using E9.
R2	The same preservation/rejection policy reaches every supported carrier. Nested location can change mechanics but not type semantics.	I1, E1/E6. Proposed carrier-completeness extension.
R3	Equality, ordering and storage have separate obligations. A lossless representation need not be a sortable SQL key; comparator equality need not imply DB equality.	E3.
R4	Pushdown is allowed only with an exact or demonstrably conservative candidate set. Unsupported/unknown semantics use a whole-predicate residual route unless Boolean composition itself is proved conservative.	I4 derived from E2. The classifier/mechanism for untyped field-to-field refs is unresolved U1.
R5	Runtime scalar literals, IN's JSON binding, cursor predicates and index literals must preserve the same logical operand; normalized runtime/index SQL stays aligned.	E4/E5; Temporal extension proposed.
R6	Each action required to serialize must remain validated, including superseded values and metadata. Adapter failure preserves durable rows, metadata, position and replay atomically.	E6 established, no new transaction scheduler.
R7	The adapter cannot reclassify its later durability error as a source precommit abort. Preserve wrapper's public receipt/error and FIFO laws.	E7 established.
R8	Constructor registration, codec reach and wire admission are separate capabilities. Expand a boundary only with that boundary owner's contract and receiving witness; otherwise state explicit non-support.	E8/E9; integration constraint inferred from current boundaries.
R9	Rebuild changed normalized index definitions using the existing index path. New readers must preserve existing supported bytes. Old readers and existing literal marker-shaped objects require an explicit decision before claiming compatibility.	E4 + unresolved U3.
R10	Add value dimensions to existing owner histories. The focused file-backed Temporal oracle owns value identity across reopen; it cannot own source-publication semantics, native host planning, or a universal transaction model.	E6/E7/E10 and oracle guide.

Active intersections (not assignable to a single serializer module): O1=P1/P3/P4: type identity versus equality versus ordering. O2=P2/P3/P4: query/index literals and stored fields meet at SQL interpretation. O3=P2/P4/P5: serialization failure meets action coalescing, durable rollback, and wrapper receipt settlement at different checkpoints. O4=P1/P3/P5: constructor availability meets platform/coordinator admission. O5=P3/P4/P6: compiler upgrades meet persisted physical indexes and direct SQL evidence.

These overlaps have distinct failure consequences; a tree that assigns all of them to serialization loses the relevant public contract. Current interfaces support a shared adapter value helper and reuse of DB comparison semantics. They do not establish a universal pluggable codec interface.

Dynamics, constraints and boundary conditions

Dynamics are design transformations: substitute a lossless representation for empty-object flattening; extend a supported carrier; add a constructor provider; replace exact SQL execution with a conservative candidate route; augment an existing oracle grammar with a native-value dimension. Each move preserves the corresponding I/R constraints or explicitly records a changed support boundary.

Constraints: R1–R10, actual transaction-driver ownership, no history rewrite, no type coercion by ambient stringification, and no unrestricted promise that all Temporal kinds admit ordering.

Boundary conditions: current shared core plus existing wrappers, current polyfill/native constructor availability, formats and driver limits. The first candidate below targets Instant and PlainDate; it is not an inferred promise for all eight Temporal kinds, custom classes, realms or provider hosts.

Unresolved rules and adjacent forms

U1: Exact mechanism for safe SQL candidate selection with untyped field-to-field refs, negation, mixed operands and unsupported functions; fallback work cost. U2: Constructor provider API versus registered globals; support matrix for native runtimes, other Temporal kinds and receiving host processes. U3: Marker namespace collisions, reader generation compatibility and what rebuild/reset policy is justified for previously damaged cache data. U4: Coordinator wire support and full public wrapper reach; direct-core scope cannot settle it. No priority between these support surfaces is invented.

Generated adjacent forms, unranked: F1 (substitute + exclude): tagged preservation for the two reported kinds, Temporal-aware residual evaluation and order; withhold unproved SQL pushdown. Retains I1–I7 where configured but requires U1 resolution; loses indexed query work benefits for those requests. It does not add a codec framework. F2 (augment F1): add exact per-operation SQL keys/literal lowering and matching index expressions for proven Temporal domains. Adds capability/proof obligations at O1/O2/O5; preserves fallback elsewhere. Precision/calendar and upgrade witnesses required. Exact keys are a new design choice, not present source fact. F3 (exclude): explicitly reject unsupported native values at serialization, retaining existing supported kinds and adapter failure contracts. Stops new silent loss but intentionally does not satisfy the requested Temporal support. It cannot promise no prior Collection publication. This is an adjacent safety form, not a substitute silently selected for F1.

Distortion and loss: operation/type decomposition can hide interactions with framework scheduling, mutable constructor registration and host transport. The source is SQLite-centric; this grammar does not make provider field schemas, all calendars or every consumer runtime authoritative. No form is a verified fix.

Controls and the frozen projection map are in process.md.