Cache-rotation receiving-gap audit

Reviewed code commit: 87aead1be5730481152a10849008287755c0ff16. This commit adds oracle histories and a Browser receiving path; it changes no production code. The accepted cache-claim and subset-demand laws come from the glossary, the Electric on-demand recovery contract, and the Query Collection's shared-cache contract. The fixtures judge those laws at named boundaries. They do not establish every cache-eviction interleaving or turn an unsupported direct-adapter call into a product promise.

Histories and observations

The Browser coordinator owner accepts one remote subset acquisition, then drops its old leader's release response after the owner unloads. Leadership transfers while the caller's actual RPC timer remains pending. After the timer expires, production retries and the public release settles. At that checkpoint the old owner has unloaded once, the new owner has loaded and unloaded zero times, and no outbound acquisition remains. The model is one exact acquisition lease with one release obligation; a response lost in transport cannot revive the retired demand. Web Locks and BroadcastChannel are deterministic seams, so this is a coordinator result rather than proof of native scheduling.

The Query owner gives two on-demand Collections one QueryClient with distinct exact keys and overlapping prefixes. The first claim starts at 1000 and expires at 11000. The second starts at 5000 and remains live at the 11001 checkpoint. A disjoint demand makes the first Collection rotate and fetch fresh rows. The independent two-claim rule predicts no change to the warm Collection. The driver uses real QueryClient and Node SQLite, then compares the first public rows and the second public row, Query cache entry, durable row, current storage ID, and fetch count. This history does not redefine the documented effect of explicit cleanup on another consumer of the same exact Query key.

The Browser OPFS owner reuses its native two-context notice history with an installed Electric SDK in the expired tab. Controlled HTTP supplies one initial up-to-date message, the old subset row, a held old subset request, and a fresh subset response held after private rotation. The warm tab's deterministic source commits a durable peer row; the real coordinator emits and native BroadcastChannel delivers the physical-ID notice. At the held notice cut, the expired claim has passed its half-open expiry and the warm claim remains live. Before delivery, no refetch starts. After delivery but before the fresh response, the explicit demand remains pending, the expired public and private durable cache are empty, and the warm peer retains its public and durable rows under the unchanged head. After the response, the demand fulfills and only the fresh row appears in the expired public and durable cache. This receives the installed SDK and native host premises together, with controlled HTTP rather than a live Electric service.

Checker calibration

These temporary mutants were restored after each run. Every killed mutant reached the stated assertion, not setup failure:

Wrong design	Result
Release does not set releaseRequested before old-leader timeout	The new owner unexpectedly loaded the retired demand.
Rotation removes every Query entry matching its base prefix	The warm Collection's distinct Query cache entry was absent.
The held native notice callback is dropped	The Electric/OPFS history failed at the refetch-entry poll.

A first Browser fixture mutant changed the ordinary callback path while the history held and later invoked a different callback. It survived. That outcome was an unreached-path calibration result, not evidence that the notice was unnecessary. Mutating the held callback itself produced the failure above.

ORC-001–014 review

Requirement	Outcome
ORC-001 authority and limits	Applicable. The three existing contracts above authorize the expected results. Each owner states its bounded path. Claimless direct-adapter access and live Electric service delivery remain open.
ORC-002 independent judgment	Applicable. One lease's release, two independently timed claims, and source-row replacement predict the results without importing the production retry, Query ownership, or cache-rotation classifiers.
ORC-003 literate responsibilities	Applicable. Each edited owner explains law, small independent rule, legal history, production path, observation, and checkpoint beside the test. The Browser fixture names its controlled provider.
ORC-004 grammar controls	Not triggered. All three additions are fixed receiving histories; no generated grammar changed.
ORC-005 production path and observation	Applicable. The coordinator executes its real RPC timer; Query uses real QueryClient and SQLite; Playwright runs two Chromium contexts over native OPFS and BroadcastChannel with the installed SDK. Call counts, public rows, cache entries, durable rows, and demand settlement are compared at the named cuts.
ORC-006 checker calibration	Applicable. The table records three assertion failures and the separate unreached-path survivor.
ORC-007 fixed/random/replay	Not triggered. No important generated property was introduced or changed. Existing generated owners remain separate.
ORC-008 stateful-model minimality	Not triggered. The fixed histories use existing lease and cache-claim concepts; no reference-model state was introduced or collapsed.
ORC-009 vocabulary mapping	Applicable. Persisted cache claim and generation, acquisition lease, demand, sync run, provider session, applied receipt, and public snapshot follow the glossary. The controlled HTTP response is provider input, not publication.
ORC-010 failure fidelity and cleanup	Applicable. The OPFS receiving test retains a primary mismatch separately from page cleanup failures. The existing coordinator and Query owners release their test resources in teardown. No shrinking or failure serialization was added.
ORC-011 independent second formulation	Applicable. Native OPFS and installed SDK receive premises previously supplied separately by controlled coordinator and Node SQLite tests. The controlled HTTP service is still a narrower formulation than a live Electric service.
ORC-012 review evidence	Applicable. This record is tied to the reviewed code commit and lists every requirement, mutant outcome, and remaining boundary. It makes no universal bug-class closure claim.
ORC-013 distinguishing boundary witness	Applicable. The Query history puts one claim past expiry and one later claim before expiry at the same clock cut; the broad-eviction mutant fails. Existing SQLite expiry grammar owns exact-at-expiry calibration. The coordinator history reaches actual RPC timeout and rejects demand replay.
ORC-014 controlled-premise handoff	Applicable. The Browser receiver gets a physical-ID notice from real native delivery and an installed SDK source snapshot. The remaining live-service and arbitrary-schedule handoffs are explicit below.

The Browser coordinator oracle passed all 166 tests, and the Query ownership oracle passed all 173 tests. Both OPFS receiving variants passed. Both affected packages typechecked. Changed-file ESLint had no errors (19 pre-existing warnings); Prettier and git diff --check passed. The branch's pre-commit hook had previously tried a private-registry install and received 403, so the verified code commit bypassed that hook.

The coverage map retains the remaining cuts: arbitrary native notice schedules, a live Electric service in this same two-tab history, custom Query provider restarts and arbitrary retention schedules, and direct claimless access after a collected physical ID loses its catalog identity. The latter has a scratch reproduction of orphan registry and row recreation; rejecting that path while allowing arbitrary eager Collection IDs needs a durable identity distinction and therefore a separate design decision.