PR #2069 review at 51563046

Reviewed code: 51563046ccac1e739250601580a795fa4400d841. Repair code: f2bf482b37508302a8df851ed16dabecaff4c82e. The external xhigh review supplied 15 numbered findings and three separate test-gap claims. Its 15th finding contained three independent cleanup claims. The task-local source-order ledger preserves all 20 resulting items and the review's original wording. This record states the executable law audit for the repair commit. It does not claim that all cache-generation design work is done.

Laws and decisive observations

Law and authority	Original failure and missing oracle cut	Repair and enforcing observation	Limit
An expired persisted cache claim cannot authorize a read, write, or public row; an active on-demand demand reacquires from its provider after private rotation. The glossary defines claims and generations, and the cache-eviction design authorizes rotation.	A real QueryClient with Node SQLite entered terminal error without a restart hook. A separate startup schedule rotated before Query sync entry yet published old QueryClient data with zero source fetches. The prior Query owner covered demand ownership but omitted the persisted-startup boundary.	Query now retires callbacks, gates old fetch results, restarts active acquisitions, and reads a startup-rotation capability. The Query owner checks warm reuse with zero fetches, private startup rotation with a fresh fetch, old peer fetch success and error, active reacquisition, overlapping rotations, public rows, caller settlement, and the tested run's claimed SQLite rows before and after a stale fetch finishes. Original schedules were RED; repaired schedules are GREEN.	Fixed real QueryClient/Node SQLite schedules. Two Collections sharing one QueryClient, arbitrary peer timing, and two successive private startup rotations have no composed Query receiver. Custom sources still need an explicit restart capability.
A cache-claim read that expires during an awaited SQLite operation must be discarded before publication; unrelated live storage errors remain failures. The claim law and persistence adapter transaction boundary authorize this distinction.	Hydration and startup second-check rejections became terminal. The persistence oracle lacked the after-read expiry transition and a second successive startup expiry.	Persistence retries private claim recovery before source entry or reload, then admits only the replacement generation's rows. Controlled second-check histories were RED then GREEN; a real SQLite owner rejects expired claimed reads.	The exact startup second-check rejection schedule is controlled; a real SQLite receiving test for that schedule remains open. A durability rejection after core publication remains fail-stop.
A provider-session restart must settle demands and retire old callbacks before a rotated cache accepts new work. The glossary separates provider session, sync run, demand, and applied receipt.	A failed Electric restart left later demands in a microtask loop. Two rotations shared the wrong gate and admitted a middle-session callback. The earlier Electric oracle checked only gate timing.	Electric retains restart failure, rejects later demand while the run remains active, gives each rotation its own gate, and rejects retired callbacks. Descriptor and installed-SDK tests check settlement, final fresh demand, and old callback exclusion. The failed-restart and overlap schedules were RED then GREEN.	No one test composes two rotations, installed SDK, real SQLite, and public/durable rows. A stalled physical SDK snapshot can still block later requests.
A declared Collection index must govern successful late index work on the same claimed storage, including remove-before-ensure and remove-then-readd. The Collection index registry is the authority.	A controlled reverse-order schedule completed removal before held bootstrap ensure; the durable index reappeared while the Collection had no declaration. The earlier oracle released ensure first, so it was false green for this order.	Bootstrap, coordinator, and dynamic index paths recheck the current declaration after awaited work. The reverse order and readd-during-removal tests check both declaration and durable adapter state; the reverse order was RED then GREEN.	The durable fixture is a controlled adapter Map. Native SQLite DDL under the same reverse completion order remains an unproved receiving cut. Failed index I/O remains best-effort.
Claim renewal preserves a still-valid claim without writing on every foreground operation; transient timer errors do not independently prove claim loss. The claim expiry and adapter admission checks define the safety boundary.	A deterministic six-commit/six-load history increased renewals from 2 to 20 while expiry was distant. A transient timer error also made the Collection terminal.	Renewal is due only near expiry; the timer retries a transient error and each durable operation still checks its claim. Call-count and timer histories were RED then GREEN, with near-expiry renewal as the neighboring control.	Source-commit durability errors still reject their receipt; this is not a promise to swallow SQLite failures.

Lossless disposition

ID	Verdict and action	Durable value
F01	Confirmed for Query and fixed there; combined item remains confirmed-open for custom managed sources and legacy logical-table collection.	Custom sources need a restart contract; pre-generation storage needs a cross-version reclamation policy.
F02	fixed-now	Persistence second-check and startup claim-expiry histories.
F03	fixed-now	Failed Electric restart followed by another demand must reject finitely.
F04	fixed-now	Unmanaged Electric adapters take full-log replacement; managed scoped recovery requires a claim.
F05	fixed-now for transient timer failure; the review overstated source-commit recovery.	Distinguish expiry from live I/O failure at each durable boundary.
F06	refuted for the stated public StrictMode release path: core aborts before unload, and the held-claim probe started no source load after release.	Direct signal-less internal calls are a separate scope limit.
F07	fixed-now at the wrapper boundary	Reverse-order and readd index oracles; native DDL receiving remains open.
F08	fixed-now	Capacitor, Tauri, and Cloudflare factories forward clock and claim lifetime, with targeted tests.
F09	accepted-design	Cleanup reports adapter teardown failure; expiry is not proof that cleanup succeeded.
F10	refuted	Unload before a pending load is necessary when unload lets that load settle; a source-specific late callback still needs fencing.
F11	confirmed-open	Uncertified Electric subsets rotate on later cold starts, so offline reuse and multi-tab sharing need a subset-authority design.
F12	fixed-now	Deterministic renewal-write count and near-expiry control.
F13	design-decision	Installed Electric SDK shares a mutable snapshot cursor; removing serialization regresses cursor state. Parallelism needs a separate cursor/session or SDK protocol change.
F14	fixed-now at the descriptor and controlled delivery boundaries	Composed real-SQLite/installed-SDK overlap remains open.
F15a	design-decision	Claim-table and old cache-ID migrations only support PR intermediate databases; retain until the supported preview-upgrade policy is explicit. Older applied-transaction migrations remain necessary.
F15b	fixed-now	Removed unused claim-assertion API and implementation.
F15c	fixed-now	One lifecycle-guarded helper replaces four identical scheduled recovery blocks; the transaction-path recovery remains separate.
T01	stale as a blanket claim: real SQLite already rejected expired claimed reads; a startup second-check gap was real and fixed in the controlled owner.	Same-schedule real SQLite receiver remains open.
T02	fixed-now for Query	Real QueryClient plus managed Node SQLite is now a receiving witness; custom sources remain F01.
T03	fixed-now	Failed Electric restart followed by a new demand is now observed before cleanup.

These 20 source-order items account for 12 fixed-now, 2 confirmed-open, 1 stale, 2 refuted, 1 accepted-design, and 2 design-decision. The reviewer identified several high-value lifecycle counterexamples but did not run them. Its proposed parallel Electric snapshots and wait-before-unload remedies were not sound on the installed SDK and legal owner schedules, respectively.

Oracle-guide audit for the changed witnesses

Requirement	Outcome
ORC-001	The laws above derive from the glossary, cache-eviction design, Collection index registry, and established Query/Electric demand contracts. The limits are explicit.
ORC-002	Query expected rows come from separately controlled provider values and claim authority, not the Query fetch classifier. Index expectations come from the Collection declaration, not the persistence reconciliation loop.
ORC-003	The primary Query, persistence, and Electric oracle files place law, model or independent relation, legal schedule, production entry, and observation cut beside the executable histories.
ORC-004	New Query startup and index races are fixed controlled histories, not new generated grammar claims. Existing generated persistence and Electric campaigns retain their documented bounds.
ORC-005	Drivers enter the real QueryClient/Collection/Node SQLite path, the persisted wrapper with controlled index I/O, and the Electric adapter/SDK paths. They assert public rows, caller settlement, fetch counts, and claimed durable rows at named cuts.
ORC-006	Original code failed the Query stale-startup and held-peer success/error cuts, the index reverse-order cut, and the other RED schedules named above. A first added durable scan failed because it read another valid generation; that was a driver error, not a product mutant, and was corrected.
ORC-007	No new important generated property was introduced. Existing fixed/random campaigns ran in the full package suites; direct replay procedures remain with their owners.
ORC-008	No independent stateful model was added or merged. The fixed histories retain claim ownership because an expired run and a warm peer can observe different generations.
ORC-009	Tests distinguish sync run, provider session, persisted cache generation, claim, demand, source fetch, applied receipt, public row, and durable row per the glossary.
ORC-010	Fixed histories use explicit holds and cleanup; no shrink claim is made. Their original assertion failures were recorded before cleanup.
ORC-011	A real QueryClient plus real Node SQLite is a distinct receiving formulation beside the controlled persistence and Electric models. It does not establish native multi-tab or Electric service behavior.
ORC-012	This commit-tied record states outcomes and open cuts for each applicable requirement.
ORC-013	Warm versus rotated startup, old peer success versus error, near-expiry versus distant renewal, and remove versus readd are distinguishing neighboring legal cases.
ORC-014	The Query startup claim and durable row observations use Node SQLite. The index reverse order and several Electric delivery schedules use controlled collaborators; their native or service receiving cuts remain open.

Verification and open work

At repair commit f2bf482b3, the full Query package passed 1,028 tests, Electric passed 1,077 with one skip, and SQLite persistence passed 1,276 with two existing todos. The core capability test passed seven tests. All affected package typechecks reported no errors. Changed-file ESLint reported zero errors; Prettier and Git diff checks passed. Two independent final oracle reviewers found no further confirmed Query or index correctness bug; one durable Query observation gap they found was added and checked.

The next design work is subset-specific Electric cache certification for safe offline reuse, a reclamation policy for legacy logical storage, a contract for custom managed on-demand providers, and an SDK cursor design for parallel snapshots. The coverage map names remaining real-provider and native-host receiving cuts. Green fixed histories do not prove arbitrary timing or storage growth bounds.