# Content temporarily unavailable
# PR #1924 dotted-path review

## Reviewed state and bounded claim

- Original reviewed PR head: `04d8b8a87583bdf3ea9e8931f20fa9661e7c6a01`.
- Reviewed executable repair head: `8bfc800c873073bb8c06e841e69ec69d153a95a7`.
- Base: `origin/main` at `6e151b0e57d63e2535cdf8e02518690d453214bc`.
- Executable owners: `packages/db/tests/query/index-path-collision-oracle.test.ts` and the focused compiler witness in `packages/db/tests/query/compiler/lazy-targets.test.ts`.

The PR protects complete property-path segments when a dotted scalar property
and a nested property have the same dotted display. Its bounded public oracle
checks numeric AND predicates, selected-field ordering, Collection subscription
callbacks, and live-query callbacks. The compiler witness checks that a union
source's coalesced lazy demand retains both target paths. It does not establish
all path-identity sites, a public on-demand adapter history for the lazy target,
or arbitrary path segments, nullish values, collation, and incremental updates.

The full PR's physical production-source diff against this base is 7 added and
6 deleted lines, net **+1**. The review repair itself changed two production
lines in place, net zero. Tests, this record, the coverage map, package script,
and changeset are excluded from production weight.

## External review ledger

| ID | Raw review claim | Evidence at original head | Disposition and destination |
| --- | --- | --- | --- |
| 1924-01 | `lazy-targets.ts:257` still joins path segments and should use `JSON.stringify(path)`. | The actual file is `query/compiler/lazy-targets.ts`. A same-source `UnionFrom`/`coalesce` witness expected `[['a.b'], ['a', 'b']]` but received only `[['a.b']]`. This is an assertion failure at the compiler target boundary. | **fixed-now** in `224a17c2`; the focused test passes and the coverage map owns the remaining public on-demand witness. |
| 1924-02 | Serialization is duplicated at three sites; extract `serializePath`. | The repetition is real, and the review missed a fourth cache in `createRefProxyWithSelected`. That cache had a separate public failure: a selected-field order sorted by the dotted scalar twice. Reverting its one-line repair made the oracle fail at exact key order. | **deferred** helper extraction. The five one-line `JSON.stringify(path)` uses now span separate proxy, planner, and compiler boundaries. A shared import would add code without changing this behavior. This record preserves the suggestion for a future coordinated encoding change. The missed cache itself was fixed in `224a17c2`. |

The review found one genuine remaining compiler collision and a true but weak
duplication observation. It identified a viable one-line fix for the former,
but cited the wrong directory, supplied no same-path evidence, and missed the
selected-field proxy cache. The reviewer is technically useful on localized
code reading; evidence depth and bug-class reach are limited. Hire
recommendation for independent high-stakes review: **no** on this sample.

## Oracle guide audit at the reviewed executable head

| Requirement | Outcome |
| --- | --- |
| ORC-001 authority and limits | The oracle header cites the public live-query guide's AND filters, selected fields, and computed ordering, plus the live-query architecture's physical-index boundary. Its known omissions and the coverage map bound the claim. |
| ORC-002 independent judgment | The model filters and sorts plain rows with direct JavaScript property reads. It imports no production predicate classifier or index logic. |
| ORC-003 visible responsibilities | The opening contract, model, bounded cases, production drivers, and exact key/order refinements remain in the executable file. The compiler boundary has its own focused witness and named limit. |
| ORC-004 generated grammar controls | Not triggered as a generated property: the oracle enumerates a fixed 3×3 row table and fixed `it.each` cases. These fixtures reconstruct the known dotted/nested collision. The values 0, 10, and 25 straddle the named bounds. No random or legal-history grammar is claimed. If the finite table is read as a generated-property claim, ablation and exclusion evidence remains open. |
| ORC-005 production path and observation | Public direct reads, Collection callbacks, and live-query results compare exact keys or exact order. Each direct indexed case spies on the installed nested BTree index's `lookup` and observes a call after index addition. The lazy-target test directly observes compiler output; it makes no public-row claim. |
| ORC-006 checker calibration | At the original head, the new lazy-target test failed with one target instead of two. After the repair, restoring the old `$selected` cache key temporarily made the public order check fail (`0-25` before `10-0`); this was an assertion failure at the named checkpoint. The original PR's grouped-range and callback proxy RED results are recorded in the coverage map. Temporary reversions were removed. |
| ORC-007 fixed/random campaigns | Not triggered: these are bounded enumerations and a focused compiler test, not important generated properties. |
| ORC-008 model minimality | Not triggered: the reference recomputes from fixed rows and adds no stateful model state. |
| ORC-009 vocabulary mapping | Not triggered: the model's flat and nested field reads are local data descriptions, not combined or split production concepts. |
| ORC-010 failure fidelity and cleanup | Pass. The harness registers each acquired resource and attempts cleanup in reverse order after success or failure. If an assertion and cleanup both fail, `AggregateError.cause` preserves the primary mismatch and `errors` retains cleanup failures. A hostile control proves both diagnostics survive and both releases run. No shrinker or capture process is used. |
| ORC-011 second formulation | Not triggered: this review named no plausible semantic fault shared by production and the direct JavaScript model that a second formulation would separate. |
| ORC-012 review evidence | This versioned record identifies outcomes and limits for ORC-001–011 against executable head `8bfc800c`. The coverage map owns the focused compiler boundary and public adapter omission. |

The bounded claim is: complete property-path identity × the fixed numeric rows
and coalesced target pair × direct query/index, selected proxy, callbacks, and
compiler deduplication × exact public keys/order or exact compiler target paths
at the named checkpoints. The original indexed and callback failures, the
adjacent `$selected` failure, and the compiler target failure are distinguishing
witnesses. A known reachable public on-demand counterexample has not been
established by this review; that history remains an in-scope evidence gap for
the lazy-target coverage owner. The record does not claim global closure of
every path-key use in the query compiler.

## Verification and remaining scope

- Before repair: the compiler target test failed with one target where two were expected. The `$selected` exact-order oracle failed when its cache key was restored to dotted joining.
- After repair: 69 tests passed across the collision oracle, lazy-target unit tests, ref-proxy tests, and union-all tests.
- Changed-file ESLint, Prettier, and `git diff --check` passed.
- Package `tsc --noEmit` reported 41 worktree-wide errors, including db-ivm source files outside the db package's `rootDir`; none named changed files. This run is not a clean typecheck receipt.

The remaining public on-demand adapter witness is assigned to the lazy-target
coverage-map row. No request to extract a shared serializer is part of this
repair.

## Second external review: correlated reference paths

This follow-up checked the later review against PR head `b602188f` before
editing. The review correctly noticed that the earlier repair did not cover two
builder deduplication sites. The architecture's route-context law requires
every distinct parent reference to reach the child query. A property path is a
sequence of segments, so [`a.b`] and [`a`, `b`] cannot share a deduplication
key.

| ID | Review claim | Executable evidence | Disposition and destination |
| --- | --- | --- | --- |
| B1 | The lazy-target collision was fixed with RED/GREEN evidence. | The original reviewed head emitted only one of the two same-source targets. The existing compiler witness now requires both and passes. | **already-fixed** by `224a17c2`; keep the focused compiler owner and its public on-demand limit in the coverage map. |
| B2 | `builder/index.ts:1275` still merges dotted and nested correlated refs. | With line 1336 repaired and line 1275 restored to dotted joining, a nested public include using ancestor aliases [`p.q`, `x`] and [`p`, `q`, `x`] lost the second value (`undefined` versus `22`). | **fixed-now** by segment-safe deduplication at this site. The route-context oracle owns the public witness. |
| B3 | `builder/index.ts:1336` still merges dotted and nested parent refs. | At `b602188f`, a one-level public include returned `nested: undefined` rather than `22`. Changing only this key to `JSON.stringify(ref.path)` made the same assertion pass. | **fixed-now** at this site. The oracle also checks a parent update after initial materialization. |
| B4 | `compiler/index.ts:2241` still merges dotted and nested include result routes. | A public conditional projection with result paths [`a.b`] and [`a`, `b`] returned both child results. A temporary mutant that bypassed `getUniqueIncludesRoutingKey` lost the flat child at the exact public assertion. The same allocator is used for projected source and direct include routes at lines 649 and 676. | **refuted for the stated public path**: this key is a unique internal routing name, and the allocator disambiguates equal dotted spellings. Preserve the public route test and its parent-key/child-insert checkpoints. |
| B5 | A shared `serializePath` helper would close every remaining site. | The two true builder collisions are fixed in place. The compiler's routing names are already unique; its dotted spelling is display text for an allocator, while the builder keys represent path identity. The source also has dotted joins for warning text, not identity. | **deferred** helper extraction in this record. A coordinated path-encoding change can revisit it if further identity sites need the same rule. |
| B6 | The dotted-path bug class was not globally closed. | B2 and B3 were reachable public failures at the reviewed head. Their fixed witnesses cover one-level and nested `toArray` includes, ancestor aliases, initial results, and selected updates. B4 is a passing public route control with a killed wrong allocator. | **fixed-now for the reported live sites, with bounded coverage**. Arbitrary path segments, other recursive source forms, every materialization form, and public on-demand adapter histories remain outside these witnesses in the coverage map. |

The follow-up changes two existing production lines, net zero. Across the full
PR relative to the reviewed `origin/main` base, physical production source is
9 added and 8 deleted lines, net **+1** (one explanatory comment). This does
not meet a net-negative production-code target; removing a useful comment to
change the count would not simplify the implementation. Tests and contract
documentation are reported separately.

At the follow-up worktree, the includes route-context oracle, bounded indexed
path oracle, and lazy-target compiler suite passed together: 114 tests. Changed
production/test ESLint and `git diff --check` passed. The package typecheck
could not resolve `@tanstack/db` in two existing conformance contracts in this
isolated worktree; it named no changed file. The PR's CI is the remaining type
validation gate.

After merging current `main`, the same three suites plus the newly merged
subquery user-value oracle passed together: 134 tests. The oracle campaign
keeps both this PR's indexed-path owner and `main`'s new subquery owner.

The second reviewer found two real public bugs beyond the original local fix
and identified the correct class of collision. The compiler routing claim and
shared-helper prescription overreached: they did not account for the allocator
or distinguish identity keys from display keys. Accuracy is mixed; depth and
signal are stronger than the first review because B2 and B3 were important
omissions. Hire recommendation for independent high-stakes review remains
**no** on this sample without executable same-path checks.