PR #2062 external review audit

Reviewed product commit: 39721f20f4a3daa597a81c5172edf0109a4d83c1. Base: 9e8ed997885fb46ac98ec85906f4ca4f662e7cce. The source review supplied ten findings from code reading and no executed reproduction. This record evaluates those claims against the reviewed commit and the follow-up changes in this PR. Each source-order finding is recorded below.

Finding dispositions

ID	Claim	Evidence and verdict	PR action and durable value
U1	A synchronous scheduler callback throw leaves persistence stuck.	Confirmed. The direct serial-pacer witness failed with no second start ([] instead of [2]). A public manual-commit fault probe also left its next transaction pending on the reviewed commit.	fixed-now: reset scheduler activity, retain any reentrant pending callback, and rethrow the original error. Two direct throw histories now pass.
U2	Manually committing a returned paced transaction makes its scheduled callback throw.	Confirmed conditional history: the public probe reached completed at the scheduled callback and observed the invariant error. The guide says the strategy controls write timing but does not explicitly define external tx.commit() on its returned transaction.	design-decision: decide whether strategy ownership forbids manual commit or manual commit must run early. The U1 repair prevents permanent scheduler poisoning; it does not define manual-commit semantics.
U3	A throwing onMutate consumes debounce's leading edge forever.	Confirmed for a callback that throws before changing a row. The oracle expected immediate second start [2] and observed [] on the reviewed code.	fixed-now: restore leading admission when the failed callback installed no timer. Both trailing settings pass; the throwing callback's error identity remains observable.
U4	A throwing onMutate consumes throttle's window and leaks partial optimistic intent into a later write.	Both effects reproduced. The window regression is new; the partial-intent leak also exists in the base transaction implementation. The original manual-transaction oracle failed for same-key update, distinct insert, and delete.	fixed-now: restore an unused leading window and restore the transaction's pre-callback mutation snapshot after a synchronous throw. The user chose to include the transaction contract change in this PR. Eight transaction histories and two paced receiving histories pass.
U5	Repeated debounce calls can cancel an eligible leading write behind a held handler.	Confirmed. The original code kept only [[1]] where the oracle required [[1],[2,3]] when the held handler returned before the renewed quiet edge.	fixed-now: keep a pending leading callback; calls can join its transaction without canceling eligibility. Release before and after the quiet timer, plus a later no-duplicate cut, pass.
U6	A throttle pending merge can coexist with a stale trailing timer that overwrites it.	Refuted for the stated path. The timer is cleared before it transfers its callback to serial pending state. The controlled held-write probe reaches the serial.hasPending() merge branch and persists [2,3] once, with the same transaction receipt.	refuted: retain the pending-merge oracle witness. A longer reentrant failure schedule remains outside this finite proof, so the invariant should be revisited if the timer handoff changes.
U7	Two clocks cause an extra wait; use zero wait in the serial pacer.	Refuted as a fix and as the stated timing rule. Admission and actual backend starts are different boundaries. The zero-wait hostile mutant fails the existing actual-start spacing assertion: the third write starts one tick too early.	refuted: keep both clocks and the timing oracle. The coverage map still limits arbitrary schedules.
U8	The commit-completion fallback is copied four times.	Confirmed by source inspection. A receipt can reject before its handler completes after manual rollback.	fixed-now: one runWithCommitCompletion helper is used by debounce, throttle, and queue. Existing manual-rollback and settlement histories pass.
U9	Strategy type checks and positional callbacks deny every custom strategy dropped-call isolation.	The generic layer does branch on _type, but the claimed general bug conflates the built-in debounce/throttle admission convention with legacy custom queue and batch behavior. The oracle proves a false-returning custom batch retains its scheduled callback.	refuted as a correctness claim. Preserve the API-shape concern; a uniform admission result needs a separate compatibility design, not a change inside this repair.
U10	The 48-line serial pacer violates the code-weight rule without an architectural reason.	The code weight is real. Installed Pacer Lite's debouncer has no asynchronous completion gate; its queuer drains callbacks synchronously without awaiting them. The 24 held-write histories and manual-rollback witnesses enforce the one-persisting law that a plain timer or LiteQueuer cannot express.	refuted as an AGENTS.md violation. The positive production diff is justified by the documented independent scheduler boundary. Keep reviewing production weight separately from oracle and documentation growth.

Law coverage and calibration

The paced owner is packages/db/tests/paced-mutations-oracle.test.ts. Its public authority is the paced guide's one pending and one persisting transaction rule, immediate optimistic admission, and debounce/throttle edge behavior. The new synchronous-throw scheduler seam has a two-callback model: the first error remains visible and the second eligible callback starts. It failed at the second-start assertion before the fix. The reentrant pending neighbor also passes. This seam does not decide U2's external manual-commit policy.

The leading-admission model treats a callback that throws before changing a row as admitting no mutation. Its next same-tick call keeps the leading edge. Both factories and both trailing settings reach that premise. The reviewed code failed the start cut for debounce and throttle. A separate held-handler history checks that a later debounce call cannot cancel an already eligible leading transaction; the original implementation failed at the release cut. The repaired driver observes rows at admission, ordered handler payloads at start, transaction identity, receipt settlement, and absence of a later duplicate. These finite histories do not cover arbitrary-length bursts.

The optimistic transaction owner is packages/db/tests/optimistic-transaction-oracle.property.test.ts, after the stable optimistic-history-oracle.ts contract. The independent rule retains only successful synchronous mutate callbacks. The grammar crosses a prior successful callback or none with three failure operations, then commits a later successful callback; a second witness touches two Collections. The driver compares public rows and pending mutation payload immediately after the throw, then the handler payload at commit. The original implementation failed all three failure-operation kinds at that throw cut; the repair passes all eight manual histories. A restoration-listener fault killed the first repair at the original-error assertion. The final repair restores every Collection and preserves the callback error as the aggregate cause. The paced owner checks the same rule through debounce and throttle. query/scheduler.test.ts checks that abandoned join work cannot publish after the failed callback and explicit rollback. The contract permits transient subscriber notifications while the synchronous callback runs. Nested throwing callbacks and asynchronous work after that scope are not covered here.

The throttle pending-merge witness reaches the timer-to-serial handoff while a first handler is held. It asserts one successor start with both admitted rows, fulfilled receipts, and no later repeated start. The source transition keeps trailingTimeout and serial pending mutually exclusive on that path. The actual-start timing oracle rejects a zero-wait serial pacer with an assertion failure one tick before the required spacing edge; the original non-mutant code passes. These checks do not establish all possible timer schedules or real-server timing.

The committed coverage map names the bounded owners and remaining histories. No new random campaign is claimed. Controlled Collections and fake timers prove the DB source path, not framework scheduling or external persistence.

Oracle guide audit

ORC-001 through ORC-003: guide and transaction documentation state the laws; the paced and optimistic owners keep their model, legal grammar, driver, and comparison cuts beside the code. ORC-004 and ORC-007 do not apply to the new finite matrices. ORC-005 is met by real Collections, transactions, strategies, and handler starts. ORC-006 is met by the original assertion failures and the zero-wait hostile mutant; no timeout is counted as a kill. ORC-008 and ORC-009 are met by the explicit pending-IDs and successful-callback abstractions. ORC-010 uses cleanup helpers that preserve the primary failure. ORC-011 has no named shared semantic fault requiring a second model. ORC-012 is this revision-bound record and the coverage map. ORC-013 is met by failed and successful neighboring admission cases and both sides of timing edges. ORC-014 does not apply beyond the controlled DB boundary claimed here.

Reviewer assessment

The review found several real asynchronous and exception-boundary failures without test execution. Its strongest points were the scheduler stall, leading-edge loss, and canceled leading write. Its weaker points inferred an unreachable stale-timer combination and proposed zero wait despite the actual-start spacing law. It also combined a new throttle regression with a pre-existing transaction error contract. The actionable signal is high, but the proposed fixes require executable calibration and contract separation.