PR #2116: earlier findings and guarantee decisions

This record separates findings discovered during the unit-test retirement workflow from the bounded fixes retained in PR #2116. The transfer ledgers remain the authority for retired assertions. The confirmed-fixes review records the baseline and hostile evidence for fixes that this PR now keeps. A finding below is not closed by passing a neighboring transfer oracle.

Finding	Authority and evidence	Next owner and witness
R29: two valid Temporal.Duration values can have the same display text but different fields. A changed field can be suppressed as an equal Collection value.	Closed in this PR for the tested direct and Collection paths. The Duration field model checks all ten fields; a same-display replacement and adjacent-unit histories make the former deepEquals and change-event behavior fail before the repair. The query equality owner and in evaluator owner separately check Duration field identity.	General multirow and live-query publication histories remain outside these owners. Add them to the relevant owner if a new failure reaches those paths.
R16: an indexed Collection can admit a valid Temporal row whose index comparator has no public order, then throw after partial state changes.	Earlier PR revisions recorded RED admission and publication traces for Duration, PlainMonthDay, and mixed-kind rows. A paired probe on origin/main bbbf017ef5 and PR head 0c10ae8e8 found no failure: 190 valid Temporal pairs per index type and revision passed direct insertion; 24 two-row sync and optimistic Collection histories retained both public rows, exact memberships, ordered storage, ready status, and both insert publications at the second write return. The earlier RED traces establish an intermediate-branch failure, not a current-base or current-head defect. Public query comparison errors remain separate from internal index storage order.	No admission repair follows from this evidence. If a valid current-head admission history fails, extend the direct-index and Collection publication owners with exact membership, ordered storage, stored rows, and subscriber observations before changing production. The probe does not cover all valid Temporal values, native-host implementations, updates, builds, or longer histories.
Mixed-kind indexed order and custom-index query selection may disagree with public query results.	The source-Map owner closes the mixed number/string direct-index key loss. The new scan-versus-index owner rejected the frozen PR's wrong mixed-kind public prefixes, and the current guard makes the tested eager paths use the query's order. A retained on-demand BTree history checks visible prefixes after a number/bigint transition, a missing-row finite request, and a later cursor request that still traverses the index; all settled public windows match independently sorted provider rows. A reverse manual index produced a wrong direct prefix on an earlier branch revision; the current three-rank owner checks direct, eager, and prepopulated on-demand public results. The reviewer withdrew its claimed live-query failure after fixing a cross-checkout @tanstack/db-ivm resolution error. The maintainer withdrew a per-row custom callback position guarantee for comparator-equal exact values.	Other retained on-demand paging sequences, different incomplete-source patterns, and later live updates need public-result witnesses. The owners do not define a universal precedence among unlike kinds.
Indexed ordering can suppress a required Temporal comparison error.	Changelog #1519 requires TypeError for mixed or unordered Temporal values. On clean origin/main, indexed direct reads returned rows for PlainDate beside PlainDateTime and for two distinct PlainMonthDay values while the scan threw. The new Temporal exception lane fails on those four baseline indexed reads and passes on this branch; eager live queries already threw on main.	The bounded direct-read repair is complete for these pairs. On-demand acquisition, later updates, and other mixed Temporal pairs need separate witnesses before claiming the whole exception class.
R17: an equal-time Date removal left an ordered ghost under added index machinery.	The recorded RED trace depended on code introduced during this PR. It does not establish an origin/main defect. The stronger rule for a substituted old row with a different callback position was withdrawn.	If ordinary direct remove/update still has a current-base counterexample, add a source-Map history to the direct-index owner before changing production.
PlainDate extended-year order under lexical string collation can diverge between scans and indexes.	On origin/main, a ready scan returns -100000-01-01 first while BasicIndex and BTreeIndex direct public reads return +010000-01-01. The new Temporal owner checks calendar order from the supplied years and fails on those two baseline direct reads. Both direct indexed reads pass on this branch. Baseline eager live queries already returned the right first row.	The fixed ready-source direct-read history is closed. Other extended-year pairs, later updates, and on-demand publication remain outside the current witness.
Cross-realm native equality was asserted by a surviving request-transport unit test.	PR #1797 captured the then-current instanceof result. No public realm-distinctness promise was found. The maintainer questioned that distinction. This PR removes that incidental test expectation and makes no cross-realm equality claim.	A future public contract decision needs a host-boundary witness before either equality policy becomes an oracle law.

The 2026-10-13 review expanded the custom-index owner to three ranks and a two-row window. The reported [20,30] public result came from a scratch test that resolved @tanstack/db-ivm from another checkout; with the correct package, both frozen PR head 16b219224 and origin/main returned [10,20] at the reviewer's read checkpoints. The reviewer withdrew that finding. A separate paged-provider witness now reaches a retained on-demand mixed-kind index after its domain changes. It checks public rows after a finite request fills a missing prefix row and after a later cursor request traverses the retained index. Wrong-provider controls that withhold either requested row fail the public comparison. Other provider histories remain untested; this witness does not establish general safe traversal of an ineligible retained index.

Captured inArray list-entry refresh and whole-live-query reconstruction were explored as new features. The pre-PR evaluator and live graph did not already deliver the whole-result behavior. The maintainer withdrew that expansion for this PR because of its production-code and query-planning cost. A separate proposal must define its dependency and invalidation boundary before adding an oracle or production graph machinery. In-place edits to a Date or byte item, unsigned default byte ordering, and guarantees after callers alter standard objects are also outside the accepted contract.

Earlier experiments and RED/GREEN records remain in published commits on codex/oracle-test-retirement-2-blocks. This PR restores the confirmed, bounded fixes described above. The R16 and R17 rows still distinguish earlier-branch observations from a current-base failure; neither justifies new production machinery without a baseline witness under the accepted law.