test: spruce up oracle contracts, metamorphic laws, and async coverage

[KyleAMathews]

Goal

Strengthen our existing oracle suites without growing production code or building a universal testing framework. Prefer several small independent checks over increasingly elaborate reference implementations.

Proposed follow-up PR

• Add metamorphic laws where the contract supports them: incremental versus fresh settled query results; backend page-size invariance for completed UI windows; idempotent authoritative replay; independent-key commutation; pending optimistic snapshot stability under unrelated sync/recomputation.
• Standardize public-observation checks: direct reads versus event-reconstructed rows and downstream results at publication boundaries, no torn transactions, no obsolete-session effects, balanced acquisition/release, and redundant-publication budgets where guaranteed.
• Generate meaningful async boundaries, not just operation order. Include begin → truncate → mutation settles → commit, startup/release reentrancy, replay overlap, cleanup, and late settlement. Reuse controlled promises and existing fast-check scheduler support.
• Test the checker with deliberate faults: dropped publication, stale completion, incorrect sibling release, and forbidden rebasing of optimistic snapshots. Each important law should reject an appropriate broken subject.
• Measure executed transitions and meaningful combinations, not just generated commands or test counts. Preserve fixed seeds, random campaigns, shrinking, and replayable minimal histories. Consider fast-check commands only where their preconditions and shrink tracking simplify an existing driver.
• Record each suite's intended contract, observation boundary, independent model inputs, supported history grammar, and explicit exclusions. Do not infer new product guarantees from a reference model's convenient behavior.

Constraints and traps

• Optimistic mutations own whole-row snapshots. Do not merge newer synced fields into a pending mutation merely because a patch-based reference model expects it.
• Metamorphic equivalences need explicit preconditions. Fresh-query comparison checks settled results; it cannot replace continuous-observer checks for partial publication or lifecycle corruption.
• Control scheduling where possible. Permit multiple outcomes only when the actual contract allows them, with whole-outcome and causal constraints—not arbitrary per-field old/new choices. No general linearizability checker is proposed.
• Reference engines are useful only on a genuinely compatible semantic subset. A passing comparison can share a bug, and a disagreement is not proof that production is wrong.
• Keep valuable existing regression tests. Fold minimal counterexamples into a shared oracle driver when practical, rather than deleting coverage to improve test counts.
• Higher run counts cannot repair an incorrect model or unreachable generator dimension.

Starting points

Existing includes cross-formulation and temporal oracles, D2 source-reconciliation commutation laws, subscription replay/lifecycle oracles, pagination and adapter refinement suites, and the optimistic history work in #1807.

Acceptance

For each touched suite, document the law and its limits, demonstrate a relevant deliberately broken subject fails, and show fixed/random runs plus exact replay pass for the correct implementation. Report executed-history coverage and test cost. Keep all additions test-only unless a separately demonstrated production defect needs a narrow fix.

References: fast-check model-based testing, fast-check advanced testing.

[ahrjarrett]

Just want to say that it's cool to see DB using property testing more, curious to see how the metamorphic relations turn out

[KyleAMathews]

Oracle design audit: what the history taught us, and the standard we will use

We are starting this issue with a design and coverage audit, not a blanket
rewrite of the tests. The goal is several small, independent oracles whose
combined coverage is explicit—not a second implementation of the database.

The historical reconstruction covers the oracle work from August 11 through
September 11, including the includes, loadSubset/pagination, recovery, proxy,
optimistic-state, and adapter work. It records 42 initial evidence units;
separate loss checks recovered additional details and rejected ideas. Those
counts are research bookkeeping, not counts of independent bugs. Most daily
records were only partly examined, and historical RED/GREEN reports were not
rerun during this research phase.

Why passing oracles still missed bugs

Missing states were only one cause. Four kinds of false confidence recur:

1. Wrong authority: the reference model encodes the wrong contract or shares
   production's mistake.
2. Missing histories: the generator never reaches a meaningful combination,
   old identity, callback phase, or post-recovery operation.
3. Unfaithful driver: the test harness changes scheduling or provider behavior
   and accidentally repairs or bypasses the fault.
4. Lossy observation: the checker sees final rows but misses intermediate
   publication, order, ownership, errors, or persistence effects.

More random runs help only within the input and observation space the test
actually supplies. They cannot repair a systematically wrong model or mock.

Historical scenes worth keeping

A query shape selected the wrong pipeline. In the includes work around
#1740, the revealing case used a bare
Collection-valued include, an ordered/limited parent window, children already
present for an inactive bucket, and later activation on the same query. Wrapped
includes, predicate filtering, or rebuilding the query tested different paths
or replayed away the damage. The lesson is to witness the intended production
path and its first exposure, not infer it from a test's title.

The observer erased the defect. Sorting actual and expected output before
comparison hid a numeric-versus-serialized key-order disagreement. One-digit
keys also failed to distinguish the orders. In a separate trace-runner case,
an unconditional await let a microtask repair a same-turn mismatch before the
assertion. Normalization and scheduling are part of correctness checking, not
neutral conveniences.

A provider fixture helped broken pagination progress. A mock removed rows
that had already been delivered before applying the request's limit. Production
could repeat an incorrect page and still receive fresh rows. The reference
answer was not enough: the driver also needed to implement the provider's
contract independently. Underfill controls likewise needed a legal cause, such
as post-join filtering, rather than an adapter silently returning an arbitrary
short page.

Large matrices counted the wrong distinctions. Configuration lists included
nullable ordering without null rows and second sort columns whose first column
was unique. Later lifecycle matrices placed reach markers outside the callback
whose phase they claimed to test. A failure-order case made the first argument
also fail first, so it could not distinguish argument order from settlement
order. Required cells need executed witnesses and data that separates outcomes.

Generalizing one regression could lose another law. Testing every receipt
position caught a skipped middle receipt. But resolving all sibling receipts
before rejection then let delayed failure reporting pass. Position needed
crossing with siblings still pending. Similarly, testing successful repair as
the endpoint missed stale handles exposed by the next window change or truncate.

Two query formulations agreed on the same bug. A lazy and a fully loaded
query both collapsed reference-sensitive identities. Differential agreement
could not establish correctness; an independently specified identity model was
needed. This is why “two implementations” and “independent authority” are not
synonyms.

A stronger expectation was sometimes wrong. The optimistic-state work
around #1807 had to preserve the
existing whole-row snapshot contract. A convenient patch/recompute model could
instead demand rebasing or source resorting that the product did not promise.
The oracle must not quietly redefine the library to make its model simpler.

Adapter realism changed the result. The final
#1785 work added cold persistence,
metadata writes, already-bound configuration reuse, and cleanup inside callbacks.
A warm in-memory fixture could not establish cold-resume correctness; an
invented reset batch could not establish a valid SDK path. Broader synthetic
robustness tests remain useful, but their claims must stay distinct from
conforming-protocol behavior.

These are historical lessons, not claims that those defects remain open.

Research: common language and useful limits

The bounded survey inspected 20 sources, including three at abstract level.
The following are the most useful starting points for this work:

• Executable models and stateful generation:
  fast-check model-based testing
  and Hypothesis stateful tests
  separate actions/preconditions from the model. A model should simplify the
  subject, not copy its branches.
• Refinement: Abadi and Lamport
  give the language of implementation behaviors permitted by a specification.
  For our purposes, this means comparing a coherent visible history, not demanding
  matching internal state machines. The testing grammar below is not a formal
  refinement proof.
• Metamorphic and differential oracles:
  SQLancer supplies several complementary
  query relations. NoREC explicitly describes
  shared semantic bugs and the limits of count-only comparison. Cross-formulation
  checks need semantic preconditions and independent anchors.
• Causal scheduling:
  fast-check's scheduler documentation
  explains that delaying a promise's result does not delay the underlying
  operation. CHESS
  likewise depends on modeled scheduling boundaries. We must control starts,
  partial effects, and enabling dependencies where they matter.
• Bounded exploration and nonvacuity:
  SmallCheck
  describes exhaustive small values; Alloy's tutorial
  shows how a too-small or overconstrained domain can miss a counterexample.
  “Exhaustive” must name its domain and prove it contains meaningful cases.
• Recovery testing and realistic faults:
  FoundationDB's paper describes
  recovery checks and simulation limits. Excessive fault injection can shrink
  the explored state space; an inaccurate environment contract can still hide
  defects.
• Mutation adequacy:
  Just et al.
  and Papadakis et al.
  support using mutants while qualifying what aggregate scores imply. We will
  record assertion kills, timeouts, survivors, equivalent mutants and no coverage
  separately—not treat a score as a probability of correctness.
• Incremental result laws:
  DBSP relates computing over
  accumulated inputs to accumulating computed output changes. That is a useful
  authority for incremental semantics, not a specification of readiness,
  cancellation or publication. Materialize's testing account
  reinforces the need for different checks at different system surfaces.

This survey supplies vocabulary and evidence boundaries. It does not prove the
following grammar sufficient, and comparative maintenance-cost evidence is thin.

The proposed design grammar

“Grammar” here means the parts a trustworthy oracle needs and the rules for
combining them. These are six roles, not six modules or a universal runner:

Role	Question it answers
Contract	What behavior is promised, under which assumptions, and what is unknown or excluded?
History	Which initial worlds, actions, identities and causal dependencies can be generated?
Authority	What independent model, reference, relation or invariant determines acceptable observations?
Driver	Which real production path runs, and what environment/scheduling behavior does the harness supply?
Observation	What is captured, at precisely which checkpoint, without erasing contractual distinctions?
Witness campaign	What proves the intended case ran, the checker could fail, and a failure can be reproduced?

The connections are load-bearing. A legal command must actually reach its driver
path. The driver and observer must agree on the checkpoint. The authority and
observer must compare the same semantic projection. Campaign evidence must
demonstrate those connections rather than merely count tests.

Construction rules:

1. State the law before generating inputs. Separate safety, conditional
   liveness, and justified resource/work bounds. Unknown product contracts stay
   questions; convenient model behavior cannot settle them.
2. Keep the answer independent. Audit shared helpers and mutable fixtures.
   Preserve reference/alias relationships where relevant. Finite models need
   representatives for all distinctions claimed by the law, including tails.
   Name what the model erases and justify why legal later actions cannot make
   that distinction observable. Present-output agreement alone is insufficient;
   bounded continuation checks support only their declared scope.
3. Generate consequential legal histories. Include retired identities and
   post-recovery use. Enumerate required finite structural cells; use random
   generation for broader values and histories. Record unexplored interactions
   rather than claiming pairwise coverage is complete.
4. Drive causes, not just completion order. Include starts, partial writes,
   callback reentry and enabling dependencies. Use causal gates, not arbitrary
   microtask counts. Keep invalid-input robustness separate from valid protocols.
5. Compare coherent observations at relevant cuts. Initial exposure,
   intermediate publication, cleanup and later use can matter. Where multiple
   outcomes are allowed, the whole observed prefix must have one consistent
   explanation—not an arbitrary mixture of individually allowed fields.
6. Test the checker. Prove meaningful reach and nonempty observation domains;
   keep valid controls and representative broken subjects. Calibrate driver and
   checker wiring too. A test that times out has not necessarily exercised the
   assertion it claims to validate.
7. Keep failures diagnosable. Preserve property ID, concrete minimized
   history, seed/path/schedule, source/build versions and immutable observations.
   Exact known-defect waivers must not swallow setup/cleanup errors or collateral
   damage. A poisoned suffix is blocked, not covered.
8. Preserve laws during change. Reopen excluded inputs after fixing their
   defect. Keep useful examples and controls; remove tests only with a replacement
   law/path witness or an explicit retired product promise. Share mechanics, not
   a sprawling second database. Independently inventory known product promises
   and map them to the union of suite witnesses, including promises no test
   currently claims. Otherwise every partial suite can honestly pass while an
   important contract disappears from the audit.

The state-erasure rule is central to keeping models small without copying
production. Two states may show the same row and the same owner count, while
one row belongs to old acquisition A and the other to replacement B. Releasing
A distinguishes them. A rows-and-counts model cannot erase that relationship
merely because the current output matches. Conversely, a distinction that no
allowed continuation can expose is a candidate to leave out of the model.

A compact per-law record should therefore answer:

Law and contract source:
Generated worlds/actions/dependencies; finite bounds and exclusions:
Independent authority and any shared-helper justification:
Real production boundary and environment assumptions:
Observation cuts and exact compared surfaces:
Required executed witnesses and fault/valid controls:
Replay coordinates and replacement coverage for older regressions:
Known unknowns and the next discriminating probe:

An independent fixed example is still a useful partial oracle. Prefer extending
a general law where practical, but do not delete a focused boundary test simply
because it has no random generator. Nor should every tiny partial oracle be
forced to model the whole library. Fixed regressions may deliberately overlap
the generated domain, including an exhaustively checked small domain.

Validation and audit plan

Grammar v2 has been reconstructed against 14 historical scenes. The fresh
hostile design audit found four issues in v1: omitted suite-level promise
accounting, insufficiently explicit continuation checks for erased state,
wording that could require fixed/generated inputs to be disjoint, and an
overstated ablation claim. All four prompted revisions.

The ablation control now asks what is lost when an obligation is removed
everywhere it appears. Removing one sentence does not remove an obligation
repeated elsewhere; it did not justify claiming six irreducible labels. These
are analytical controls, not current runtime tests or a proof that the grammar
is minimal. No independent held-out range case has been established.

The inventory is pinned to tested head
541ab9f8ea2c60fda8728549288ff9e69ab103b7. It contains 132 candidate/support
entries, including 45 named-oracle or fast-check files. These are not 132
independent oracles: shared contract registrations and harness files repeat or
support laws. Another 197 test files remain discovery leads.

Next, grade law × driver × observation surface, then reconcile sibling
coverage against the independently scoped contract inventory. Each dimension
gets a status and evidence tier:

• Dimensions: contract, authority, history/reach, driver fidelity, observations,
  calibration, replay/diagnostics, maintainability/coverage conservation.
• Status: supported, gap, conflict, unknown, or not applicable with a reason.
• Evidence: source-inspected, executed, or calibrated against a specific fault.
  A fault kill does not upgrade unrelated laws or adapter instances.

We will not average those into one numerical score: perfect replay cannot make
an incorrect authority trustworthy. Each finding should identify the missing
distinction, a concrete wrong behavior that might pass, and the smallest probe
that would distinguish a test gap from a production bug or contract question.

The output will be a keep/strengthen/consolidate/remove-with-proof/add plan.
No tests will be removed just to reduce counts, and no production behavior will
be changed merely to satisfy a new model.

Revision: gist integrated into grammar v3

The testing-DSL guide was intended as design input, not just a later reading suggestion. After reading its full snapshot, we retained the six roles and strengthened two obligations:

• Name and discharge environment assumptions. For each material premise, identify its responsible provider, source/version, provider witness, connection to the consumer, and whether the required antecedent was reached. A unit oracle can validly assume its dependency's contract; two suites using helpful mocks do not establish that the real components compose. Missing connection evidence stays conditional or unknown, not silently green.
• Separate valid commands from raw observations. A typed builder may generate legal histories. Its recorder must still preserve relevant violations—duplicate callbacks, stale-session events, wrong order, unexpected errors—so an assertion can reject them. Invalid-input tests are separate and need an actual rejection/containment contract; we are not adding arbitrary malformed-SDK support.

For example, mocking cancellation as automatically closing a stream cannot establish that a real adapter closes a stream whose acquisition finishes after cleanup. A stream being unlocked also does not establish that it was canceled. That boundary needs its own witness or a narrower claim.

The guide's hybrid models, trace checks, causal scheduling, small-scope exploration, mutation calibration and bidirectional specification accounting already fit v2. We are not adopting universal snapshot sorting or blanket disabling of shrinking; both could weaken this portfolio.

The historical records and v2 grades remain preserved. All three initial source assessments have now received targeted v3 rechecks; later assessments start with v3. The structures grades stayed unchanged. TrailBase gained two concrete test-gap candidates: its subscription mock ignores the requested record id, and error logs arriving after the last assertion can be cleared before judgment. These are source-level gaps, not reproduced runtime bugs. This changes the audit questions, not production behavior. V3 has author-side analytical controls; independent hostile closure remains pending because the auditor could not be resumed under the task's agent-thread limit. No formal completeness or new runtime verification is claimed.

---

Portfolio audit result and test-only repair proposal — 2026-09-11

This closes the bounded source audit, not a proof that all possible states or every repository test have been audited.

Baseline: 541ab9f8ea2c60fda8728549288ff9e69ab103b7. The corrected manifest contains 329 unique tracked paths: 132 selected entries (45 named/generated files, 21 adjacent files, 66 shared-contract/runtime registrations) plus 197 remainder files. Registrations and helpers are not independent oracles. All selected entries now have source assessments with explicit reading/provider limits. The 197 remainder files have discovery-tier dispositions and preservation owners; they are not 197 full semantic reviews. Some fixed tests from that group were separately read as complementary witnesses.

No production/test changes or new test campaigns were made during this audit. No new production defect was reproduced. Source-supported false-green paths and coverage gaps need calibration before turning into runtime bug claims.

What to keep

Keep the strong independent whole-row history models, weighted D2 retraction checks, graph reference algorithm, index/Map comparisons, raw includes-order and facade controls, lifecycle ownership matrices, native proxy comparisons, durable storage reopen tests and real provider probes. They cover different promises and boundaries. Replacing them with one shared state machine would risk copying production into a second implementation.

A fixed example is not inferior merely because it is not generated. Several apparent generated-suite omissions are already covered by useful fixed companions:

• Post-unsubscribe physical settlement and full restart prefixes already have replay/storage witnesses.
• Automatic-repair tests already cover bounded attempts, the first-delay exclusion and explicit recovery after exhaustion. The documented second delay needs a more precise cut, not a new behavior policy.
• React's server-page probe already forces ties across backend/UI boundaries and checks exact ordered prefixes. This does not establish equivalent coverage for every framework or exact page-array contents.
• Fixed value/proxy tests cover symbols, cycles, aliases and live iterator semantics omitted by broad generators.

Keep these distinctions during consolidation.

Main blind-spot patterns

1. The recorder or assertion discards the bug. Ordered results get sorted before judgment; only the first root is read; counts replace exact content; a callback flag can be overwritten; empty .every domains pass; cleanup occurs before a decisive read. Repair observation first.
2. The history misses the causal condition. Correlation keys vary together, leading sort fields are unique, transformations are no-ops, retries reuse the same rejected Promise, or an “immediate” check occurs after an async boundary. More seeds do not repair missing dimensions.
3. The provider makes the consumer look right. A preordered fixture can ignore a wrong order request; a mock can suppress obsolete callbacks itself; a subscription mock can ignore the requested id. State and enforce conditional fixture domains, then establish real provider/consumer connection where integration is claimed.
4. The expected answer shares too much with production. Mutable data, production comparators/key functions and model-fed provider results narrow independence. These may remain valid partial laws, but cannot certify the shared dependency.
5. Campaign names overstate execution. Registry membership does not prove targeted replay ran. Named test:oracles scripts omit some audited laws. Shared native/runtime names can refer to unit shims, disabled entries or insufficient run counts. Report actual law→file→command→environment reach.
6. The portfolio loses unique witnesses during cleanup. Repair at law × history × driver × observation level, not by removing similar-looking files.

Grammar clarification from the final hostile check

The six roles and core obligations remain useful. One operational preservation gap needed correction: P7 mentioned held-out cases, but the campaign card did not require their future accounting.

The v3.1 operational addendum requires provenance: design/tuning case, existing regression, new discovery, or held-out challenge. When claiming generalization, reserve a companion-owned challenge until the model/checker is frozen, or record justified not-applicable/unknown. Once a challenge informs a fix, it becomes a regression, not held-out validation of that revision. Fresh reviewer context or a new random seed alone is not held-out evidence.

No held-out campaign was executed here. Research remains bounded by twenty sources/access budget, not saturation; S8/S14/S18 were abstract-only. Historical reconstruction also includes explicitly partial reads. The method is evidence-grounded, not a formal completeness result.

Proposed packets

These are proposed scopes, not permission to change production. Exact file ownership and local finding IDs must be frozen before dispatch.

Packet	Focus
P00	Shared mechanics: targeted replay must execute the selected law; complete campaign manifest; exact failure-checker controls; failure-safe cleanup preserving evidence.
P01	Values/cursor/query identity: no NaN sign collapse or vacuous conditionals; independent mixed-value/output contexts and compiled-result identity checks.
P02	Hash/graph: meaningful permutations, unequal/equal controls, cycle versus DAG, full opaque-reference replay context; no universal collision-free hash claim.
P03	Index/BTree: independent worlds, exact values/order/neighbors, retired identities, tie order, same-instance rebuild continuation.
P04	D2: cumulative signed output separate from delta/work counters; independent top-K order after updates; bounded per-operator incremental laws and actual public wiring.
P05	Optimistic/metadata: preserve whole-row snapshots; observe Promise outcomes, public trace cuts and final settlement; real deletes and multi-operation histories.
P06	Includes: raw order/cardinality/callback records, pre-cleanup and in-action cuts, independent correlation axes and meaningful route histories; preserve rejection and old-snapshot laws.
P07	Lifecycle/replay: fresh-success retry, nonempty subscriber witnesses, late cleanup suffix, caller outcomes and delegated-storage checks under their stated contracts.
P08	Ordered demand/pagination: complete request semantics, pending windows, tie/null histories, exact documented retry cuts; keep ownership/work separate from output truth.
P09	Electric/serializer: full parsed content, immutable raw recovery traces, metadata and early rejection; versioned SDK framing distinct from synthetic robustness.
P10	Query/TrailBase: distinct-demand negatives, exact edges, public lifecycle/provider connections, wildcard arguments, late streams/errors and canceled caller outcomes.
P11	PowerSync: preserve and inspect ordinary tracking/rebuild/ownership matrices first; derive a small contract-backed complementary model, not assume no fast-check means no coverage.
P12	Persistence/E2E: exact content/order/work, reachable antecedents, every registration and environment, real durable/lease outcomes; no native claim from shim-only runs.
P13	Frameworks: exact rows/pages and raw promised fields, safe ownership, measured scheduler cuts and restricted-provider guards; retain React tie/capped-provider controls.
P14	Proxy/storage complements: nonvacuous native-law assertions, exact Map keys, settled async effects, durable failure→later success→reopen controls.
P15	Offline/RxDB remainder: contract-first inspection of skipped serialization/schema-rollback and ordinary fixed laws; preserve tests before proposing new models.

Oracle architecture refactoring

Refactoring belongs inside these repairs. Consolidate repeated capture/replay/cleanup mechanics; split mixed-contract suites when that clarifies relation truth, publication timing, ownership and work; move provider/SDK assumptions to their responsible adapter tests while retaining real connection witnesses. Separate cumulative semantic verdicts from raw delta/acquisition counters.

Do not centralize independent expected-answer models or remove fixed cases merely because they resemble generated histories. Any consolidation or split needs a before/after responsibility and law map, unchanged accepted traces for pure moves, stronger-checker calibration for actual repairs, affected-consumer runs and a separate blocking loss audit. Retain cross-boundary interaction tests so cleaner components do not create new gaps. Repair false greens before large structural moves; no wholesale framework rewrite is proposed.

Sequence and acceptance

Wave 0: P00 owns shared test helpers. Domain authors can inspect/prepare in parallel but cannot edit shared files concurrently.

Wave 1: repair known false greens in independent families. Share mechanical capture/replay tools where useful, not semantic models. Small patches, owned paths, preserved fixed controls.

Wave 2: extend meaningful histories and provider boundaries; deeper ordinary-test inspection is explicit work, not retroactively claimed completed auditing.

Wave 3: serial audited integration, affected-consumer/package gates, targeted replay and bounded random campaigns; then a budgeted 100× campaign over an explicit manifest. A timeout is not a semantic fault kill, and unavailable native/service environments stay unverified.

Each repair author must hand a frozen patch to a separate blocking loss-audit companion. The handoff includes:

• Contract, independent authority, valid history domain and actual observed cuts.
• An old false-green demonstration where practical, wrong-result sensitivity control and nearby valid case.
• All historical law/path witnesses and any replacement map.
• Exact seed/path/history/schedule/runtime and verified replay.
• Complete Promise/error/cleanup evidence.
• A no-production-diff check.
• Held-out challenge provenance or explicit NA/unknown.
• Any runtime red or contract question kept separate.

With four seats, a practical arrangement is two authors, a rotating independent auditor and a coordinator. No author approves their own patch. Shared-helper integration is serialized.

Possible states: audited green, audited red witness / production fix needed, blocked on contract, blocked on evidence, not yet audited. Valid new reds are preserved separately, not hidden in broad expected-failure classifiers or repaired by changing production under test-only authority.

Decisions left for packet-local clarification

Most assertion and harness repairs need no new product policy. Resolve existing sources before asking maintainers about: permissible callback/retract traces and exact notification counts; framework absent-field/config-omission semantics; valid fractional top-K multiplicity/negative-offset domain; normalization guarantees for non-Error failures; private delegated-buffer representation; and conflicting unordered setWindow documentation. Adapter assumptions need versioned contracts and execution evidence, not an invented universal recovery policy.

Settled choices remain settled: whole-row optimistic snapshots, supported live Map/Set iteration, explicit unsupported-form errors, retained stale data after failed bounded repair, first-error policy, and no production behavior changes in this project.

The detailed local report set retains every finding, complement, refutation and uncertainty. This comment is the durable portfolio-level plan; it does not certify future repairs or widen their authority.