Convert the files demoted from oracle owners back into oracles

Read the oracle rubric at docs/contributing/oracle-rubric.md, then inspect the listed demoted test files and their renamed counterparts, including collection-subscription-lifecycle-cells.test.ts. For each law, determine whether an oracle model applies, add generated or fixed histories with declared checks, and verify a hostile regression fails. Done means the coverage map records each new oracle owner and its limits, or a maintainer decision with a reason for rows where an oracle is impractical.

Problem

The oracle/no-unit-test lint rule (#2234, step after #2237) requires every test in an oracle file to reach a declared check, model, or grammar. A test that compares production with a hand-written value is a unit test, and it moves to an ordinary test file.

During the migration, some files named as oracle owners had no check or model at all. Every expectation in them is a hand-written value. The migration renamed these files to ordinary test names. Their tests still run unchanged, but the laws they owned now have only focused tests and no oracle coverage.

This issue tracks each demoted law until it has an oracle again. A maintainer can also accept focused tests for a law. Then the coverage map records the gap.

Demoted owners

Oracle-style tests that moved to an ordinary file

• packages/db/tests/collection-subscription-lifecycle-oracle.test.ts: four scenario tables (start, failure, release, and restart ownership) moved to collection-subscription-lifecycle-cells.test.ts. Their expected values are computed from the scenario, so they are oracle-style tests. They are also the only recorders of some acquisition cells, and the afterAll coverage audit sees only recorders in its own file. Restore: extract each table's computation as a named model. Then put the cell witnesses and the audit in a structure that keeps them together in an oracle file.

• packages/query-db-collection/tests/persisted-direct-write-window.oracle.test.ts: the "direct writes interleaved with refetches follow the precedence model" suite (about 12 tests) moved to persisted-direct-write.test.ts. The file kept its reference-collection matrix as an oracle. The precedence section states five rules as a model (write order, accepted-only precedence, newest-wins per key, refetch settles after its rows apply, retired writes reject), but each case states its expected rows by hand. These rows of the file's ownership table now have no oracle owner: rejected writes gain no precedence, a later accepted write keeps precedence, refetch settles after its rows apply, and cleanup during the wait rejects. Restore: write the five rules as a model over a history of writes, fetch starts, fetch results, and cleanup. Then generate interleavings, and compare rows, Query cache, and stored rows with it.

• packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts: three cases whose prose names a model moved to electric-sdk-delivery.test.ts. Each states its expected rows by hand. The cases: "discards an old SDK snapshot after managed cache rotation" (source model), "serializes concurrent subset snapshots on one SDK stream", and "satisfies subset demand after a fresh persisted launch" (4 cases, "independent model"). Restore: write the source and cache-generation model as a function, generate rotation and snapshot interleavings, and compare public and stored rows with it.

• packages/offline-transactions/tests/leadership-replay-oracle.property.test.ts: "never fulfills an unadmitted action when it $history" (4 cases, prose "safety relation") and "does not readmit a permanently rejected row from a stale outbox read" ("Law:" comment) moved to leadership-replay.test.ts, with 13 other pinned cases. The oracle keeps its generated campaigns and the ledger fold model foldReplayLedger. Restore: state the safety relation as a predicate over the ledger fold, and add those histories to the generated campaigns.

• packages/electric-db-collection/tests/electric-sdk-delivery-oracle.property.test.ts: "quarantines uncertified cache rows across later scoped demands after $cause" (3 cases) also moved to electric-sdk-delivery.test.ts. It is the only test of the scoped-restart law: after tag state is lost, a persisted row is only a cache, and a later scoped snapshot must not re-admit a removed row from SQLite. Restore: a source model that changes and removes rows while the Collection is closed, generated demand orders at the second launch, and a comparison of public rows and local reads with it.

• packages/offline-transactions/tests/transaction-settlement-oracle.property.test.ts: 19 hand-written cases (42 tests) moved to transaction-settlement.test.ts. The opening prose still states laws for held deletion, retry deadlines, and hook faults, but only those cases test them. preserves the default retry deadline when the hook agrees compares production with a no-hook production run. This is a metamorphic relation, so it can come back as a generated property over hook decisions. Restore: add held deletion and hook faults to the generated settlement histories, and compare with expectedRetryDecision and the FIFO local-row model.

• packages/query-db-collection/tests/ownership-lifecycle.oracle.test.ts: 138 hand-written registrations (359 tests) moved to ownership-lifecycle.test.ts. The oracle keeps the result-settlement, refetch-call, handler-boundary, and mutation-refresh reducers, the reacquisition and published-owner models, and the direct-write history drivers. Many moved suites name an "independent reference" or "model" in their prose, but each case states its expected rows by hand. The largest families: direct-write ownership and reconciliation after refetch; eager cache-patch projection through a Query shared by two Collections; retry and revalidation error visibility; and reacquired claims across release publication. Restore: extend the ownership-graph reference to direct-write positions and shared-Query cache patches, then turn these families into generated histories against it. Also: observeHandlerIdentity stays declared as the identity model, but its prediction is constant (every alias preserves identity), so it is weak evidence.

• packages/node-db-sqlite-persistence/tests/expression-index-oracle.test.ts: two hostile-mutant kills (the overbroad mutant and the legacy path-binding mutant) state their expected verdicts by hand. They moved to expression-index.test.ts. The generated scenario grammar's per-kind expected keys hold by construction but are not a named model. Restore: add both mutants as fault kinds of the generated property, and state the scenario construction as a model.

• packages/react-native-db-sqlite-persistence/tests/op-sqlite-driver-oracle.test.ts: frozen provider receipts ("decodes frozen provider receipt" and two neighbors) and the malformed-envelope table with its calibration moved to op-sqlite-driver.test.ts. Adversarial envelope coverage now lives only in unit tests. Restore: a generated envelope grammar with a verdict model, and a receiving witness that declares the recorded receipts.

• packages/browser-db-sqlite-persistence/tests/browser-coordinator-oracle.test.ts: 174 fixed-scenario tests moved to browser-coordinator.test.ts. The oracle keeps the leadership need-table cells and five generated RPC, disposal, and retention properties. Moved tests whose prose names an independent reference but whose expected values are written by hand:

  • surviving source Collection stays usable
  • reconciled stream position ("adapter log is the independent sequence reference")
  • passive follower stays on the newer elected route ("independent ledger increments once per election")

  Restore: generated election and reconciliation histories, compared with an election ledger and a stream-position model.

• packages/db-sqlite-persistence-core/tests/persisted-oracle.test.ts: 624 fixed-scenario tests moved to 13 ordinary persisted-*.test.ts files. The oracle keeps five generated-history drivers, the snapshot, ledger, reconciliation, FIFO, and hydration-source models, and the follower demand and reacquisition models. Laws that now rest only on fixed tests, and that the oracle's prose no longer claims: cache-generation claims and seq-gap timing, construction and descriptor ownership, admission characterization, retained on-demand acquisition failure, and partial-update dependency work counts (expectPendingKeyMembershipWork takes its expected count from the caller). Restore: generated claim and renewal histories against a claim-lease model, and a work-count model for partial updates.

• packages/db/tests/query/includes-context-transport-oracle.test.ts: the dotted and nested path witnesses, the cycle and accessor tests, and the query-ref metadata cells moved to includes-context-transport.test.ts. They state their expected values by hand. These ARCHITECTURE.md laws now rest only on those fixed tests: route-metadata discovery never invokes an accessor, cycles survive metadata removal, and plain record results carry route metadata under a private symbol. The object-query-ref-scalar branch of runPublicSurfaceCell still writes literal anchor ids inside the declared driver. Restore: add accessor-valued, cyclic, and query-ref rows as dimensions of the route-context grammar, and compute the scalar-anchor expectation from the source rows.

• packages/db/tests/query/includes-temporal-oracle.test.ts: 36 tests moved to includes-temporal.test.ts. They are hand-written scenarios, including the prose "Model B" (demand cancellation) and "Model C" (progressive delivery) cases. The oracle keeps readiness, scheduled settlement, release reentry, and lagging-source readiness. These ARCHITECTURE.md laws now rest only on fixed tests:

  • law 6: obsolete demand does not block readiness, and an obsolete acquisition does not complete the current preload
  • law 7: "waits for actual source application"
  • law 9: failed replay retention, and failed-replacement visibility
  • law 10: fragmented churn consolidation, failure preservation, obsolete replacement, and growth loading only uncovered keys
  • progressive timing

  Restore: an independent demand-churn and cancellation model, and a progressive-publication model, both driven by generated schedules.

• packages/db/tests/query/includes-alias-shadowing-oracle.test.ts: six rejection and identity witnesses moved to includes-alias-shadowing.test.ts. They are ancestor and descendant alias reuse, union duplicate branch, nested-include rejection, missing captured projection, and repeated spread identity. These ARCHITECTURE.md identity laws now rest on fixed tests only. Alpha-renaming keeps its oracle. Restore: generate alias placements over the include tree, and compare acceptance and the error class with a scope model. Also, load-subset-replay-refinement-oracle.test.ts's checkOrderedReplay still computes its expected window inline, so name it as a model.

• Weak models accepted during the migration, kept declared but worth strengthening: local-storage-order-oracle.test.ts (expectedManualAfterAutomaticInsert and expectedUnawaitedManualRows are boolean-keyed literal tables), persisted-oracle.test.ts (modelSourceReconciliation has two fixed states), and the browser coordinator's need table.

• packages/db/tests/optimistic-transaction-oracle.property.test.ts: 14 fixed scenarios moved to optimistic-transaction.test.ts, including the failed-callback and replacement cases. The failed-callback restoration law now has no oracle case. Restore: add a failing mutation callback to the transaction drivers' history grammar, and compare the restored rows with the expected world.

• packages/db/tests/query/ordered-lifecycle-oracle.property.test.ts: the nullable-order model expectedNullablePaletteIds is a written palette table (9 rows, four group orders, both null placements), not a computed sort.

• packages/db/tests/query/includes-alias-shadowing-oracle.test.ts (second pass): 74 more cases moved to includes-alias-shadowing.test.ts. The ARCHITECTURE.md Identity law "a bound reference captured from an unrelated query is rejected" now has no model-checked owner. Its cases are join operands outside lexical scope, non-join expressions, include filters, correlations, hidden inner bindings, and sibling captures. validate-aliases.test.ts covers only same-scope and union rejection. The moved describe joined subqueries reject captured sibling sources cites an "independent scope model" that does not exist in code. Two alpha-renaming identity checks are now unit tests as well. Restore: a lexical scope model that predicts acceptance or the error class for generated reference placements.

• packages/db/tests/query/ir-stable-identity-oracle.test.ts: 50 tests with hand-written identity equalities moved to ir-stable-identity.test.ts. Generated "distinct when not equivalent" coverage now exists only for output programs and reference-valued captures. These are now unit tests only:

  • argument order of function calls and orderBy
  • the limit/offset window
  • groupBy/having normalization
  • union source ordering
  • demand-key exclusion of cursor, signal, and subscription
  • custom comparator identity
  • __proto__ keys
  • invalid Date/Temporal equality
  • captured status values

  The coverage map says this oracle owns demand-key encoding, but only two generated tests now reach getLoadSubsetDemandKey. Restore: extend the canonical-form model and its generated grammar to those dimensions.

• packages/db-ivm/tests/temporal-group-key-oracle.test.ts: its "bounded grammar" is the fixed temporalCases list, with no generated histories. packages/db-ivm/tests/hash-oracle.property.test.ts: the calibration of expectEqualHashes moved to hash.test.ts, so no declared check calibrates that comparison.

• packages/db/tests/indexed-db/persistence-oracle.test.ts: runHistory keeps its model as inline state interleaved with production calls. local-write-order-oracle.test.ts compares inline per cut. transport-oracle.test.ts moved 29 literal scenarios to transport.test.ts. Name the inline models so that the checks are separable.

• packages/db/tests/conformance/infinite-suite-oracle.ts: eight scenarios that state literal outcomes (error messages, boolean settlement flags) moved to infinite-suite-cases.ts, which runs in the same cross-framework describe. The "fulfills only after the window request fulfills" law (fetch-settlement) has no model-based check. Also, expectPageRows in page-laws-oracle.ts is declared as a check but takes its visible rows from the caller. It checks the page-partition law over them, and 14 conformance scenarios reach a part only through it. Their visible rows are written as source slices such as rows(8).slice(0, 6). Restore: a visible-window model computed from the source, page count, and edits, so that expectPageRows compares with the model instead of a caller-written slice.

More rows can come: the migration is not complete. The migration adds each new demoted owner here.

What done means, per row

• An oracle file with a declared check (and model, if one applies) that the law's tests reach, with generated or fixed histories. Follow the oracle rubric.
• A RED result: a hostile mutant, such as the regression that the law guards, fails the new oracle.
• The coverage map names the new owner and its limits.

Or, for a row where an oracle is not practical: a maintainer decision, recorded in the coverage map with the reason.

Refs #2234